Slashdot Mirror
Slack To Disable Thousands of Logins Leaked on GitHub (detectify.com)
An anonymous reader writes: Thursday one technology site reported that thousands of developers building bots for the team-collaboration tool Slack were exposing their login credentials in public GitHub repositories and tickets. "The irony is that a lot of these bots are mostly fun 'weekend projects', reported Detectify. "We saw examples of fit bots, reminding you to stretch throughout the day, quote bots, quoting both Jurassic Park...and Don Quixote...."
Slack responded that they're now actively searching for publicly-posted login credentials, "and when we find any, we revoke the tokens and notify both the users who created them, as well as the owners of affected teams." Detectify notes the lapse in security had occurred at a wide variety of sites, including "Forbes 500 companies, payment providers, multiple internet service providers and health care providers... University classes at some of the world's best-known schools. Newspapers sharing their bots as part of stories. The list goes on and on..."
Slack responded that they're now actively searching for publicly-posted login credentials, "and when we find any, we revoke the tokens and notify both the users who created them, as well as the owners of affected teams." Detectify notes the lapse in security had occurred at a wide variety of sites, including "Forbes 500 companies, payment providers, multiple internet service providers and health care providers... University classes at some of the world's best-known schools. Newspapers sharing their bots as part of stories. The list goes on and on..."
Any time you keep credentials on a public hub is just a bad thing to do (in a "cross the streams" sense), and I addressed that in a blog entry back when bots were finding thousands of Amazon AWS and S3 OAuth credentials and secret keys made public on github.
But I do wonder, for libraries that give you an API token to use (Flickr, Trello), how should one use it in a pure html5 single-page client app, one that doesn't use any server proxy middleware. E.g., except for securing the API key, there's no reason for a flickr photo slideshow to ever need to talk to my own server: it should just talk to Flickr directly. Routing everything through my server as a proxy just for the API key would be horribly inefficient and expensive on my bandwidth, as well as unnecessarily slow.
But if I just leave the API key in the app's scripts, it can, with a little bit of research in the web console, be found by anybody looking for it. Even if I were to encrypt it in some way, that encryption could be cracked easily because everything needed to decode it could also be found because it all is in the javascript somewhere.
So what if any is the solution for efficient CORS-based HTML5 single page apps for APIs that require a key that you should attempt to secure in some way to prevent others from using the key to create abusive applications of their own?
"But remember, most lynch mobs aren't this nice." (H.Simpson)
-- Joe
shouldn't every company that gives out private authentication tokens for developer to use should be monitoring sites like github and revoking any tokens found? when you sign up to get an authentication token it says you have to keep it secret or it will be revoked, so why aren't more people doing this?
Anons need not reply. Questions end with a question mark.
I can't keep up with all these new companies.
With a focus on making everyone a programmer, this is only going to get worse. These people don't understand what they're doing. They're mimicking by following tutorials, copy-pasting other people's code and making small changes. "It works, ship it" is bad when it is caused by deadline stress. It is unavoidable when the "developer" doesn't even understand 90% of the tutorial, but can make it work thanks to the enormous power of modern development environments. IoT is going to be a glorious hacker playground.
Leave it to ArsTechnica to misreport. The tokens have been revoked prior to Detectify's post.
Any time you keep credentials on a public hub is just a bad thing to do
yes mommy, i left my locker key on the lunch table and they stole my stuff
tomorrow we will get advice on when to poop
Headline implies a security problem at GitHub. Not correct. Developers are checking plaintext passwords (API keys) into a publicly accessible source control system. Still interesting and news relevant here, but not a breach to be sensationalized.
And yet an Incoming WebHook into Slack uses no authentication whatsoever. The payload is encrypted with SSL, but the string that routes to your team/channel is in clearcase in the URL. So, no, one can't see what's being sent to Slack, or directly know which team/channel it's talking to. But one can be a creeper and starting sending his own content, with attachments.
So when are we going to start using client-side certificates?