How leaky can it git? - MackenzieJackson

How leaky can it git? Discovering and exploiting leaked secrets in repositories and containers - MackenzieJackson
Exposed secrets, like API keys and other credentials, are a growing problem. 6 million secrets were leaked publically on GitHub in 2021 according to one study and nearly 5% of dockers’ images contain a secret. This talk examines how these are leaked, discovered, and exploited by hackers.
This presentation assumes a Black Hat position to look how offensive security teams can abuse this widespread problem to gain initial access to a specific target. To achieve this objective we examine why secrets are so frequent in public spaces despite being a highly valuable asset, how these secrets are leaked and the types of secrets frequently found in both public git repositories and public Docker images. Building on this we break down three recent successful attacks, all of which used different methods to extract publicly exposed secrets that granted initial access to the attackers.
These are CodeCov2021, which exposed secrets via a public docker image, SolarWinds 2020, which exposed a secret in a public git repository belonging to an employee and the Lapsus breaches of 2022 which exposed secrets inside private source code via insider access. Examining each methodology of these attacks we review down exactly how we can replicate each to exploit other specific targets. Finally, we break down the different methods and tools can be used to extract secrets from source code, reviewing the pros and cons of each.