Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All 7
Security researcher Bill Demirkapi unveiled a massive trove of leaked developer secrets and website vulnerabilities at the Defcon conference in Las Vegas. Using unconventional data sources, Demirkapi identified over 15,000 exposed secrets, including credentials for Nebraska's Supreme Court IT systems and Stanford University's Slack channels.
The researcher also discovered 66,000 websites with dangling subdomain issues, making them vulnerable to attacks. Among the affected sites was a New York Times development domain. Demirkapi's tack involved scanning VirusTotal's database and passive DNS replication data to identify vulnerabilities at scale. He developed an automated method to revoke exposed secrets, working with companies like OpenAI to implement self-service deactivation of compromised API keys.
The researcher also discovered 66,000 websites with dangling subdomain issues, making them vulnerable to attacks. Among the affected sites was a New York Times development domain. Demirkapi's tack involved scanning VirusTotal's database and passive DNS replication data to identify vulnerabilities at scale. He developed an automated method to revoke exposed secrets, working with companies like OpenAI to implement self-service deactivation of compromised API keys.
Gemini (Score:4, Funny)
wow (Score:1)
ALL OF THEM?!? no way
yet another classist paywall (Score:1)
so much for a free press, now we get the fee press
Re: (Score:3)
There's no great solution. Either we allow the market to rule (and no matter the initial state, eventually the market will be controlled by a handful of people), or we nationalize and what, allow the government full control so a different handful of people decide, only less efficiently?
I'm starting to think an educated mob rule is the answer. When someone gets too far out of line, the mob takes care of it. That means anybody in any position of power needs to be careful not to piss off the mob. That's th
Re: yet another classist paywall (Score:3)
We need to stop this. (Score:3, Interesting)
Helping corporations, I mean. They will continue to ignore these vulnerabilities until they are compromised and shamed, or forced to comply by legal requirements.
The only time an executive has taken an interest in making sure their company was secure was when there was a litigation risk, government fine, or threat to the stock price.
wtf is a 'dangling subdomain issue'? (Score:1)
the link domain appears to be linked to a github account:
lixiang521.com. 399 IN CNAME idealeer.github.io.
but all repos seem uninformative.