The attackers guide to exploiting secrets in the universe

Secrets such as API keys, cloud credentials and certificates are meant to be used by software rather than people, yet they keep turning up in source code, images and apps. The talk looks at how attackers find them and why one valid credential can provide initial access or let an intruder keep a foothold after getting inside.

The first part covers public and private git repositories. Activity on public GitHub is broadcast through a readable events feed, which can expose pushes and repositories that were made public with old history still attached. A planted honey token was tried by unknown callers within a short time. Exposed .git directories on web servers can be pulled back into full repositories, and private source code often carries credentials buried in its branch history. The second part looks at container images and compiled applications. Images on Docker Hub and Android and iOS packages are archives that can be unpacked and scanned, and a meaningful share of them were found to contain plaintext secrets. A supply chain incident involving a code coverage tool illustrated how a credential in a public image can lead into private repositories.

The practical takeaways are to stop hardcoding credentials, adopt a secrets manager the team can realistically roll out, run automated secret detection in repositories and pipelines, install git hooks, rotate keys regularly and grant each key only the privileges it needs. Restricting which machines may use a key also limits what a stolen one can do.