A report published by Aqua Security finds that as many as 18% of secrets inadvertently exposed are not being discovered.
Yakir Kadkoda, a lead researcher for the Aqua Nautilus team, said even after DevSecOps teams believe they have deleted a secret they overlook the fact those same secrets have been stored in a cache elsewhere by, for example, a cloud service they are relying to store code and build applications.
Additionally, those same exposed secrets are likely to be included in any mirror or clone of that repository, the report noted.
These blind spots in DevSecOps workflows create what are essentially phantom secrets that years later can come back to haunt application development teams, noted Kadkoda.
Secrets management has become a major challenge because a large percentage of security breaches occur simply because cybercriminals have been able to gain access to credentials. Sometimes those credentials are stolen from end users directly but in many cases, cybercriminals have been able to access application and infrastructure secrets that have not been encrypted.
For example, the Aqua Security report discovered that conventional scanning methods miss nearly 18% of potential secrets in more than 50,000 repositories created by the top 100 organizations using the GitHub platform. Aqua Security researchers used those secrets to access complete cloud environments, which enabled them to access Kubernetes clusters, telemetry platforms, analytics tools, network devices, SNMP secrets and camera footage.
Hardcoded Secrets
The challenge is many of those secrets can’t be discovered by any of the most widely used scanning tools, said Kadkoda. This is because key patterns for application programming interfaces (API) don’t often conform to standard regular expression models, making detection more challenging. Hardcoded secrets can also be stored in many ways and may be found in unpredictable locations that are beyond the usual confines of configuration files or URL parameters.
In addition, credentials exhibit varying entropy levels, indicating that not all of them will be easily detectable based on complexity.
Finally, scanners might completely miss vast areas of the code base, due to the limited amount of event data that can be analyzed on the source code management (SCM) platform.
The best way to overcome that limitation is to instead of relying on an API exposed by GitHub is to create a historical dataset of past commits, the report advises. DevSecOps teams can collect every commit ever recorded for a target repository and then verify if these commits are included in any mirrored version of their repository. If a commit is not present in the mirrored version, it would be advisable to fetch this commit from GitHub and scan it for secrets, the report noted.
While no one tends to be rewarded for finding and remediating exposed secrets, application developers have a vested interest in participating in any review process as a matter of self-preservation, noted Kadkoda. After all, come the day a breach is traced back to a secret that was left exposed it won’t be too long before cybersecurity forensics teams determine how that secret fell into the wrong hands.
