Infosys leaked FullAdminAccess AWS keys on PyPi for over a year

You can check out their website for a lot of buzwords, but it’s clear from all the stock photos that they take security Very Seriously Indeed ™️.

However, from what I’ve found recently, it seems that Infosys use the following Comprehensive Management-Endorsed Proficiently Driven Cybersecurity Strategy and Framework items:

• Don’t use AWS roles or temporary credentials for your developers
• Instead, use IAM user keys and give them all FullAdminAccess permissions
• Never rotate these keys and store them as plaintext in git
• Use these keys to protect what appears to be medical data about COVID patients
• Have someone publish those keys and the code in a public package to pypi
• Keep those keys active for days after leakage
• Make nonsensical pull requests to try and remove all references to the leak

This morning I woke up to a very strange pull request on my pypi-data project. This project contains metadata for every package published on PyPi (e.g Flask), and it exists because querying the data from PyPi in bulk was annoying and I didn’t want to use BigQuery.

The user was attempting to delete a project called ihip. Looking at the file they where trying to remove, it seemed to be an internal package that was published by mistake on the 2nd of February 2021. The metadata of the package referenced the internal infosys Github instance as it’s homepage, but otherwise looked pretty innocuous.

It seems my project didn’t correctly account for complete packages that have been deleted from PyPi - my bad! I’m not sure how to handle that to be honest - once the package is published the metadata is out there.

Out of interest I downloaded the publicly available release file that was specified in the metadata and found something interesting.

At the top of the file, embedded as string constants, was an AWS access key and AWS secret key. The rest of the code seemed to be interacting with a S3 bucket in pretty standard ways: pulling data, loading it into pandas and computing some basic aggregates. It seems like this code came from an internal Github instance inside Infosys and was accidentally published.

I assumed the key had been revoked (it’s been public for over a year!), but to my great surprise I found it was still active!

So this is definitely something that should be reported to them. I always let my curiosity get the better of me, so I listed the root of the bucket. From the contents it seems that this bucket contains data used to train COVID prediction models. Inside the John_Hopkins_Hospital/ prefix there appeared to be file names that looked like they contained some form of clinical data, which I did not access to verify:

Johns_Hopkins_Hospital/Input/Excel/Covid_patientdetails/covid_patient_details.xlsx

By now it was clear that this was pretty serious. There’s a bucket potentially containing some form of medical data, with the contents listable by a leaked, now public set of IAM credentials.

I wanted to know if I could access them, so I inspected my assigned IAM permissions. I found that the key has AdministratorAccess. This policy gives unrestricted access to all IAM actions, on all services. It’s AWS’s “god mode” policy, and it’s not a good idea to assign these to long-lived credentials issued to developers.

Meanwhile I received a “takedown request” for a specific file in the pypi-data repository, specifically for the data associated with the reaction-utils package. It seems that it’s a pretty vanilla package which is still available on PyPi.

I expect, but I have no proof, that the same person who opened and immediately closed three merge requests in the project (commenting “Na” and “Ah”?) messed up again.