The keys in the home directory
Plaintext keys on an engineer’s laptop, carried off in one go by an infostealer.
(Illustrative scenario, not a real incident)
A-Feng, an engineer,installed a development package that looked perfectly normal.
Hidden inside was a stealerthat packed up the config files in his home directoryand uploaded them.
A few days later,the company’s cloud accounthad a new access key no one recognized.
This twenty-person software startuponly found out at the very end:the stolen cloud keyhad been created by A-Feng two years earlier,and had sat in a local config file ever since,with admin-level permissions.
Those files weren’t in version control,so everyone assumed they were safe.
I used to think keeping it on my own computerwas keeping it in my own home.Later I realizedthe paths infostealers know bestare exactly those few common ones.
Rarely rotated,given broad permissions,and the company has no ideawhich laptop holds which keys.
Don’t hang your keys by the front door.Even Grandma knows that.Yet on our computers,we often hang them in the most obvious place.
- Ask engineers to inventory the keys and config files on their machines.
- Revoke the ones not in use; cut the rest down to least privilege.
- Switch to short-lived credentials that expire.
- Before installing a package, take a look at where it comes from.