Sign In

What if the authentication key was accidentally uploaded as a comment on our company's official GitHub? (True story)

Haebom
So many people found the previous post entertaining that I decided to bring you another story along the same lines. The star of this story is—surprisingly—Mercedes-Benz. Mercedes-Benz has participated in a few open source projects and granted certain levels of access through their official GitHub.
But recently, an employee's authentication token was left exposed in one of Mercedes' public GitHub repositories. This token provided full access to the company's GitHub Enterprise Server and allowed anyone to download the company's source code repositories. (It supposedly included all the code managing the entire Mercedes-Benz lineup.)
According to Shubham Mittal, who first found and reported this, the token allowed “unrestricted” access to all source code hosted on Mercedes’ internal GitHub Enterprise Server. That repository contained a trove of sensitive internal information, including intellectual property, connection strings, cloud access keys, schematics, design documents, SSO passwords, API keys, and more.
The funny thing is, instead of notifying Mercedes-Benz, Mittal tipped off the media. Mercedes-Benz only found out through news coverage and then announced that they had “revoked the API token and immediately took down the public repository,” admitting that “internal source code was mistakenly posted to a public GitHub repository.” They also issued a statement promising to take greater care in security moving forward.
Honestly, perhaps the only real victim here is Mercedes-Benz... It’s one of those incredible true stories, from the person who accidentally uploaded the main token to GitHub to the person who spotted it and immediately reported it to the media. If I were Mittal, I can’t help but think that reporting it directly to Mercedes-Benz and maybe offering them some security solutions would probably be worth more than a Benz or two! The reason I think like this? Mittal is the CTO of the IT security solution company RedHunt Lab. 😂
Subscribe to 'haebom'
📚 Welcome to Haebom's archives.
---
I post articles related to IT 💻, economy 💰, and humanities 🎭.
If you are curious about my thoughts, perspectives or interests, please subscribe.
haebom@kakao.com
Subscribe