https://pwn.watch/t/secrets Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 31 May 2024 00:00:00 GMT https://pwn.watch/i/hugging-face-spaces-secrets-leak https://pwn.watch/i/hugging-face-spaces-secrets-leak Fri, 31 May 2024 00:00:00 GMT high <p>Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-05-31: Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens (<a href="https://huggingface.co/blog/space-secrets-disclosure">source</a>)</li></ul> https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion Thu, 01 Feb 2024 00:00:00 GMT high <p>A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-02-01: Cloudflare publishes its full write-up (<a href="https://blog.cloudflare.com/thanksgiving-2023-security-incident">source</a>)</li><li>2023-11-23: Cloudflare detects the attacker on its self-hosted Atlassian server (<a href="https://blog.cloudflare.com/thanksgiving-2023-security-incident">source</a>)</li><li>2023-11-14: Attacker begins reconnaissance with credentials from the Okta compromise (<a href="https://blog.cloudflare.com/thanksgiving-2023-security-incident">source</a>)</li></ul> https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 Mon, 18 Sep 2023 00:00:00 GMT high <p>A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched</p> <p><strong>Latest updates:</strong></p><ul><li>2023-09-18: Public disclosure by Wiz and Microsoft (<a href="https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers">source</a>)</li><li>2023-06-24: Microsoft revokes the SAS token (<a href="https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/">source</a>)</li><li>2023-06-22: Wiz reports the exposure to Microsoft (<a href="https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers">source</a>)</li></ul> https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023 https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023 Fri, 24 Mar 2023 00:00:00 GMT medium <p>GitHub's private RSA SSH host key for github.com was briefly exposed in a public repository. GitHub rotated it as a precaution, which meant anyone connecting over SSH with RSA saw a host key mismatch warning until they updated known_hosts.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched</p> <p><strong>Latest updates:</strong></p><ul><li>2023-03-24: GitHub replaces its RSA SSH host key; users must update known_hosts (<a href="https://github.blog/news-insights/company-news/we-updated-our-rsa-ssh-host-key/">source</a>)</li></ul> https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023 https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023 Fri, 13 Jan 2023 00:00:00 GMT critical <p>Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2023-01-13: Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated (<a href="https://circleci.com/blog/jan-4-2023-incident-report/">source</a>)</li><li>2023-01-04: CircleCI tells all customers to rotate every secret stored in CircleCI (<a href="https://circleci.com/blog/january-4-2023-security-alert/">source</a>)</li></ul>