Unveiling GitHub's Hidden Risks: A Deep Dive into Secret Exposures.
- Reef Noor
- Mar 13, 2024
- 3 min read
Unveiling GitHub's Hidden Risks: A Deep Dive into Secret Exposures.
According to a recent report from GitGuardian, developers inadvertently exposed 12.8 million secrets on public GitHub repositories in 2023, marking a 28% increase compared to the previous year. The security vendor stated that this figure represents a fourfold increase in exposed secrets since 2021, attributed to the expansion of GitHub repositories.
GitGuardian noted that seven out of every 1000 commits, 4.6% of active repositories, and 11.7% of contributing authors disclosed at least one secret last year. Despite sending out 1.8 million alert emails during this period, GitGuardian highlighted that 90% of exposed secrets remained active five days after the leak, creating a persistent security vulnerability. Only 2.6% of these secrets were revoked within one hour of email notification.
GitGuardian CEO Eric Fourrier expressed concern about developers failing to revoke leaked commits or repositories, emphasizing the ongoing security risk posed to companies as long as the credentials remain valid. He described these unresolved leaks as "zombie leaks," which are particularly problematic.
In the past year, approximately 50 million new repositories were added to GitHub, marking a 22% year-on-year increase. Of these, three million repositories contained leaked secrets, with the most common being Google API keys, MongoDB credentials, OpenWeatherMap tokens, Telegram Bot tokens, Google Cloud keys, and AWS IAM. These leaks could significantly aid opportunistic threat actors in compromising sensitive enterprise resources. GitGuardian also observed a significant increase in leaked OpenAI API keys and HuggingFace user access tokens, indicating the growing popularity of AI services.
The IT sector accounted for the majority (65.9%) of secret leaks, followed by education, science & technology, retail, manufacturing, and finance and insurance.
GitGuardian emphasized the importance of taking action not only to detect but also to remediate these leaks effectively. The report argued that while most security initiatives focus on detecting leaks, the key challenge lies in effectively addressing and rectifying these mistakes by providing developers with necessary guidance and support.
Key takeaways for your business:
Heightened Risk: SMBs need to recognize the increased risk of inadvertently exposing sensitive information on public GitHub repositories. The growing trend of secret leaks poses a significant threat to the security of business's data and resources.
Persistent Vulnerabilities: The persistence of security vulnerabilities associated with exposed secrets, as many remain active even days after the leak. Businesses must understand the potential long-term impact of leaked credentials and take proactive measures to address them promptly.
Challenges in Revocation: Challenges in promptly revoking leaked credentials, as indicated by the low percentage of secrets revoked within one hour of notification. This underscores the importance of having effective incident response procedures in place to mitigate the impact of security incidents.
Common Types of Leaked Secrets: Awareness of the common types of leaked secrets, such as API keys and credentials for cloud services like AWS and Google Cloud. Understanding these common vulnerabilities can help businesses prioritize security measures and implement necessary safeguards.
Sector-wise Distribution: The distribution of secret leaks across various sectors highlights that businesses across all industries are susceptible to this risk. Regardless of their industry, businesses need to prioritize security initiatives and adopt best practices to protect their sensitive information.
Importance of Remediation: Businesses should recognize the importance of not only detecting but also effectively remediating leaked secrets. Providing developers with the necessary guidance and support to address security incidents promptly is crucial for minimizing the impact of potential breaches.
Collaboration with Security Experts: Businesses may benefit from collaborating with cybersecurity experts or leveraging security solutions like GitGuardian to detect and remediate secret leaks effectively. Seeking external expertise can help businesses strengthen their security posture and mitigate the risk of data breaches.
