| ▲ | john_strinlai 7 hours ago |
| >Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow "“AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems" while i understand and sympathize with the fact that CISA is kind of being gutted, a passwords.csv with weak passwords is inexcusable incompetence. not much budget is required for a password manager. embarrassing all around. |
|
| ▲ | tantalor 7 hours ago | parent | next [-] |
| The word you're looking for is "gross negligence" |
| |
| ▲ | gleenn 5 hours ago | parent | next [-] | | Sometimes I feel like it's a cover for some other org actually just wanting to steal the data and this being the excuse. | | |
| ▲ | bix6 4 hours ago | parent | next [-] | | You mean like if our government was compromised at the highest levels and they wanted to undermine everything without the public realizing? Btw what happened to all the social security data that DOGE exfiltrated? | | |
| ▲ | juvoly 3 hours ago | parent | next [-] | | When empires collapse, it's usually not caused by a foreign power, but by negligence and corruption from within | |
| ▲ | red-iron-pine 3 hours ago | parent | prev [-] | | the fact we're asking about it means the public realized the problem is the public is dumb, at least when it comes to security, and couldn't tell you why password123 is bad | | |
| ▲ | bix6 3 hours ago | parent [-] | | I think most people realize that leaving your passwords in public is dangerous. |
|
| |
| ▲ | HoldOnAMinute an hour ago | parent | prev [-] | | Don't they call this "parallel construction" or some such ? |
| |
| ▲ | john_strinlai 7 hours ago | parent | prev [-] | | "crazy crazy" gets the same point across | | |
| ▲ | binkHN 6 hours ago | parent [-] | | Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money. | | |
| ▲ | sandeepkd 6 hours ago | parent [-] | | While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than something thats shared across the company/group | | |
| ▲ | mikestew 5 hours ago | parent | next [-] | | The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. This strikes me as so wrong, I wonder if I’m misreading your comment. For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords. | | |
| ▲ | sandeepkd 5 hours ago | parent | next [-] | | Lets take a concrete example, suppose you have AWS root account credentials. Are you going to assign them to one individual identity or as a company you would keep them accessible to a group of admins. Its going to be the second choice almost for every big company which makes them shared credentials. Coming to team password managers at high level, its a shared location guarded behind closed doors (probably encryption at transit and rest). They would be another set of software that every company specially small business or contractors may not be incentivized to pay for. Some one in their naivety considered Github as a safe enough place, assuming that the access is guarded which turned out to be wrong and exposed this thing. Lastly IT teams in large corporations being secure is a myth for most part. Your root keys for the most popular CA providers were shared in plain text emails not so long ago. | | |
| ▲ | antonvs 5 hours ago | parent | next [-] | | This organization is using AWS apparently. They would store the root account credentials in AWS Secret Manager. That costs $0.40 per month. People in the relevant admin group would have access to them. They would log in with their individual AWS credentials in order to access the root credentials if they need that. But, requiring AWS root credentials itself is an anti-pattern and implies an immature organization. That should not be needed for day-to-day operation. This is all just ignorance and incompetence, nothing more. > Lastly IT teams in large corporations being secure is a myth for most part. This is CISA. The Cybersecurity and Infrastructure Security Agency for the United States. Security is what they're supposed to specialize in. The only potential excuse here is that DOGE gutted them to a point that has completely compromised their capabilities. However, this situation is bad enough that it suggests that problems predated that incident. | | |
| ▲ | sandeepkd 4 hours ago | parent [-] | | To be honest I do not know how to respond to this, cause this plays out quite often this way and sounds pretty convincing on surface. Unfortunately this is the gap between theory and implementation. There is a reason why the ROOT credentials are called ROOT. In case of anything going wrong, all your regular user accounts would be locked, see how you lock yourself out of this circular dependency. ONE SHOULD NEVER NOT PUT THEIR ROOT CREDENTIALS IN THE SECRET MANAGER OF SAME ACCOUNT. Its a classical circular problem, compilers compiler type. For AWS itself they have this additional concept of management account that allows you to defer this problem to just one more level. Bottomline, you can have any number of boxes to lock other boxes and put their key to bounding box, ultimately there would be one outermost box that is locked by key which is not in any box |
| |
