Researchers set up the dummy accounts with programmatic access but no permissions to prevent the attackers from impacting our AWS infrastructure. Using the AWS CloudTrail service, they then watched and logged attackers who used the credentials to access our AWS servers. They then published user credentials such as AWS IDs and secret keys in public GitHub repositories. Our researchers created multiple accounts on Amazon Web Services (AWS) and GitHub. Malicious hackers actively scan and scrape GitHub for leaked passwords, client IDs, secret keys, and API tokens, to name a few, because they know programmers are prone to such oversights.īut how long does it take for attackers to find data once it’s exposed, and what do they do with it? Comparitech researchers sought to find answers to these questions by setting up a honeypot. And all too often, developers forget to remove sensitive data from their code before putting it on GitHub.Įxposing sensitive private data in public GitHub repositories isn’t a new problem. GitHub code repositories are usually public, meaning anyone can find and access code that’s been uploaded to the site.

Developers routinely use GitHub to back up, share, and manage changes to code.

Plex aws