89
We made 75 private repos public on a timer. The internet noticed in 6 minutes. (codatus.com)
submitted 1 month ago by to c/programming@programming.dev
15 comments fedilink hide all child comments
 

Live AWS keys in 75 throwaway repos, each made public for one of five windows from 60 seconds to 12 hours, every use logged. The keys were tripwires; the real question was who notices a private repo going public, and what they do once they're in.

The most useful finding is the dull one: re-hiding the repo does nothing. One busy harvester kept re-validating the captured keys for a day after the repos went private again. Only rotating the key stops it.

This came out of building a monitor for exactly these repo-setting changes.

you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 1 month ago (1 child)

The real question.

Are people watching private repos go public? Or are people watching for exposed credentials?

Like if I make a Snake game in Python, then make it randomly go public, would anyone notice or care?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 5 points 1 month ago

    This is what I struggled with myself, whether basing the research on people using the key is even relevant. But to get the key, they first have to be watching repos go public. So the watching is the common step, whatever the motive behind it. That's where the 6 minutes comes from.

  • permalink
  • fedilink
  • source
  • parent