Are there any frameworks or applications available for automatic detection of credential or secrets being leaked?

So far, I've found a number of academic papers on papers on the subject but no specific applications or frameworks. I've also found Netflix's Scumblr tool, which sort of fits the bill: automatic searching of social media sites, possible use-case would be to add regexes for emails or possible API strings.

  • A lot depends on the context in which your credentials may leak, and what are the credentials are you defending. If you decide to use machine uptime in the TCP time extension as a credential, that would be absolutely impossible to defend from being leaked (apart from never connecting the machine to a network). – grochmal Sep 15 '16 at 16:47
  • 1
    I guess (just guess) that what you are after is whether there are frameworks that can guess if a string may be a credential to somewhere. i.e. given that you have a webpage in which you publish user content you want to make sure that an user will not publish his credentials to some place. Just like bitbucket emails you if you for example push your AWS keys into a public repo. Is this what you are after? – grochmal Sep 15 '16 at 16:56
  • 1
    There are very less projects on this. One of the useful projects I found is Have I been pwned? . They have currently the largest database of compromised and leaked credentials. You can register your email id there and if in future any of those email ids, accounts are in compromised data, site will provide you an alert within your email. – FrOgY Sep 15 '16 at 18:27
  • @grochmal Yeah, I mean any tools that are available for secret leaking would be good for research :) – Peter Souter Sep 16 '16 at 12:38

This will not be a full answer, since a full answer is not possible: A credential can be anything that you may want to make into a credential. But assuming that the credentials are sensible we can argue about two things:

  1. The first paper you mention simply makes a scheme in which an unauthorized access provokes an alarm (wrong codeword in the paper) which disables the key. In implementation terms this isn't much different from: "after three unsuccessful logins the password is blocked".

    The novelty of the paper is only that they make a full keyscheme (with formal analysis of the scheme).

  2. The second paper talks about something completely different. It is just an enumeration of how systems that publish user data to the web (e.g. github or bitbucket, but it could well be facebook) try to find that inside the published data there are strings that look like credentials to somewhere else. This is pretty similar to what scumblr can be configured to do. Their list of techniques includes rather simple points:

    1. keyword search (e.g. BEGIN RSA PRIVATE KEY)
    2. pattern match (e.g. search for base64 encoded strings)
    3. heuristics (pattern match but using context)
    4. source search (pattern match but using guesses based on the type of source code it is searching)

    These things work, I remember receiving an email from BitBucket when once upon a time I submitted my AWS API key to a repository. But as for their implementation as a specific tool I believe they're just scripts that are invoked as git hooks. Look at this image in the paper:

    enter image description here

    The "key detection module" is called between a user commit and the actual commit to the public repository.

    Github and BitBucket certainly has a database of patterns that are likely to be credentials. And also they certainly have a couple of heuristic algorithms. Points 1 (keyword search) and 2 (pattern match) are trivial to implement with grep, points 3 (heuristics) and 4 (source search) require a good deal of pre-existing data which only places like Github and BitBucket would have.

    Finally note that even the paper argues that the heuristics and source search produce both false negatives and false positives. Therefore there is no magical solution here.

Had I needed something to check for users on my website publishing their credentials to somewhere by accident I'd try to use points 1 (keyword match) and 2 (pattern matching) and then simply build a heuristic algorithm that does not depend on so much on pre-existing data. On way would be to try Kolmogorov complexity (see this old question about string complexity from more info).

The assumption is that complex credentials will have a lot of entropy by byte since they should be difficult to brute-force. This is a bad assumption in some cases: for example base64 encoded strings have little complexity compared to their length. We will need to catch base64 strings in the pattern match phase (phase 2).

Here is a trivial (it uses zlib to approximate Kolmogorov complexity, which isn't particularly close) heuristic algorithm using the assumption above:

#!/usr/bin/env python3

from io import BytesIO
import zipfile

strings = [ b'password password password password'
          , b'correct horse batter staple'
          , b'HdtfhhaissdogkanfhhwnaHDnbahdnSGENdkfQWee=='
          , b'hZjJIdkXndjaodk='
          , b'\x89\x12\x03\x561w\x10'
for s in strings:
    fp = BytesIO()
    zf = zipfile.ZipFile(fp, 'w', zipfile.ZIP_DEFLATED)
    zf.writestr('f', s)
    print('%50s' % s, float(len(fp.getvalue())) / float(len(s)) )

And its output:

        b'password password password password' 3.257142857142857
                b'correct horse batter staple' 4.777777777777778
b'HdtfhhaissdogkanfhhwnaHDnbahdnSGENdkfQWee==' 3.3255813953488373
                           b'hZjJIdkXndjaodk=' 7.375
                        b'\x89\x12\x03V1w\x10' 15.571428571428571

As expected it works well to separate simple strings from strings that are sets of more-or-less random bytes. Yet, it works badly on base64 strings and even on some passphrases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.