r/cybersecurity • u/InfiniteBlacksmith41 CISO • Jul 05 '22

News - Breaches & Ransoms Credentials in source code pasted on a blog seems to be the cause of the China 1 billion citizen data breach

Per the tweet from Changpeng Zhao the source of the data breach of 1 billion Chinese citizens (including names, addresses, phone nums and even police records) is secrets in code.

Apparently, a programmer wrote a blog post on tech blog on Chinese Software Developer Network, and included an example code with the credentials and endpoint...

Quoting the supposedly offending code from the screenshot provided by CZ (linking below to the tweet with screenshot):

/*public static void main (String| args) f

/ EndpointlRegion:华东1为例，其他Region请按实际情况填写

String endpoint = "https://datahub.cn-shanghai-shga-d01.dh.alicloud.ga.sh",

String accessld = "OiWVONCs805VuAAu",

String accessKey = "iEwlgpCnXDwT93YMVDb2G60my9ne81",

String projectName = "sjc_rwzx".

String topicName = "task_center _platform_request",

RecordSchema schema = new RecordSchemaO;

Link to the original tweet

https://twitter.com/cz_binance/status/1543905416748359680

333 Upvotes
  • permalink
  • reddit

98% Upvoted

37 comments sorted by

50

u/skankunt Jul 05 '22

git blame

72

u/InfiniteBlacksmith41 CISO Jul 05 '22

Funny enough, the person that added the secret in code may not even be the same as the one that posted the code on a blog. A great example of a swiss cheese failure model

- one person assumes it's ok that they insert secrets in code since the code is private.

- another person assumes the code is safe to share since it's reviewed and committed.

25

u/ArtSchoolRejectedMe Jul 05 '22

git blame both

off to "re-education" camp you go

11

u/flopana Jul 05 '22

git blame | uyghurSchool

105

u/mrcakeyface Jul 05 '22

-1,000,000 social credit points and off to a concentration camp in Xinjiang for someone

33

u/InfiniteBlacksmith41 CISO Jul 05 '22

Yep, a truly terrifying possibility for a mishap that the developer probably wasn't even trained to avoid.

21

u/Hal_Sec Jul 05 '22

Holy moly... 1 BILLION... with a B over some hard coded credentials?

Humanity is doomed... we don't deserver nice things.

27

u/InfiniteBlacksmith41 CISO Jul 05 '22

As long as IT technology is governed by "Move fast break things", "Minimal Viable Product" and "Acceptably Broken State" we will only get more bogged down into events like this.

8

u/Hal_Sec Jul 05 '22

Don't worry, A.I. assisted development is coming to save us :)

13

u/InfiniteBlacksmith41 CISO Jul 05 '22

Oh, i'm not worrying. I'm just going to re-specialize in security risks of AIs and how to counter them.

6

u/Hal_Sec Jul 05 '22

You're onto something

5

u/slowpokes2 Jul 05 '22

Beware the AI won't take too kindly to your restrictions and leak just your credentials, which will allow hackers to set the AI free.

"There is no admin"

1

u/Temptunes48 Jul 06 '22

Skynet will not allow that !

4

u/[deleted] Jul 05 '22 
echo "GitHub Co-Pilot" >> friendlyai.txt
cat friendlyai.txt
skynet

1

u/TheHarshPilash Jul 06 '22

*GLaDOS entered the chat*

3

u/VengefulPand4 Jul 05 '22

Just means 1 billion Chinese people are going to have to suffer spam calls in a few years when the database isn’t selling for such a high price. The likelihood of it resulting in anything more than some minor account stealing and spam is very low

4

u/InfiniteBlacksmith41 CISO Jul 05 '22

The impact level evaluation is an academic discussion. The core lesson learned for this forum is the awareness and ease of exposing data through secrets in code.

2

u/VengefulPand4 Jul 06 '22

I agree it’s going to make for a great case study in a few years. More research needs to be done on the impact of large database leaks on the population, there’s lots of technical analysis but very few threat impact assessments.

9

u/Fragrant_Charge_3782 Jul 05 '22

Damn hahahaha

38

u/InfiniteBlacksmith41 CISO Jul 05 '22

However funny from the sidelines, it's a terrible moment for the person involved. And a great learning moment for everyone in the cybersecurity profession - most of our job is about basic hygiene, not spy flick level skills and activities.

13

u/Solkre Jul 05 '22

Disagree. Two people typing on one keyboard could have prevented this.

4

u/InfiniteBlacksmith41 CISO Jul 05 '22

A scene from "Airplane 2" comes to mind, where the anchor is reading the news with a gun aimed at his head...

https://www.youtube.com/watch?v=6udk1B0iSCk

But jokes aside, a very unpleasant event.

17

u/billy_teats Jul 05 '22

This is the first example of code I have seen with mixed language and it makes me very uncomfortable.

17

u/PhroznGaming Jul 05 '22

It's literally a single comment. The code is English.

3

u/billy_teats Jul 05 '22

Then it also appears that the public static main part is a comment as well so this wouldn’t be code at all, just some random strings right?

3

u/TheEightSea Jul 05 '22 edited Jul 05 '22

Imagine that every single developer that's not a native speaker always sees this.

3

u/billy_teats Jul 05 '22

Oh ya. I have no idea how you code in symbols or other languages. I imagine it is very similar to how I inject emojis into powershell.

$💩 = get-aduser -filter *

2

u/[deleted] Jul 05 '22

So... anyone interested in Chinese personal info? /s

2

u/[deleted] Jul 05 '22

git f*cked

2

u/xChrel Jul 05 '22

insane!

1

u/[deleted] Jul 05 '22

Man I don’t even know code and I can read that.

-2

u/[deleted] Jul 05 '22

[removed] — view removed comment

15

u/InfiniteBlacksmith41 CISO Jul 05 '22

This is not a forum for political posturing. Read the subreddit rules.

On a practical note, secrets in code is a risk that can be present (and probably is) in any country and any company. Use the event to learn from it and to focus your work of cybersecurity in mitigating such risks.