Terabytes worth of credentials, many belonging to the world’s biggest and most sensitive organizations, have been exposed in a supply-chain attack on LiteLLM, an open source tool that streamlines A- driven software development. Microsoft, Amazon, Cisco, Samsung, and Salesforce are only a handful of the entities whose access secrets were exposed.
The revelation was posted on Tuesday and Wednesday by security firms CloudSEK and Hudson Rock. CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AlI provider keys that could allow attackers to gain access to more than 2,500 organizations.
The credentials were extracted during a 40-minute window in March while the victims used compromised versions of LiteLLM downloaded from the package’s official location in the Python Package Index repository. Hudson Rock said it made the discovery after analyzing a 195TB file that it obtained. Neither firm identified the source of the information.
Not really, lot of this is hyped up sales bullshit. The reality is that security software has been getting better and better. It’s not this ecosystem of “that matches this hash or IP” anymore. For the last decade ML has been used heavily. It doesn’t look for just the stuff it knows is bad, it looks for things that are out of place.
End of the day…you can’t fix everything and you can’t fix your users…but the script kiddies aren’t what to worry about, it’s the large gov backed groups. Those have always been the problem.