Post

1/ A former DevOps colleague recently woke up to a $70k GCP bill. And honestly, 𝗶𝘁 𝗺𝗮𝘆 𝗯𝗲 𝘁𝗵𝗲 𝗯𝗲𝘀𝘁 𝘁𝗵𝗶𝗻𝗴 𝘁𝗵𝗮𝘁 𝗵𝗮𝗽𝗽𝗲𝗻𝗲𝗱 𝘁𝗼 𝘁𝗵𝗲𝗺. After investigating, they found out that an 𝗔𝗣𝗜 𝗸𝗲𝘆 created in 𝟮𝟬𝟮𝟬 with no restrictions had been leaked and was now being 𝗮𝗯𝘂𝘀𝗲𝗱 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗚𝗲𝗺𝗶𝗻𝗶 𝗔𝗣𝗜.

2/ They disabled the key immediately, only to discover it was tied to their Firebase SSO implementation. The key was meant to exist and to be public. It wasn’t meant to be unrestricted.

4/ See, there’s a growing class of threats called 𝗔𝗣𝗜 𝘄𝗼𝗿𝗺𝘀. @trufflesec.bsky.social has been writing about them, and we now have real-world examples like 𝗦𝗵𝗮𝗶-𝗛𝘂𝗹𝘂𝗱. These rely on chaining trust across services. 𝗡𝗼𝘁 on compromising hosts.

5/ 𝗔 𝘁𝘆𝗽𝗶𝗰𝗮𝗹 𝗽𝗮𝘁𝗵 𝗹𝗼𝗼𝗸𝘀 𝗹𝗶𝗸𝗲 𝘁𝗵𝗶𝘀: 1.A leaked API key is discovered (GitHub, S3, logs, etc.) 2.That key grants access to a service (storage, analytics, CI/CD) 3.Inside that service, more credentials are discovered

6/ 4.Those credentials unlock other platforms (Jira, artifact stores, ticketing systems) 5.The process repeats across systems, accounts, and even companies The important detail is that not all keys are equal, but 𝗮𝗹𝗹 𝗸𝗲𝘆𝘀 𝗮𝗿𝗲 𝘂𝘀𝗲𝗳𝘂𝗹.