Shiba Inu Leaking the AWS Credentials might be a Publicity Stunt
Latest posts by Sayantani Sanyal (see all)

The developer team of the Shiba Inu token exposed its AWS credentials in August, according to security company PingSafe.

Shiba Inu and any other person or business who possesses the tokens should be concerned by the news that one of Shiba Inu’s AWS credentials was posted on a public GitHub repository, according to Karl Steinkamp, director at Coalfire. According to Steinkamp, the creation of Shiba Inu and other crypto-related projects is no different from the creation of any other non-crypto software product in that both require a structured development process and authorized personnel to push the code into the development/test stages and production.

Shiba Inu is a cryptocurrency with a $6.7 billion market valuation. Shiba Inu, a cryptocurrency that was created in August 2020 by an unnamed individual or organization known as Ryoshi, is now the 14th largest coin by market cap, according to Prakash.

Researchers discovered a Shiba Inu AWS account credential leak on a public code repository on Thursday. Security experts deemed the leak serious since for the two days the credentials were exposed, a hacker may have exploited them to their advantage. Anand Prakash, the founder of Pingsafe, stated in a blog post that a Shiba Inu developer’s submission of AWS infrastructure keys to a public GitHub repository was the cause of the compromised credentials. “While it’s unknown if the credentials were intended for testing or production, this represents a break in the internal process and probably violated Shiba’s software development lifecycle practices,” Steinkamp said. “Having AWS credentials exposed for two days presents a dangerous window of opportunity for any potential hacker to perform any host of malicious activities, which may have included a full environment compromise, token theft, and escalation of permissions into other AWS environments,” according to the report.

AWS ACCESS KEY and AWS SECRET KEY, two environment variables that permit scripts to access an AWS account, were among the data that was exposed. In this instance, the compromised malware was a component of a shell script that operated validator nodes for Shibarium, Shiba Inu’s Layer 2 network. According to Pingsafe, this mistake “severely exposed the company’s AWS account” and may have resulted in security lapses like money theft, embezzlement, and service interruptions. Shiba Inu and several developers were contacted via email and social media to alert them to the risk, but no response was received, according to Pingsafe. The security company looked for a bug reward program or responsible disclosure policy as well, although it was unsuccessful in doing so.

Every software firm handles private API keys and passwords, according to Casey Bisson, head of product and developer enablement at BluBracket, and far too many of them are stored in code repositories. A secret in a repository is a secret shared, according to Bisson, whether it was done intentionally, as a result of insider threats, or as a result of code theft. The most crucial resources of a firm, such as cloud resources, customer data, and financial transactions, are all connected by these secret keys and passwords. To find secrets and other dangers in code and give developers a chance to fix them before they become a severe problem, we advise every firm to incorporate automated scanning into their CI/CD process.