| ▲ | Hikikomori 4 hours ago | parent | prev [-] | | We deleted the root credentials efter initial setup where we added mgmt iam accounts used by our automation. If we ever needed them we used the recovery process. All users and services use temporary credentials. | | |
| ▲ | sandeepkd 4 hours ago | parent | next [-] | | I made an assumption that you have federated AWS account setup. One organization management AWS account and then federated accounts under it and you are referring to deletion of deletion of ROOT credentials in the federated accounts. Considering thats not the case, what you just did is move the goal post to a account recovery process. Question becomes who has ability to recover the account, in case its tied with email then most likely it has to be a shared email box. What you have now is a much more fragile system in case of custom domains, where whoever is controlling the email domain (DNS management capability) can take over the AWS accounts. | | |
| ▲ | Hikikomori 3 hours ago | parent [-] | | One account, org, federated, whatever. You don't need to store the root credentials. An email per account where only security team has access. Whoever can modify domain can already do this. |
| |
| ▲ | sandeepkd 4 hours ago | parent | prev [-] | | This would be a incorrect representation/comparison of the problem being discussed. The semantics of ROOT account changes in the case when a separate management IAM account is introduced. In this case the question would become how you are securing the ROOT credentials for the separate AWS IAM management account/tenant. | | |
|
| |
| ▲ | realo 5 hours ago | parent | prev | next [-] | | You are right... Most use Excel files ... | |
| ▲ | throwawaypath 3 hours ago | parent | prev [-] | | >For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords. It's CURRENTYEAR. No one should be using team password managers or files to store credentials. There should not be storable credentials. |
| |
| ▲ | morpheuskafka 4 hours ago | parent | prev | next [-] | | He worked for CISA. Surely there is either a security clearance with indoctrination and training, or at the very least, some sort of mandatory training/onboarding for all contractor staff? | |
| ▲ | MrDarcy 5 hours ago | parent | prev | next [-] | | The error and omission of not enforcing mandatory security training covering posting plaintext passwords to public sites for CISA contractors is itself an act of gross negligence. So much so the contracting company’s insurer would cite it as the reason why the claim is not covered by their policy. | |
| ▲ | Forgeties79 4 hours ago | parent | prev | next [-] | | > While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. This isn’t a grocery store or something it’s CISA. This is like a gun going off in a cop’s holster while he’s texting and driving without a seatbelt. Yeah he’s a contractor but that doesn’t suddenly allow for such incompetence. | | |
| ▲ | sandeepkd 3 hours ago | parent [-] | | I have worked with some of the experienced folks in federal space in the past, who were super smart, experienced and COSTLY from managements perspective. They had the ability to challenge the management on such things. Most of them have either retired, managed out or moved on. What you have here is not a reflection of the individual but the entire management chain. Its a race to make most money and at times these contractors are number of seats to fill at lowest possible cost. | | |
| |
| ▲ | antonvs 5 hours ago | parent | prev [-] | | > shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. What do you mean by this? There are password managers and more enterprise-oriented secrets managers, and application platforms typically have integration with them. Individuals shouldn't be using shared secrets. This is a completely solved problem and it's not difficult to set up properly, especially in a cloud environment like AWS, where you can use services like AWS Secrets Manager. | | |
|
|
|
|
|
| ▲ | uean 2 hours ago | parent | prev | next [-] |
| Not defending this person, but it's obvious that this person used Github as a file-sync. Firefox-passwords.html and firefox-bookmarks.html are what you dump before migrating to a new computer and importing them there. An old school practice before FF sync was around. This is mentioned in the article but it stood out enough to call it here. |
|
| ▲ | totetsu 7 hours ago | parent | prev | next [-] |
| One the one hand the CISA is being gutted, and on the other hand there is an ever increase of rhetoric about cybersecurity, national interests, critical infrastructure.. |
| |
| ▲ | SV_BubbleTime 5 hours ago | parent | next [-] | | Complaining about gutting, during examples of gross negligence is kind of a sympathy destroyer for me. | | |
| ▲ | ImPostingOnHN 4 hours ago | parent [-] | | Complaining about gross negligence, after all the competence has been gutted out, strikes me as misdirected frustration. |
| |
| ▲ | downrightmike 5 hours ago | parent | prev [-] | | That's why we don't listen to rhetoric. |
|
|
| ▲ | 6 hours ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | mystraline 6 hours ago | parent | prev | next [-] |
