Are Source Code Leaks the New Threat Software vendors Should Care About?

Less than a month ago, Twitter indirectly acknowledged that some
of its source code had been leaked on the code-sharing platform
GitHub by sending a copyright infringement notice to take down the
incriminated repository. The latter is now inaccessible, but
according to the media, it was accessible to the public for several
months. A user going by the name FreeSpeechEnthousiast committed
thousands of documents belonging to the social media platform over
several months.

While there is no concrete evidence to support this hypothesis,
the timing of the leak and the ironic username used by the
perpetrator suggest that the leak was a deliberate act aimed at
causing harm to the company.

Although it is still too early to measure the impact of this
leak on the health of Twitter, this incident should be an
opportunity for all software vendors to ask a simple question:
what if this happened to us?

Protecting sensitive information in the software industry is
becoming increasingly critical as the frequency and impact of data
breaches and leaks continue to rise. With the growing reliance on
software, the amount of sensitive information stored in digital
form is constantly expanding.

About a year ago, the Lapsus$ hacking gang made headlines for
publicly leaking the source code of some of the biggest names in
technology. The group’s trophies included nearly 200GB of source
code from Samsung, the source code for Nvidia’s DLSS technology,
and 250 internal projects from Microsoft. Several other software
companies have also been targeted, with their codebases falling
into the wrong hands: LastPass, Dropbox, Okta, and Slack have all
disclosed that some of their code was compromised.

A Treasure Trove of Sensitive Information

Source code contains a wealth of sensitive information, and that
includes, most of the time, hard-coded secrets such as passwords,
API keys, and certificates private keys. This information is often
stored in plain text within the source code, making it an
attractive target for attackers.

There are many potential risks associated with leaked private
source code, but exposed secrets are perhaps the most concerning:
in the 2023 State of Secrets Sprawl^[1], the single largest
analysis of public GitHub activity, GitGuardian reported 10 million
newly exposed secrets in 2022 alone, a staggering number that grew
67% year-over-year. The phenomenon is in great part explained by
the fact that it is very easy when using version control like Git
to mistakenly publish hard-coded secrets buried in the commit
history. But malicious intentions can also be the cause of the
disclosure of confidential information.

When a source code leak^[2]
happens, these secrets can be exposed, providing attackers with
access to systems and data. Secrets-in-code is a particularly
significant problem. They allow an attacker to move fast to exploit
a number of systems, making it more difficult for organizations to
contain the damage. Unfortunately, internal source code is a very
leaky asset. It is widely accessible by developers throughout the
company, backed up onto different servers, and even stored on
developers’ local machines. That’s one reason why making sure no
secrets are exposed in the first place is so crucial.

In addition to the risk of malicious activity, mistakes made by
developers can also put companies at risk. For example, accidental
leaks of code can occur due to the way GitHub has architected its
enterprise/organization offering. This makes it cumbersome for
organizations to prevent accidental leaks and, conversely, too easy
for developers to make mistakes.

Exposed logic flaws are also a concern. There may be
vulnerabilities in the way software applications handle functions
and data that could be present in the source code. When source code
is exposed, attackers can analyze it for these vulnerabilities and
exploit them to gain unauthorized access. The same goes for
application architecture. Often, organizations expect the
architecture of their applications to be hidden, a concept called
security by obscurity. When source code is exposed, it can lead
attackers to a map of how applications work, giving them the
opportunity to find hidden assets.

Time to Act: Protect Your Source Code

The problem is not new, and many in the security industry have
been sounding the alarm for some time. However, recent initiatives
by the Biden administration to strengthen the cyber resilience of
infrastructures and SMEs have increased the focus on software
vendors’ accountability. As cybersecurity becomes a national
priority, there will be increased pressure to promote secure
development practices and shape market forces to prioritize the
protection of sensitive information.

So what can software vendors do to protect their source code and
sensitive information? First and foremost, they must recognize the
potential risks and take appropriate steps to mitigate them. This
includes implementing security measures to protect against
malicious activity and ensuring that hard-coded secrets are not
stored in plain text within the source code.

However, more than a single approach is needed to protect
sensitive information in the software industry. Using a combination
of secrets management solutions, secure coding practices, and
automated secrets detection can provide a comprehensive security
strategy.

Secrets detection involves scanning source code and other
digital assets for hard-coded secrets, alerting developers to
potential vulnerabilities that attackers could exploit. With this
proactive approach, organizations can better protect their
sensitive information and identify potential security risks earlier
in the software development lifecycle.

Combining a secrets detection solution in conjunction with
secrets management and secure coding practices provides a layered
security approach that can help to mitigate the risks associated
with leaked source code and other potential vulnerabilities.

In addition to these technical measures, it is also important to
ensure that employees are trained and educated on cybersecurity
best practices. This includes regular training and awareness
programs to ensure that employees are aware of the risks and know
how to protect sensitive information.

Continuous Security

Overall, protecting source code and sensitive information is a
critical issue for software vendors. As the frequency of malicious
activity and accidental leaks continues to increase, it is
essential that vendors take steps to mitigate the risks and protect
their customers’ data. By implementing secure coding practices,
using secrets management solutions, and providing employee training
and awareness programs, vendors can help drive a continuous
improvement of software development practices in the long run.

It is important to note that protecting source code and
sensitive information is not a one-time event. It is an ongoing
process that requires constant attention and vigilance. Software
vendors must continually monitor their systems for potential
vulnerabilities and ensure that their security measures are up to
date.

If you’re interested in improving your organization’s secrets
management practices, we encourage you to take our secrets management questionnaire^[3] (anonymous) to assess
your specific situation. It only takes five minutes to gain a quick
overview of your organization’s strengths and weaknesses and get
started on the path to better security.

Ensure your sensitive information is protected, and your
customers’ trust is maintained.