GitHub secret key finder released to public
A researcher has published a tool for finding secret keys with varying cryptographic strength in git repositories.
The tool, dubbed TruffleHog, is able to search for and locate keys containing high-entropy strings by digging deep into commit history and branches, according to developer Dylan Ayrey.
TruffleHog's search capabilities make it "effective at finding secrets accidentally committed that contain high entropy," Ayrey says, and the tool needs nothing more than GitPython to work.
Ayrey commented:
"This module will go through the entire commit history of each branch, and check each diff from each commit, and evaluate the Shannon entropy for both the base64 character set and hexidecimal character set for every blob of text greater than 20 characters comprised of those character sets in each diff."
TruffleHog calculates entropy levels using a Shannon Entropy (.PDF) calculator. The entropy levels of keys are important, as the more or less information required to determine unknown key variables can alter how difficult it is to crack.
If a high-entropy string is detected, the string is printed to the screen.
Users of TruffleHog said in a Reddit discussion topic that Amazon already uses the tool to preemptively search GitHub for Amazon Web Services (AWS) keys accidentally connected to public repositories, which prevents attackers from snatching the keys, spinning up vast AWS instances and leaving the owners with the bill.