独立安全研究员Ben Zimmermann对中国最大本土Git托管平台Gitee上的7,256,531个公开仓库进行了大规模扫描，共识别出26,400个经过验证的有效泄露凭据 1。此次扫描历时约一个月，总成本为3,097.64美元，使用了TruffleHog和Kingfisher两种双重扫描工具 1。研究发现，Gitee平台的每千仓库凭据泄露密度高于GitLab和Bitbucket 1。
在泄露的凭据类型中，阿里云AccessKey对最为常见，数据显示大约每766个仓库中就有1个包含有效的阿里云凭据 1。其他高频出现的泄露密钥包括DeepSeek（2,940个）、Zhipu（1,489个）以及OpenAI（1,198个）1。值得注意的是，这些泄露凭据中有近半部分（12,242个）是在2025年提交的 1。涉及受影响的机构不仅包括华为、字节跳动等中国科技企业，还涵盖多家西方科技公司 1。
目前，Zimmermann已向高暴露量的供应商发送了协调报告，但相关凭据的具体撤销状态尚未得到确认 1。
Independent security researcher Ben Zimmermann discovered 26,400 unique, verified leaked credentials while scanning 7,256,531 public repositories on Gitee, China's largest domestic Git hosting platform 1. The investigation utilized both TruffleHog and Kingfisher tools to identify exposed secrets, revealing that Gitee exhibits a higher density of credential leaks per thousand repositories compared to major competitors like GitLab and Bitbucket 1. Approximately half of the compromised credentials were associated with code committed in 2025, totaling 12,242 instances 1.
The most prevalent form of leakage involved Alibaba Cloud AccessKey pairs, appearing in roughly one out of every 766 scanned repositories 1. Significant numbers of valid keys for other services were also detected, including 2,940 for DeepSeek, 1,489 for Zhipu, and 1,198 for OpenAI 1. The exposure extends beyond local entities to include tech giants such as Huawei and ByteDance, as well as various Western technology companies 1. The entire research process took about one month and incurred a total cost of $3,097.64 1.
Zimmermann has issued coordinated reports to vendors showing high levels of exposure 1. However, the current revocation status of these specific credentials remains unconfirmed 1.
评论
还没有评论，欢迎留下第一条。