9
How recruitment fraud turned cloud IAM into a $2 billion attack surface (venturebeat.com)
submitted 9 months ago by to c/security@programming.dev
1 comment fedilink hide all child comments
 

A developer gets a LinkedIn message from a recruiter. The role looks legitimate. The coding assessment requires installing a package. That package exfiltrates all cloud credentials from the developer’s machine — GitHub personal access tokens, AWS API keys, Azure service principals and more — are exfiltrated, and the adversary is inside the cloud environment within minutes.

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 9 months ago

Kinda shocks me that most of these cli apps still have no method of securing these credentials. No encryption with passphrase, no integration with password/secret managers. Just a plaintext credentials file in a static location.

  • permalink
  • fedilink
  • source
    •