GitHub tackles leaks by scanning for secrets in pushed code
(2022/04/05)
- Reference: 1649174408
- News link: https://www.theregister.co.uk/2022/04/05/github_prevents_leaks_by_scanning/
- Source link:
GitHub is aiming to help users avoid inadvertent leaks of confidential objects like access tokens by scanning repository content for such secrets before a git push is allowed to complete.
The [1]secret scanning capability is already a feature of [2]GitHub Advanced Security , which is enabled for all public repositories on GitHub.com and an option for GitHub Enterprise users.
With this turned on, it scans repositories for secrets – passwords, encryption keys and authorization tokens – that may have been included by developers accidentally. It can also detect those issued by various service provider partners such as Azure or Adobe.
[3]
Now, GitHub said that secret scanning's new push protection capability embeds secret scanning proactively into the developer workflow itself. But, to avoid disrupting developer productivity too much, this push protection only supports token types that can be detected accurately.
[4]
[5]
To this end, GitHub changed the format of its own secrets last year, and has been working with those service provider partners to push for them to implement patterns that can be more reliably identified. The new push protection capability is starting off with support for 69 such high confidence patterns, the firm said.
With this protection enabled, GitHub will check for high-confidence secrets as developers push code, and block the push if the scan appears to uncover a secret.
[6]
Developers can review the results and remove the secrets from their code before pushing again, or else can choose to flag the secret as a false positive, a test case, or real instance to be fixed later.
[7]GitLab issues critical update after hard-coding passwords into accounts
[8]Zlib crash-an-app bug finally squashed, 17 years later
[9]Dev rigs up receipt printer to spit out GitHub issues
[10]PlanetScale offers undo button to reverse schema migration without losing data
However, if secret scanning push protection is bypassed in this way, GitHub will generate a closed security alert in the case of secrets identified as test cases or false positives. For secrets flagged "to resolve" later, GitHub will generate an open security alert for both the developer and the repository administrator, to allow them to work together on a fix.
In a [11]post announcing the new capability, GitHub said it has already detected more than 700,000 secrets across thousands of private repositories through secret scanning for GitHub Advanced Security.
Organizations with GitHub Advanced Security can enable secret scanning’s new push protection capability at the repository and organization levels via the API or by clicking a button in the UI, the firm said.
Not all new features go down well: last month, GitHub was inundated with complaints after it introduced a social media-style [12]algorithmic feed with suggestions for developers to look at. This prompted a promise from GitHub that it would introduce a setting to allow users to opt out of the distracting feature. ®
Get our [13]Tech Resources
[1] https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning
[2] https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/04/01/gitlab_security_advisory/
[8] https://www.theregister.com/2022/03/30/zlib_data_bug/
[9] https://www.theregister.com/2022/03/29/github_issue_printer/
[10] https://www.theregister.com/2022/03/24/planetscale_undo_button/
[11] https://github.blog/2022-04-04-push-protection-github-advanced-security/
[12] https://www.theregister.com/2022/03/23/github_for_you/
[13] https://whitepapers.theregister.com/
The [1]secret scanning capability is already a feature of [2]GitHub Advanced Security , which is enabled for all public repositories on GitHub.com and an option for GitHub Enterprise users.
With this turned on, it scans repositories for secrets – passwords, encryption keys and authorization tokens – that may have been included by developers accidentally. It can also detect those issued by various service provider partners such as Azure or Adobe.
[3]
Now, GitHub said that secret scanning's new push protection capability embeds secret scanning proactively into the developer workflow itself. But, to avoid disrupting developer productivity too much, this push protection only supports token types that can be detected accurately.
[4]
[5]
To this end, GitHub changed the format of its own secrets last year, and has been working with those service provider partners to push for them to implement patterns that can be more reliably identified. The new push protection capability is starting off with support for 69 such high confidence patterns, the firm said.
With this protection enabled, GitHub will check for high-confidence secrets as developers push code, and block the push if the scan appears to uncover a secret.
[6]
Developers can review the results and remove the secrets from their code before pushing again, or else can choose to flag the secret as a false positive, a test case, or real instance to be fixed later.
[7]GitLab issues critical update after hard-coding passwords into accounts
[8]Zlib crash-an-app bug finally squashed, 17 years later
[9]Dev rigs up receipt printer to spit out GitHub issues
[10]PlanetScale offers undo button to reverse schema migration without losing data
However, if secret scanning push protection is bypassed in this way, GitHub will generate a closed security alert in the case of secrets identified as test cases or false positives. For secrets flagged "to resolve" later, GitHub will generate an open security alert for both the developer and the repository administrator, to allow them to work together on a fix.
In a [11]post announcing the new capability, GitHub said it has already detected more than 700,000 secrets across thousands of private repositories through secret scanning for GitHub Advanced Security.
Organizations with GitHub Advanced Security can enable secret scanning’s new push protection capability at the repository and organization levels via the API or by clicking a button in the UI, the firm said.
Not all new features go down well: last month, GitHub was inundated with complaints after it introduced a social media-style [12]algorithmic feed with suggestions for developers to look at. This prompted a promise from GitHub that it would introduce a setting to allow users to opt out of the distracting feature. ®
Get our [13]Tech Resources
[1] https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning
[2] https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yky8FSWvuZl3bqddMESKTwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/04/01/gitlab_security_advisory/
[8] https://www.theregister.com/2022/03/30/zlib_data_bug/
[9] https://www.theregister.com/2022/03/29/github_issue_printer/
[10] https://www.theregister.com/2022/03/24/planetscale_undo_button/
[11] https://github.blog/2022-04-04-push-protection-github-advanced-security/
[12] https://www.theregister.com/2022/03/23/github_for_you/
[13] https://whitepapers.theregister.com/
captain veg
"GitHub has been working with service provider partners to push for them to implement patterns that can be more reliably identified"
I'm no expert, but that looks like "weakening your encryption" to me.
-A.
Joe W
Not sure about that...
My guess (as good as anyone's) is that tokens would come with headers (or "tail" identifiers like in an .authorized_keys file or rather the public key part of an ssh key pair that define the user / domain / machine it was created for). These would only compromise security through obscurity, which is not much of the former as the latter is not easily achieved...
Fruit and Nutcase
a social media-style algorithmic feed with suggestions for developers to look at. About as annoying as Microsoft's forays into this type of things in Outlook. May I humbly suggest that whoever comes up with these ideas take a look where the Sun doesn't shine and let us get on with our work without hindrance.
"Organizations with GitHub Advanced Security "
Only as secure as your payment.