Infosys leaked FullAdminAccess AWS keys on PyPi for over a year | Tom Forbes
tomforb.es/infosys-leaked-fulladminaccess-aws-keys-on-pypi-for-over-a-year
What Jamie wrote
Leaked credentials to cloud services is a huge problem, and it is so easy to make. This is wild that this was publicly exposed for a year!
At the top of the file, embedded as string constants, was an AWS access key and AWS secret key. The rest of the code seemed to be interacting with a S3 bucket in pretty standard ways: pulling data, loading it into pandas and computing some basic aggregates. It seems like this code came from an internal Github instance inside Infosys and was accidentally published.
I assumed the key had been revoked (it’s been public for over a year!), but to my great surprise I found it was still active!
😳