SoylentNews is people
SoylentNews
from the largfe-bills-are-found-on-giant-ducks,-right? dept.
We had two different reports concerning a bug in a GitHub addon to Visual Studio which led to a developer's keys to their Amazon account getting compromised which resulted in a rather large bill.
GitHub's Visual Studio Add-on costs user $6,500
A developer published some of his code, as a paid GitHub subscriber, to a private storage space on GitHub's servers using a tool co-developed by Microsoft and GitHub. Due to a bug in the software, instead of going to their private storage space, it went to a public one, without the developer having any indication anything had gone wrong.
Included in this private code were the developer's keys to their Amazon cloud account. BitCoin miners, who scan GitHub for Amazon keys, found them and began using the developer's account to process BitCoins in the cloud. By the next morning the developer was receiving notifications of oddities on his account, and contacted Amazon support, by this time he had a $1,700 bill with Amazon. Within the next 2 hours, with various calls to Amazon for support, he finally contained the issue, with a nearly $6,500 bill.
Bug in Visual Studio GitHub Commit Tool Leads to $6,500 Amazon Web Services Bill
A bug in the GitHub Extension for Visual Studio 2015 ultimately led a South African web developer to be charged $6,500 for Amazon Web Services instances used by criminals:
Carlo van Wyk of Cape Town–based Humankode said he used the GitHub Extension for Visual Studio 2015 to commit one of his local Git code repositories to a private repository on GitHub. Unfortunately, however – and unknown to van Wyk at the time – a bug in the extension caused his code to be committed to a public GitHub repository, rather than a private one as he intended.
The extension is developed and maintained by GitHub itself, although it was created with a little help from Microsoft. Van Wyk said in his blog post that both companies have since been in touch with him and the bug has been confirmed and patched. But that won't help mitigate the fallout of what happened after van Wyk committed his repo.
Within around ten minutes after publishing his code, he received a notification from Amazon Web Services telling him his account had been compromised. He had (somewhat foolishly) included an AWS access key in the code that he had committed to GitHub.
It's not entirely clear what happened next. Van Wyk said he immediately changed his AWS root password, revoked all of his access keys, and created new ones. Nonetheless, within hours the data thieves had managed to sign him up for AWS's Elastic Compute Cluster and fire off more than 20 instances in each EC2 region. By the time the dust cleared, his AWS account had racked up a bill of $6,484.99.
Such cases aren't new. Miscreants – probably Bitcoin miners, in most cases – have begun routinely trolling public GitHub repositories with bots that search for AWS keys. In van Wyk's case, however, he never expected his repo to be public in the first place.
[...] GitHub, on the other hand, has apologized for the error in its code, describing it as "inexcusable." GitHub team member Phil Haack added, "As for preventing this in the future, we are trying to take a comprehensive look at the conditions and systems that allowed this happen in the first place and how we can improve those systems to mitigate such issues in the future."
Original Submission #1 Original Submission #2
(Score: 2) by Common Joe on Thursday September 03 2015, @04:55AM
Indeed. Many years ago, I had a credit card and a limit was placed on it. That meant that I could not spend anymore than $X. If I tried to go over X, they would deny the purchase. Fast forward many years later and through pure happenstance, I found out that the definition of limit changed under my nose. It now meant that I could charge more than X and if I did, the purchase would be allowed and I'd be hit with higher interest rates and service charges. I asked for the hard limit because I didn't need more than X and that limit could protect both them and me. They said they could not do it.
This is very much on purpose.
(Score: 2) by bzipitidoo on Thursday September 03 2015, @06:07PM
Yes, reminds me of a policy change print media has tried to push on their customers. They push "automatic renewal" on us. I know print media has been in decline, but it doesn't excuse policy trickery that smacks of desperation. They even try to tell us that, actually, we wanted it, and it's for us. It's so much more convenient, makes life easier. The local newspaper went further, made automatic renewal a requirement, would not offer any subscription plan that didn't include that. So I canceled them. Reader's Digest, which my parents used to get, didn't go quite that far, they just opted-in everyone, and left it to their customers to jump through hoops to exercise the option of not having automatic renewal. I canceled them too.