March 2022 Summaries

In the latest installment of GitGuardian's "Detector of the Month" series, the focus is on the Redis credentials detector, highlighting the importance of securing Redis database credentials to prevent unauthorized access and potential data breaches. Redis, an open-source, in-memory key-value data store, is renowned for its speed and low latency, making it a popular choice for caching and real-time messaging applications since its inception in 2009. GitGuardian emphasizes the increasing risk of secrets sprawl, noting a significant rise in leaked credentials on public platforms like GitHub, which can lead to severe security breaches. The company offers a solution with a library of over 350 detectors to alert developers of exposed credentials, sharing best practices for secrets management and remediation. They advise on steps to mitigate risks, such as revoking and rotating secrets, improving secrets management, and reviewing access logs. The article underscores the necessity of keeping sensitive information secure, especially when using Redis, which relies on being accessed within trusted environments and has minimal authentication layers.

GitGuardian's latest white paper, "DevSecOps: Protecting the Modern Software Factory," introduces the AppSec Shared Responsibility Model, which advocates for a collaborative approach to application security among Developers, AppSec, and Ops teams. This model addresses the challenge highlighted by their 2022 State of Secrets Sprawl report, which found a significant imbalance in the ratio of AppSec engineers to software developers, resulting in overwhelming security vulnerabilities for individual AppSec engineers. By embedding security controls into the DevOps culture, the shared responsibility model aims to break traditional security silos, allowing developers to use appropriate tools for addressing familiar security issues while security engineers focus on complex assessments. Ops teams are also involved to ensure proper security CI/CD configurations. The paper emphasizes that this collaborative approach is crucial for scaling secure software development as teams expand and new threats emerge, and it outlines key aspects of a DevOps-ready security solution that can facilitate this transition by promoting security automation and best practices organization-wide.

Lapsus$, a hacking group, has leaked internal source code from 250 Microsoft projects, claiming it includes 90% of Bing's and 45% of Bing Maps and Cortana's code. This follows previous leaks from companies like Samsung and Nvidia. The group employs various methods to gain access, such as deploying malware, purchasing credentials, and exploiting personal accounts of employees with leaked corporate credentials. Despite Microsoft's assertion that these breaches have caused limited damage, an analysis by GitGuardian found 376 sensitive secrets within the leaked Microsoft source code, highlighting the ongoing challenge of managing exposed sensitive information even in security-focused organizations. GitGuardian's analysis also indicates that while Microsoft has implemented security measures to minimize such leaks, the presence of secrets remains a significant issue, showcasing the difficulty of maintaining complete secrecy in large code repositories.

In 2022, the issue of hardcoding secrets in Git repositories continues to be a significant security concern, prompting GitGuardian to collaborate with security expert Rohit Sehgal, known as @sec_r0, to raise awareness through various educational materials, including a zine. This initiative highlights the risks associated with secrets sprawl and the complexities of managing Git history, drawing attention to the vulnerabilities exposed by incidents like the Solarwinds attack. GitGuardian's comprehensive efforts include reports, tutorials, and automated detection tools aimed at educating developers on best practices for secrets management and detection. Their resources emphasize the importance of preventing leaks of sensitive information such as API keys and credentials in codebases, Docker images, and CI/CD pipelines.

Containers are increasingly adopted in businesses for their portability and scalability, but they also introduce new security challenges, such as potential exploitation leading to host compromise and unauthorized access to sensitive data. While traditional security measures like vulnerability scanning are integral, they often fall short in post-exploitation scenarios. The article introduces Seccomp-BPF, a Linux kernel feature for restricting syscalls, as a solution to mitigate damage from exploited container applications. Seccomp-BPF filters can be created using Red Hat’s oci-seccomp-bpf-hook tool, which records syscalls during execution to produce application-specific filters, limiting a container's capabilities to essential functions. Despite its potential, the integration of Seccomp into mainstream software development is hindered by its technical complexity and manual upkeep requirements. To overcome this, the article suggests automating Seccomp-BPF filter generation within Continuous Integration (CI) workflows, enhancing security in enterprise applications by aligning it with existing development processes.

The Lapsus$ hacking group has published nearly 200GB of source code from Samsung and Nvidia's latest DLSS technology, highlighting a growing trend of internal source code leaks by adversaries. GitGuardian's analysis of the leaked Samsung source code revealed 6,695 sensitive secrets, with 90% relating to Samsung's internal services and infrastructure but the remaining 10% potentially exposing external systems like AWS, GitHub, and Google to unauthorized access. This issue underscores the risks associated with the widespread accessibility of source code within large organizations, making it an appealing target for attackers. The Lapsus$ group, active on Telegram, even encourages insiders to provide access to confidential repositories, indicating that more leaks could be expected in the future. This situation raises significant concerns about the security of internal source code, which often contains sensitive data and remains vulnerable due to its distribution across various platforms and devices.

GitGuardian's 2022 State of Secrets Sprawl report reveals a significant increase in secrets leaks on public GitHub, with a two-fold rise in 2021 compared to the previous year, highlighting that three out of every 1,000 commits exposed a secret. The report underscores the challenges faced by IT professionals as the volume of secrets-in-code continues to grow, overwhelming the capabilities of application security teams and threatening the transition to DevSecOps. Private corporate repositories are four times more likely to expose secrets compared to open-source ones, indicating a misplaced trust in their security. The report suggests a collaborative prevention model between AppSec teams and developers as a solution to address the threat of secrets sprawl without overburdening security teams.

GitGuardian, a cybersecurity start-up, has been included in this year's Index based on its financial achievements, such as fundraising and rapid revenue growth, highlighting its role in the competitive French ecosystem. The company, which also received the FIC start-up of the year award, plans to expand its team significantly following a Series B fundraising round, focusing on technical recruitment in France, particularly in R&D based in Paris, and doubling its team size by 2022. Additionally, GitGuardian will establish an office in Austin, Texas, to enhance its sales and marketing efforts, aiming to increase its visibility and strengthen its employer brand.