Research Finds Nearly 800,000 Access Keys Exposed Online

guest · Sep 17, 2020

Research Finds Nearly 800,000 Access Keys Exposed Online
The keys were primarily for access to databases and cloud services
September 15, 2020
https://www.darkreading.com/vulnera...000-access-keys-exposed-online/d/d-id/1338918

When AWS keys were exposed in GitHub repositories, GitHub responded by invalidating those keys. Researchers at Digital Shadows have found that this proper action doesn't end the issue of exposed keys as they have found almost 800,000 keys available on the Web.

The researchers searched approximately 150 million entities across GitHub, GitLab, and Pastebin during a 30-day period in August and September to find the roughly 800,000 keys. They discovered that more than 40% of the keys were database keys while 38% were for cloud services. Redis was the most common database involved, while Google Cloud API was the most common cloud service key.
Click to expand...

In their blog post on the research, Digital Shadows notes three services — Trufflehog, GitRob, and GitHub Secret Scanning — that can help organizations search for their own keys that might have been exposed online.
Click to expand...

Digital Shadows: Access Keys Exposed: More Than 40% Are For Database Stores

Typically, when we think of credentials, the first thing that comes to mind is a username and password widely used by people and other systems to authenticate to systems. But in software, there’s an additional type of security credential – an access key.
Access keys can be public or private and, depending on the type of services, provide system authentication to third party or internal systems.

Access keys often have broader access than individuals and fewer checks/restrictions on their usage.
Click to expand...

Unfortunately, these access keys can be exposed by internal software developers or contractors, who may have not noticed a repository’s settings have changed to public.
FINDING YOUR OWN KEYS
For GitHub, there are a few options for gaining this visibility: [...]

Of course, this is about more than just GitHub, and so it’s worth referring to help provided by the technologies themselves. Google, for example, provides helpful guidance on steps to take if you unearth an exposed access key.
Click to expand...

Log in or Sign up

Research Finds Nearly 800,000 Access Keys Exposed Online

guest Guest

Log in or Sign up

Research Finds Nearly 800,000 Access Keys Exposed Online

guest Guest

Useful Searches