Less than a month later, Twitter indirectly claimed that some of its source code had been leaked on code-sharing platform GitHub by sending a copyright infringement notice and removing the offending repository. Admitted. The latter is currently inaccessible, but has been publicly accessible for several months, according to media reports: A user named FreeSpeechEnthousiast has committed thousands of documents belonging to his social media platform for months.
While there is no concrete evidence to support this hypothesis, the timing of the leak and the sarcastic username used by the perpetrator suggest the leak was a deliberate act intended to harm the company. doing.
It’s still too early to gauge the impact of this leak on Twitter’s health, but this incident should be an opportunity for all software vendors to ask simple questions. What if this happened to us?
As the frequency and impact of data breaches and leaks continue to increase, protecting sensitive information in the software industry is becoming increasingly important. As our reliance on software increases, the amount of confidential information stored in digital form is constantly increasing.
About a year ago, the Lapsus$ hacking gang made headlines when they publicly leaked the source code of one of the tech industry’s most prominent companies. The group’s trophies included around 200 GB of source code from Samsung, Nvidia’s source code for his DLSS technology, and 250 internal projects from Microsoft. LastPass, Dropbox, Okta, and Slack have all revealed that portions of their code have been compromised.
A treasure trove of confidential information
Source code contains a large amount of sensitive information, most often containing hard-coded secrets such as passwords, API keys, and certificate private keys. This information is often stored in plain text within the source code, making it an easy target for attackers.
There are many potential risks associated with leaked private source code, but exposed secrets are perhaps the most concerning. In the 2023 State of Secrets Sprawl, the single largest analysis of public GitHub activity, GitGuardian reported 10 million newly published secrets in 2022 alone. A staggering 67% increase year over year. A large part of this phenomenon is explained by the fact that with version control like Git, it’s very easy to accidentally expose hardcoded secrets buried in your commit history. However, malicious intent can also cause the disclosure of confidential information.
In the event of a source code leak, these secrets are exposed, giving an attacker access to your system and data. Secrets-in-code is a particularly serious problem. It allows attackers to move quickly and exploit many systems, making it more difficult for organizations to contain the damage. Unfortunately, internal source code is a very leaky asset. It’s widely accessible to a developer across the company, backed up on various servers, and even stored locally on the developer’s machine. This is one of the reasons why it’s so important to keep secrets private in the first place.
In addition to the risk of malicious activity, mistakes made by developers can also put your company at risk. For example, there could be accidental leaks of code due to the way GitHub designed its products for enterprises/organizations. This makes it harder for organizations to prevent accidental leaks and, conversely, makes it easier for developers to make mistakes.
Flaws in exposed logic are also a concern. Vulnerabilities can exist in the way software applications handle functions and data that may be present in their source code. Once the source code is made public, attackers can analyze these vulnerabilities and exploit them to gain unauthorized access. The same applies to application architecture. Organizations often expect the architecture of their applications to be hidden. This is a concept called security through obscurity. When the source code is made public, attackers are lured into a map of how the application works and given an opportunity to find hidden assets.
Time to Act: Protect Your Source Code
This issue is nothing new, and many in the security industry have been sounding the alarm bells for some time. However, recent initiatives by the Biden administration to strengthen the cyber resilience of infrastructure and small businesses have increased the focus on software vendor accountability. As cybersecurity becomes a national priority, there will be increasing pressure to promote secure development practices and create market forces that prioritize the protection of sensitive information.
So what can software vendors do to protect their source code and sensitive information? First and foremost, they must be aware of potential risks and take appropriate steps to mitigate them. This includes implementing security measures to protect against malicious activity and ensuring that hardcoded secrets are not stored in plain text within source code.
However, protecting sensitive information in the software industry requires multiple approaches. Using a combination of secrets management solutions, secure coding techniques, and automated secret discovery can provide a comprehensive security strategy.
Secret discovery involves scanning source code and other digital assets for hardcoded secrets and alerting developers to potential vulnerabilities that attackers can exploit. This proactive approach allows organizations to better protect sensitive information and identify potential security risks early in the software development lifecycle.
Combining a secrets discovery solution with secrets management and secure coding practices provides a layered security approach that helps reduce the risks associated with source code disclosure and other potential vulnerabilities.
In addition to these technical measures, it is also important to ensure that your employees are trained and educated on cybersecurity best practices. This includes regular training and awareness programs to ensure employees are aware of the risks and know how to protect confidential information.
continuous security
Overall, protecting source code and confidential information is an important issue for software vendors. As the frequency of malicious activity and accidental breaches continues to increase, it is imperative that vendors take steps to mitigate risk and protect customer data. By implementing secure coding practices, using secrets management solutions, and providing employee training and awareness programs, vendors can drive continuous improvement in software development practices over the long term.
Keep in mind that protecting source code and confidential information is not a one-time event. This is an ongoing process that requires constant attention and vigilance. Software vendors must continuously monitor their systems for potential vulnerabilities and ensure that their security measures are up to date.
If you are interested in improving your organization’s confidentiality management practices, we encourage you to complete the confidentiality management questionnaire (anonymous) to assess your specific situation. It only takes 5 minutes to get a quick overview of your organization’s strengths and weaknesses and start on the road to better security.
Reliably protect sensitive information and maintain customer trust.
