Last year, I’ve found my client’s AWS account access and secret keys pushed to git, and visible in 23 different locations in the application’s codebase. After requesting an immediate removal, I used the awesome GitLeaks tool to scan the project’s history. GitLeaks allows you scan a project’s entire history, rather than its current state so that it provides a very reliable output of the sensitive data hiding in your code.

The process yielded a 4.3MB of sensitive data, listing the same keys in 309 commits throughout the project’s history, along with private keys, private secrets used to communicate with cloud providers and other gems.

In the absence of tools, engineers tend to find their own solutions to everything. Whether it’s for delivery, storage, build-pipelines and unfortunately secrets and keys, developers require certain tools to surround them and provide solutions to their basic application needs.

A secret manager, is a tool that allows safe storage and encryption of sensitive data, providing access through strict and secure methods.

Without it, keys are being stored on shared locations, hardcoded, committed and pushed to VCS. Sometimes it’s even publicly visible in the code downloaded to the client’s browser. #truestory

Right, it’s not even remotely safe or done with the minimum level of security in mind, we can blame the responsible ones as much as we want, but educating is worthless without providing a proper alternative.

Common sense should be trusted, but not with your company’s life, and yes, I mean that in the very literal way.

In order to illustrate how destructive a data leak can be, I used a few python lines exploiting AWS root keys as described in the first paragraph; I’m sure you understand this can be done just as easily with any language or the CLI. Please do not copy this code, let alone run it.

Kill any company in minutes, provided IAM keys with the right permissions

This code can be altered and used on any AWS resource the keys allow access to. Deleting instances, databases, users, DNS records and everything in its path!

To be very clear about the risk of such a key pair falling in the wrong hands, and without disclosing any names, it could have completely ruined the company with its 65 engineers and $50 Million in the bank, turning it to ashes within a single command.

A tool like aws-nuke can also be handy for the bad guys. The destructive power of such a leak cannot be stressed enough.

Not convinced?

Here are some real world examples:

#1

A small startup in the retail business, discovering and comparing retail prices of premium brand top sellers, had been hacked four times in 90 days at the end of 2017. A private SSH key used by the production cluster was part of a library open sourced by the organization and aggressively marketed to create traction and buzz around their product.

After each hack they rotated all AWS and GCP keys, and 3rd party tools access credentials including taking a security audit of their internal code base. Only a complete scan over the public code base exposed the leaked secret keys.

#2

Another small company in the mobile gaming field, used AWS S3 to store XML files. Upon launching their Android app, XML data from their AWS account was downloaded, using an AWS key.

Only retrospectively, it turned out to be lacking any kind of monitoring on resources and monthly bills alike.

In order to fetch the data, under the hood, the application used to authenticate with S3 using the account’s root credentials.

When their new iOS application was launched, they were disapproved by Amazon’s Appstore, and communicated by Amazon describing the leak. Only then, they found some public unfamiliar instances running on their expense. Luckily, except for money loss, no real harm was done.

#3