tspof on Nostr: Independent security researcher Ben Zimmermann, in collaboration with MongoDB's ...

Independent security researcher Ben Zimmermann, in collaboration with MongoDB's Kingfisher team, scanned 7,256,531 public repositories on Gitee, China's largest Git hosting platform, using TruffleHog and Kingfisher scanners. They found 26,400 unique verified-live credentials, including high-level credentials for major enterprise AI platforms and thousands of live cloud provider keys. Gitee's API limits complicated the enumeration process, requiring innovative scraping methods to build a corpus of repositories. The scanning cost about $3,000 and took roughly a month. Credential exposure density on Gitee was higher than that reported on GitLab and Bitbucket, with many credentials committed in the past two years and involving both Chinese and Western tech companies. The dual-scanner approach improved detection coverage substantially. The researcher shared detailed reports with vendors to assist in credential revocation, but the status of remediation efforts remains unknown. The pipeline used is adaptable to other Git hosts with little modification.

Source: https://www.mongodb.com/company/blog/technical/scanning-7-point-25-million-public-repositories-chinas-largest-git-platform-for-secrets



#news_en #credentials #security #opensource #mongodb_com