March 2021 Summaries

The white hat hacking group Sakura Samurai executed a significant breach affecting 26 state-owned organizations in India, uncovering critical vulnerabilities across various government departments. Attracted by India's Responsible Vulnerability Disclosure Program, they legally tested domains, leading to discoveries such as exposed credentials, sensitive file disclosures, private-key pairs for servers, and over 13,000 personal identifiable information (PII) records. The group demonstrated their methodology by executing a meticulously planned attack involving perimeter establishment, asset identification, vulnerability scanning, and exploiting known infrastructure weaknesses, including a remote code execution on a financial server. Despite the breach's potential for significant damage, Sakura Samurai refrained from penetrating deeply to avoid unnecessary data exposure. The attack highlights the importance of organizations adopting robust cybersecurity measures like regular patching, preventing external access to sensitive directories, and scanning perimeters for hidden secrets to mitigate such vulnerabilities.

The GitGuardian secrets detection engine is a sophisticated system composed of numerous independent detectors maintained by a dedicated Secrets Team, which continuously updates and expands its capabilities to protect code from exposed secrets. Given the complexity and probabilistic nature of secrets detection, GitGuardian has developed individual algorithms, or detectors, for each type of secret, which now number over 250. In the first quarter of 2021 alone, they introduced 16 new detectors, including specific ones for services like Azure DevOps and MongoDB, as well as generic detectors for broader secret types. These updates are part of an ongoing effort to demystify the process of secrets detection and enhance protection for users, who can manage these detectors through their GitGuardian Dashboard settings.

The blog post by Pierre Lalanne, a data scientist at GitGuardian, explores the company's approach to developing and refining detectors for identifying MongoDB credentials leaked in source code. GitGuardian's detection engine, which monitors over 10 million GitHub documents daily, is designed to balance high recall and precision by focusing on "multimatch" secrets, a method that reduces false positives and alert fatigue. The article describes three main detection methods for MongoDB credentials: variable assignments, URI connection strings, and shell commands, each with specific strategies for identifying and validating potential leaks. GitGuardian employs pre-validation to discard irrelevant files and post-validation steps to refine results, such as filtering out common placeholder values and ensuring detected credentials are related. This meticulous approach allows the company to maintain high precision in detecting MongoDB credentials, with the engine raising over 3,000 alerts weekly for such leaks.

Pierre, a developer on the GitGuardian Secrets Detection Team since July 2020, leverages his background in aeronautics engineering and data science to enhance the company's detection capabilities. His interest in cybersecurity, spurred by curiosity about hacker activities, led him to GitGuardian, where he appreciates the vast amount of structured data available for analysis. At GitGuardian, Pierre has the opportunity to work on complex data models and tackle the significant issue of sensitive information leaks, even from companies with advanced cybersecurity measures. The company's strong technical focus and dynamic environment provide Pierre with a platform to develop his skills and contribute to innovative solutions. Excited about the future, Pierre sees potential in expanding GitGuardian's detection capabilities beyond secrets to include personal information and technical assets. Outside of work, Pierre enjoys music, playing guitar for a decade, and recently began learning the clarinet.

Developers increasingly face the challenge of managing sensitive data, commonly referred to as secrets, which include API tokens, security certificates, and credentials. These secrets often end up in source code and consequently in git repositories, posing a risk of leakage. GitGuardian, a security company, has analyzed data from 2020 to identify file extensions most prone to secret leaks, with the top 10 accounting for 81% of leaks. The main culprits include programming language files like Python and JavaScript, data serialization files such as JSON and XML, and forbidden files like .env and .pem. Hardcoding secrets into source code or configuration files is a prevalent issue, and best practices suggest using environment variables and .gitignore files to manage and protect secrets. GitGuardian's analysis highlights the importance of secret management and offers insights into preventing secret leaks by implementing security scanning and centralized management systems tailored to specific teams and technologies.

GitGuardian has expanded its security offerings by adding Bitbucket native integration to its Internal Monitoring product, which is designed to enhance source code security by scanning git repositories for any exposed secrets. Originally focused on public GitHub repositories, GitGuardian has progressively broadened its offerings, including the release of an open-source CLI application called GG-Shield and native integration with GitLab. This latest development allows integration with Bitbucket Server/Data Center, enabling companies to monitor the entire git history and every new commit to detect exposed secrets in real time. Although this integration currently excludes Bitbucket Cloud, GitGuardian is actively working toward extending its capabilities to include this platform. The integration can be implemented at both instance and project levels, providing flexibility for companies to secure their code depending on their organizational needs. Interested parties can view the integration through the GitGuardian dashboard or contact the sales team for a demo.

GitGuardian has conducted a comprehensive study on "secrets sprawl" by scanning nearly 1 billion public commits on GitHub in 2020, revealing a 20% annual increase in the number of secrets such as API keys and credentials found in public repositories. The Octoverse, with its vast community of over 50 million developers and 2 billion commits, inadvertently hosts sensitive data that is vulnerable to exploitation. The report highlights that 85% of these leaks occur in personal repositories, even when the secrets belong to organizations, indicating the challenges in enforcing security policies across distributed codebases. Additionally, the study details the types of secrets most commonly exposed, the countries with the highest leakage rates, and file extensions frequently containing secrets, while offering tips to mitigate this issue. GitGuardian plans further analyses of the findings, including a focus on the top 10 file extensions where secrets are most often discovered.