GitHub GitHub Checkout, 16 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Find Hard Coded Secrets in Your Code - GitHub Checkout

Description

4:48 - Demo

When you push commits to a private repository with secret scanning enabled, GitHub scans the contents of the commits for hard-coded secrets. Hear Sasha Rosenbaum (https://twitter.com/DivineOps) and Bukky Adebayo (https://twitter.com/bukkyadebayo) discuss hard-coded secrets and see secret scanning in action!

GitHub Secret Scanning overview
https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/about-secret-scanning

GitHub Secret Scanning documentation
https://docs.github.com/en/free-pro-team@latest/github/setting-up-and-managing-organizations-and-teams/managing-secret-scanning-for-your-organization

Becoming a Secret Scanning partner
https://docs.github.com/en/free-pro-team@latest/developers/overview/secret-scanning

Bukky Adebayo:
GitHub - https://github.com/bukkyadebayo
Twitter - https://twitter.com/bukkyadebayo

Sasha Rosenbaum:
GitHub - https://github.com/DivineOps
Twitter - https://twitter.com/DivineOps

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
Google+: http://google.com/+github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

Hello and welcome to github checkout. I am sasha rosenbaum, a program manager at github and today we're talking about secret scanning. My guest today is bookie adebayo bookie. Would you like to introduce yourself.

B

Hi yeah thanks sasha, I'm buki. I am a product manager here at github. I manage a couple of our security products, but today I'll be talking about secret scanning one of the products that I've been managing for the past few months.

A

All right, so, let's jump right into secret scanning. So I know secret scanning for public repos has existed for a long long time and most of our users are gonna. They have an idea that we do this, but they don't exactly know how it works. So would you like to explain to us how it works behind the scenes.

B

Yeah, so um for public repos, what we do is we scan all the public repos and we look for secrets um for our of our partners so like their developer credentials, so our partners will tell us hey our developer. Credentials are follow this particular regular expression. So can you search all the public repos and find those and send those to us, and so then we send them to our partners. Our partners then notify their customers or revoke the tokens that and then notify them and say hey.

B

We found this particular um credential in open source in public repos. It's compromised now so like. Maybe you should do something about that.

A

B

Currently, the secret scanning engine is built using like intel's, you know hyper scan, so we try to catch things right as soon as they're spilled. So it's really it's a pretty quick turnaround in terms of as soon as a commit happens.

A

Oh very cool! So if, as a developer, I checked in say my azure or my aws api key, um you just immediately gonna notify the partner and then probably that secret is gonna, be revoked.

B

Yeah, basically, yes, essentially, that's exactly what happens. It's a really good description and it's pretty quick. Actually, I think within five minutes, we're able to do it and get it to the to the partner and the partner is able to either revoke it or notify the user.

A

So for from the data that we have, how often does it happen? How often do people check secrets into source control.

B

So it's about a million different detected secrets per month for us, um but some of those are obviously going to be false, positives and they're, not necessarily real secrets. They just happen to match our partner's regular expression, but a million is still like, even if half of those were real, that's still a little a little uh stressful. I don't know yes yeah yeah, yes, um but like for private repos, what we're finding is actually like.

B

We scanned about 37 000 private repos over the past um few months and only 5 000 of those have detective secrets in them. So like it's, not everybody. By any stretch of the imagination, that's committing secrets. It is still it's a smaller number um or percentage, but it's still, you know, five thousand repos is still a little bit like all right. We could.

A

Do better right, we could definitely do better, um so I I know we are just talking about. You know releasing that feature for private repos. I know that's been kind of in the works and been asked for it for a long time. Was there any particular challenges uh in implementing that feature for private repos.

B

So for public repos I'll start talking about public groups and talk about why it's challenging to move it over to private for public repos, we don't tell our users anything we just um you know.

B

We just send the detected tokens to our partners for private. We actually have to show our users some sort of user interface, and because we have to show our user some sort of user interface, then we have to make sure that what we're showing them is high value and high risk, so we're showing them important things. So one of the biggest problems that we had to to face with that was how do we make sure that we're showing them things that are important?

B

So, no, not you know random strings or goods that happen to match their regular expression, but like actually like this is a secret. You should do something about it and then the other half of it is like. What's the user experience of dealing with that? So, what's the developer experience of handling a committed secret, because you know you and I can imagine we're developers- we've been writing so we're trying to ship a feature, and it's like you know the ninth hour, we're almost there and then github's like yo.

B

Here's the secret, it's pretty much close to fraud like do something about it, and we don't want that experience because it's a little bit it can be a little like gut wrenching. If you know whoa, I just committed this aws secret, like how do I you know deal with that, so we wanted to ensure that we're actually holding developers hands to the whole process and making sure that we're not creating really stressful situations unnecessarily.

B

So yeah, that's it's yeah! So it's been an interesting journey translating from public to private because of those those particular concerns. So.

A

We've talked a little bit about the user experience and I feel like now you got to show us what the user experience actually looks like.

B

Yeah, let me just share my screen um so before this I had created a bookie demo repo. You know to just showcase how this works and I committed a secret, um not a bunch of secrets, but one one token um and you'll notice right here is that we're like we say one right there to match the fact that we found a secret and in within this tab, there's a detected secrets section and there the token shows up as a twilio api key.

B

In addition to this, we will send um folks in email that says: hey we detected it's a secret. You should probably go check this out.

A

So twilio is one of our partners and we know what their api keys look like, and so that's how we were able to detect it. Yes,.

B

Yeah, and so you know, we show them, we show folks this the secret, where we found it, give some some sort of guidance around like here's, what you should do with it. So you know you can either rotate it or revoke it with twilio um and sort of like why this is a risk for people to know, then you can.

B

The developer can either say: that's not real, it's a false positive, it's using test or won't fix, and if it is a real secret and they decide to go to twilio and revoke it at twilio, roy david at twilio, they can then say: oh, this is reveal so I'll. Just say assume that I've just done that and I'll say it's revoked and then the sec. The alert will get closed. So you'll see zero secrets here and there's no there's not gonna, be any count here as well.

A

Nice and I just learned that there's also a reopen button, so I could also go in there and then um basically say. Oh no. I was mistaken about how to handle that secret and I can actually reopen the issue.

B

Yes, yeah. We've definitely heard like people wanting to be like. Oh this was. I thought this was a false positive, but it's actually not a false positive. It's a real positive and things like that. That happen all the time, so you can reopen it to make sure that it's still an alert, that's showing up for you and so that you can decide what to do with that later.

B

So I can just reopen it and then.

A

Very cool um I super like that, so if I'm a developer, uh where do I go to sort of start using this feature now.

B

So for public repos, you don't have to do anything. We just automatically um scan public repos um and do that with our partners for private. You have to reach out to our sales team and like and basically get our advanced security offerings added to your um see your github package uh yeah and then, if you want to be a partner, you can email us and we'll help you become a partner as well.

A

That sounds great, so we'll share the links on in the show notes for this video, so you can all check out the beta, and you can also see how to become a partner um and thank you so much brookie. This has been really really good, um and uh this has been get up check out. uh Please hit the subscribe button for more videos on security, related topics and more and I'll see you next time.

A