| Most of the folks I know who were with CISA were purged with the January-March 2025 Doge campaign. 0 notice "we 20 year olds dont understand what you do so fired". A group was working on Diebold voting insecurity, and foreign implant hacking. Gone. |
| |
| ▲ | mxuribe 5 hours ago | parent [-] | | > ...A group was working on Diebold voting insecurity, and foreign implant hacking. Gone... The conspiracy theorist in me from years ago would have stated that maybe this action from DOGE was purposeful...but, nowadays, i see lots more incompetence that merely might present/display as conspiracy! lol :-D |
|
|
| ▲ | jimt1234 6 hours ago | parent | prev | next [-] |
| The first "hack" I ever reported was when I found a plaintext passwords file on my high school computer network...in 1987. The more things change, the more they stay the same. |
| |
| ▲ | g-technology 2 hours ago | parent | next [-] | | Mine too, but it was in the late 90’s and I found an open table in an access database that the school district used for grades and attendance. It listed plaintext usernames and passwords for every user in the system. I managed to use that to get to know the districts head of IT and get a summer job with them. | |
| ▲ | JackGreyhat 3 hours ago | parent | prev [-] | | Machine Head - Struck A Nerve The more things change, the more they stay the same. Wise words, lovely song. |
|
|
| ▲ | throwaway5752 6 hours ago | parent | prev | next [-] |
| DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional. |
| |
| ▲ | parineum 5 hours ago | parent | next [-] | | Which DOGE employee put this file on GitHub? | | |
| ▲ | throwaway5752 5 hours ago | parent | next [-] | | "I didn't create the epidemic, I just fired all the doctors and dissolved the medical schools" Security doesn't happen by magic. It is enforced by process, maintained by people and systems built and run by people. Furthermore, when people are under stress and underresourced, they make more mistakes. This was inevitable given the budget cuts. You can't fire everyone at AWS and say one intern will support it, and say that it is a profitable and sustainable restructuring. Any fool can see that will fail, so if it were actually implemented by someone who is not a fool, you can conclude it is intentional. | | |
| ▲ | parineum 5 hours ago | parent [-] | | The analogy to not posting secrets to the public isn't medical schools and doctors, it's a sign in the bathroom that says "employees must wash hands". | | |
| ▲ | ceejayoz 5 hours ago | parent [-] | | They replaced the people who put the signs up with people who think signs are too woke. | | |
| ▲ | stackedinserter 3 hours ago | parent [-] | | [flagged] | | |
| ▲ | ceejayoz 3 hours ago | parent [-] | | We can know, and we do know. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch. https://www.nytimes.com/2025/04/05/us/politics/trump-loomer-... > For four years, [Trump] nurtured deep resentments about CISA, which had declared that the 2020 election was one of the best run in history, undercutting his false claims that he had been cheated of victory. Weeks after taking office this year, he began a campaign of dismantlement. > Federal programs that monitored foreign influence and disinformation have been eliminated. Key elements of the warning systems intended to flag possible intrusions into voting software have also been degraded; the effects may not be known until the next major election. And contractors who worked with local election officials to perform cybersecurity testing, usually with federal funding, have found the deals canceled. > In early March, CISA — which is nested inside the Department of Homeland Security — cut more than $10 million in funding to two critical cybersecurity intelligence-sharing programs that helped detect and deter cyberattacks and that alerted state and local governments about them. One program was dedicated to election security, and the other to broader government assets, including electrical grids. |
|
|
|
| |
| ▲ | ceejayoz 5 hours ago | parent | prev | next [-] | | They fired the people who might've prevented that. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch. | | |
| ▲ | parineum 5 hours ago | parent [-] | | Not posting secrets to public GitHub repos doesn't need red teaming. | | |
| ▲ | jnovek 4 hours ago | parent | next [-] | | Storing a bunch of passwords in a plain-text list that an individual can access violates zero-trust AND least-privilege which I think a red team might have some opinions on. | |
| ▲ | wil421 2 hours ago | parent | prev | next [-] | | At my job the commits wouldn’t have even made it to our private GitHub repo. The scanners would’ve rejected it when you tried to push a commit. They find keys and tokens all the time. | |
| ▲ | ceejayoz 5 hours ago | parent | prev | next [-] | | A red team might well notice that the build process doesn't check for accidentally committed secrets. | |
| ▲ | gumby271 5 hours ago | parent | prev [-] | | And yet, here we are. |
|
| |
| ▲ | skywhopper 5 hours ago | parent | prev [-] | | The one who fired the team that prevented this sort of thing. | | |
