SolarWinds leaked FTP credentials through a public GitHub repo since 2018

Also this --&gt; Security researcher Vinoth Kumar told Reuters that, last year, he alerted the company that anyone could access SolarWinds’ update server by using the password “solarwinds123” <a href="https:&#x2F;&#x2F;www.reuters.com&#x2F;article&#x2F;global-cyber-solarwinds&#x2F;hackers-at-center-of-sprawling-spy-campaign-turned-solarwinds-dominance-against-it-idUSKBN28P2N8" rel="nofollow">https:&#x2F;&#x2F;www.reuters.com&#x2F;article&#x2F;global-cyber-solarwinds&#x2F;hack...</a>

Wait, FTP as in actual goddamn FTP, or actually SFTP but we call it FTP?<p>I could make fun, except in 2018, I moved a company off of FTP and onto S3. To be fair to the company, no developer had worked there since 2016, so they were just running on autopilot. Still, anyone even vaguely concerned with security should have stopped using FTP since sometime in the early 00s.

Here is one interesting project that lets you see in almost real time leaked secrets (or suscpected secrets there might be fasle positives) across Github, Gists, Gitlab, and Bitbucket: <a href="https:&#x2F;&#x2F;www.shhgit.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.shhgit.com&#x2F;</a><p>You can also run your own instance: <a href="https:&#x2F;&#x2F;github.com&#x2F;eth0izzle&#x2F;shhgit&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;eth0izzle&#x2F;shhgit&#x2F;</a>

It doesn&#x27;t take much of a &quot;sophisticated hack&quot; if they post their passwords publicly.

This is egregious, for sure, but it doesn&#x27;t explain how a DLL signed with their certificate ended up in the wild.<p>Have SolarWinds&#x27; handling practices for their code signing certificate come to light? It&#x27;s sounding more and more like we&#x27;re going to find out it was a &quot;PFX file w&#x2F; the password &#x27;password&#x27; saved on a network share&quot; kind of situation.

I assumed that all software in the supply chain for defense would go through an audit that exposes things like this. Did that never happen?

I discussed this in a video I made on the SolarWinds compromise if anyone is interested - <a href="https:&#x2F;&#x2F;youtu.be&#x2F;ONd0ERCUy0k?t=760" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;ONd0ERCUy0k?t=760</a><p>Original Tweet came from @vinodsparrow - <a href="https:&#x2F;&#x2F;twitter.com&#x2F;vinodsparrow&#x2F;status&#x2F;1338431183588188160" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;vinodsparrow&#x2F;status&#x2F;1338431183588188160</a><p>Keep in mind the binary files that contained the backdoor were digitally signed by SolarWinds after being tampered with. So this FTP credential leak might be part of the supply chain compromise, but is not the whole enchilada.

This was posted yesterday and flagged into oblivion. Unless new information has come out, there wasn&#x27;t and still isn&#x27;t any reason to believe this leak had anything to do with 2020&#x27;s megabreach.<p>Edit: To clarify, this version follows up the flagged post with a bit more information and a lot more speculation. It does a lot of work to &quot;not&quot; make claims while setting them up and basically making them.<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25419140" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25419140</a>

Considering how often people commit their credentials, it seems Git or GitHub need a --i-need-a-nanny option that would check if you&#x27;re about to publish things that you would not rather publish. But then it would have to be an installation option because the people who goof up like this would not know&#x2F;remember to add that CLI parameter; but I would bet a lot of people would turn on said nanny option that would warn you if you&#x27;re about to commit lines containing the word &quot;password&quot; or &quot;secret&quot; or &quot;key&quot; (obviously it would have to be more clever than this simple text compare, otherwise it would warn on lines like &quot;function checkPassword(String userSuppliedPassword) {&quot;...

Highly sophisticated attack that only nation state could have accomplished or leaked FTP credentials that any script kiddie could have used?

Glad I&#x27;m not the ASC for that product

Does github have a log of IP addresses that cloned the repo? Not that an IP address has much information.

I love the word &quot;since&quot; in the title.

This type of thing can happen easily with Git. We just submit a directory, and every damn file in that directory gets submitted.<p>What I do, is have a file that aggregates my sensitive stuff (like server secrets and whatnot), and call that file something like &quot;DoNotCheckThisIntoSourceControl.swift&quot;. I then add a git ignore line, on that name.<p>I&#x27;ll also sometimes store it outside of the repo root (I use Xcode, so I can drag files in from anywhere).