Repositories held for ransom by using valid credentials

Re:Repositories held for ransom by using valid credentials by weinzierl on Saturday May 04, 2019 @03:57PM (#19828910)

> A few years back (2015 or so) the average time from push-to-repo to AWS account compromise was 6 minutes. Surely that time has only gone down, and the number of different credentials identified has gone up.

I don't doubt that a second and I'd like to use that as a quote. I'd like to be prepared if someone doubts it, so: Do you have a primary source for this?

[ Parent | on HN ]

Re:Repositories held for ransom by using valid credentials by kelnage on Saturday May 04, 2019 @05:47PM (#19829587)

This paper may be relevant to your interests: https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-chara...

[ Parent | on HN ]

Re:Repositories held for ransom by using valid credentials by scraptor on Saturday May 04, 2019 @05:49PM (#19829603)

Blog post summary: https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-chara...

Source if blog is unavailable: https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd...

[ Parent | on HN ]

Re:Repositories held for ransom by using valid credentials by bostik on Saturday May 04, 2019 @04:06PM (#19828970)

I'll need to find the talk I lifted it from. Not easy... but looks like downthread a sibling comment gives a relatively decent update about the current speed of compromise.

[ Parent | on HN ]

Re:Repositories held for ransom by using valid credentials by bostik on Sunday May 05, 2019 @04:00PM (#19834692)

Answering myself: I think it was a BSides London talk. (Quite likely from 2017.) After doing a search, I don't think it was recorded.

Hence, I can't provide a primary source. Sorry.

[ Parent | on HN ]

Re:Repositories held for ransom by using valid credentials by frandroid on Sunday May 05, 2019 @10:53AM (#19833085)

I thought that AWS nowadays is also feeding at the firehose and auto-disabling any of its keys it could find in a commit?

[ Parent | on HN ]