０７６萌ＳＮＳ
  • Login

  • Public

    • Public
    • Network
    • Groups
    • Popular
    • People

Conversation

Notices

  1. Catalin Cimpanu (campuscodi@mastodon.social)'s status on Saturday, 07-Jan-2023 16:19:28 JST Catalin Cimpanu Catalin Cimpanu

    "I scanned every package on PyPi and found 57 live AWS keys"

    https://tomforb.es/i-scanned-every-package-on-pypi-and-found-57-live-aws-keys/

    In conversation Saturday, 07-Jan-2023 16:19:28 JST from mastodon.social permalink

    Attachments


    1. https://files.mastodon.social/media_attachments/files/109/645/404/330/677/603/original/1c725e6355df07cd.png
    2. Invalid filename.
      I scanned every package on PyPi and found 57 live AWS keys
      from Tom Forbes
      After inadvertently finding that InfoSys leaked an AWS key on PyPi I wanted to know how many other live AWS keys may be present on Python package index. After scanning every release published to PyPi I found 57 valid access keys from organisations like: Amazon themselves 😅 Intel Stanford, Portland and Louisiana University The Australian Government General Atomics fusion department Terradata Delta Lake And Top Glove, the worlds largest glove manufacturer 🧤 This post outlines the way I scanned PyPi, showcases a project I’ve built that automatically scans all new PyPi releases to notify AWS of potentially leaked keys, presents some analysis of the keys I’ve found and draws a few conclusions at the end.

    Feeds

    • Activity Streams
    • RSS 2.0
    • Atom
    • Help
    • About
    • FAQ
    • TOS
    • Privacy
    • Source
    • Version
    • Contact

    ０７６萌ＳＮＳ is a social network, courtesy of ０７６. It runs on GNU social, version 2.0.2-beta0, available under the GNU Affero General Public License.

    Creative Commons Attribution 3.0 All ０７６萌ＳＮＳ content and data are available under the Creative Commons Attribution 3.0 license.