Have My Keys Been Pwned? API Edition: Hunting Leaked Credentials in Public Repos
Rod Soto explores how developers inadvertently leak cloud API keys and SSH secrets in public repositories, demonstrating automated hunting and abuse vectors.
Summary
The Proliferation of Hardcoded Secrets in DevOps
Rapid CI/CD release cycles and distributed developer workflows frequently lead to hardcoded API keys, database credentials, and cloud tokens committed to code repositories.
Automated Git Reconnaissance and Secret Scraping
Rod Soto demonstrates how attackers and threat hunting bots scan public GitHub repositories, commit histories, and gists in real time for cryptographic secrets.
Weaponizing Leaked Cloud API Keys for Tenant Takeover
The speaker illustrates how leaked AWS access keys and cloud service tokens allow attackers to escalate privileges and access sensitive backend databases.
Preventative Controls and Automated Secret Scanning
The presentation provides DevOps and security engineers with pre-commit secret detection hooks, secret rotation policies, and cloud secret management best practices.
Related talks
Security BSides San Francisco·28 min
Outlines BSidesSF 2016 - Developing a Rugged DevOps Approach to Cloud Security (Tim Prendergast) and evaluates key implications for security practitioners.
Red Team Village·38 min
Vandana Verma Sehgal
Vandana Verma Sehgal explores Zero Trust architectures, examining identity verification, micro-segmentation, and offensive testing in modern cloud environments.
Red Team Village·53 min
Michael Wylie
Michael Wylie details automated reconnaissance techniques to discover unauthenticated AWS S3 buckets, Azure Blob containers, and GCP storage leaks.