26,400 live credentials found scanning 7.25M Gitee repos
Original title: 26,400 live credentials found scanning 7.25M repos on China's Gitee
TruffleHog and Kingfisher verified cloud keys and an unnamed enterprise AI platform's organization-admin credential.
Researcher Ben Zimmermann, with MongoDB's Kingfisher team, enumerated 7,256,531 public repositories on Gitee, China's national Git host. Concurrent TruffleHog and Kingfisher scans verified 26,400 unique live credentials, including cloud-provider access keys and an organization-admin credential for an unnamed major enterprise AI platform. Gitee has no public equivalent of GitHub's vendor secret-scanning partnerships.
Unconfirmed: The enterprise AI platform is unnamed, and the credential counts are the researcher's.
- Enumeration used user search, Explore feeds, profile pages, and an Elasticsearch widget.
- The username seed corpus contained 1,704,759 names.
- The Modal scan ran about one month and cost $3,097.64.
- Each scanner verified credentials the other missed.
Impact: 26,400 unique verified-live credentials, including cloud keys
- 1.Revoke and rotate credentials that appear in public Gitee repository history.
- Products
- GiteeTruffleHogKingfisher
- Organizations
- Ministry of Industry and Information Technology
- Countries
- China
From the original article
7 min read at mongodb.com.png&w=1280&q=75)
This guest post by independent security researcher Ben Zimmermann was developed in collaboration with the Kingfisher team at MongoDB. Ben specializes in large-scale credential exposure research across public source-hosting platforms.
By kernelrocks · mongodb.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.