| ▲ | strictnein 4 hours ago | parent | next [-] | | What team prevented someone from uploading sensitive information to public sites? This is a billion dollar a year industry (Digital Loss Prevention) and all the solutions suck. | |
| ▲ | SV_BubbleTime 5 hours ago | parent | prev | next [-] | | I’m not sure you can complain that the people who should prevent this type of thing are having their funding reduced what are the example is they just did this exact thing. | |
| ▲ | parineum 5 hours ago | parent | prev [-] | | I really hope they didn't also fire the "don't shit your pants" team or that office is going to smell really bad. | | |
| ▲ | malcolmgreaves 5 hours ago | parent [-] | | DOGE only fired those who were loyal to the facist. Anyone who is competent was illegally fired. |
|
|
| |
| ▲ | dude187 4 hours ago | parent | prev | next [-] | | Yes, DOGE invented storing lists of text passwords and uploading them somewhere. What a monumental cost savings innovation, surely never been done before! | | | |
| ▲ | scottyah 5 hours ago | parent | prev [-] | | [flagged] | | |
| ▲ | ceejayoz 2 hours ago | parent | next [-] | | You incorrectly mistake "no authority" for "didn't happen". Judges spank the executive branch for exceeding their authority fairly regularly, including in this case. https://lawandcrime.com/high-profile/no-statutory-authority-... > The court finds that neither OPM nor OMB have any statutory authority to terminate employees – aside from their own internal employees – "or to order other agencies to downsize" or to restructure other agencies. And, as far as the Elon Musk-led agency is concerned, the judge is withering: "As plaintiffs rightly note, DOGE 'has no statutory authority at all.'" https://www.reuters.com/world/us/trump-scores-win-suit-chall... > A judge on Tuesday declined to immediately block Elon Musk's government efficiency department from directing firings of federal workers or accessing databases, but said the case raises questions about Musk's apparent unchecked authority as a top deputy to President Donald Trump. | |
| ▲ | john_strinlai 5 hours ago | parent | prev [-] | | this does not align with.. well.. anything ive read about DOGE | | |
| ▲ | scottyah 3 hours ago | parent [-] | | [flagged] | | |
| ▲ | mikeyouse 2 hours ago | parent [-] | | Per the EO that established DOGE, each Agency head established a 4-member DOGE team consisting of a lead, an engineer, a HR specialist and an attorney. Those DOGE teams absolutely did fire thousands of employees after EO 14210 called for huge RIFs across the government. |
|
|
|
|
|
| ▲ | 7 hours ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | delfinom 6 hours ago | parent | prev | next [-] |
| Dealing with IT departments run wild with cyber security monkeys that can only follow checklists with no independent thought. The spreadsheet of passwords is a tad more common than it should be because the password managers don't meet whatever arbitrary checklist of invented cyber security requirements they blindly follow. But Excel does. Lol |
|
| ▲ | modriano 6 hours ago | parent | prev [-] |
| Sure, it could be incompetence. It could also be an intentional strategy to tie up CISA/DHS resources, poison or obstruct CISA/DHS investigations/operations, open up systems to sunlight and journalism, or cause general chaos. The not-responding-when-notified part makes me think it's not just incompetence. |
| |
| ▲ | stackskipton 6 hours ago | parent [-] | | >The not-responding-when-notified part makes me think it's not just incompetence. Strong disagree. The person in question probably thought it was a private repo on Github and had a massive deer in headlights reaction when they got contacted. Whoever this is, lost their job, possibly security clearance and more. This was 100% life altering "mistake"/gross incompetence decision they made. | | |
| ▲ | SoftTalker 5 hours ago | parent | next [-] | | the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories. That doesn't support the theory that it was a mistake. That was intentional action. Maybe he was being blackmailed, and was coerced to do it. Or maybe he was a foreign agent or sympathizer who had infiltrated the organization. | | |
| ▲ | stackskipton 5 hours ago | parent [-] | | There has been no indication if this was personally owned GitHub or Organizational owned GitHub. If it's personally owned, it still is one person doing massive dumb. Even if it's Organizational, it's very possible that person in question had rights to do this without oversight. I've been a government contractor before, it does not employ best and brightest, it employs the average and below generally. |
| |
| ▲ | modriano 6 hours ago | parent | prev [-] | | Maybe. I didn't see enough in the article about the repo owner/committer to make any inference about their intentions and wouldn't jump to conclude it was incompetence or malice or crafty leaking. The only real signal I saw was that the repo didn't immediately turn private when the person was notified. For some people, yeah, this could be a career killer. For some other people, it might just precipitate a flight back to Moscow or Beijing or something. |
|
|
