Hardcoded Secrets in Source Code

Welcome to the second lesson of the "Cryptographic Failures" course! In our previous lesson, we explored the importance of cryptography and identified common cryptographic vulnerabilities. Today, we'll focus on a specific issue: hardcoded secrets in source code. Hardcoded secrets, such as API keys and encryption keys, pose significant security risks.

If these secrets are exposed, they can lead to unauthorized access and data breaches. Let's dive into understanding these risks and how to mitigate them effectively. 🔍

Hardcoded secrets are sensitive information embedded directly in the source code. Understanding the risks associated with hardcoded secrets is crucial for maintaining secure applications. Key examples include:

• Authentication credentials: Passwords, API keys, OAuth tokens
• Cryptographic material: Encryption keys, JWT signing secrets
• Connection strings: Database credentials, server access information

These secrets are often added for convenience during development but can lead to severe security vulnerabilities if not managed properly.

For instance, in 2019, a major data breach occurred when hardcoded AWS keys were discovered in a public GitHub repository, leading to unauthorized access to sensitive data. To better illustrate this vulnerability, let's examine a concrete example of vulnerable code.

Let's examine a code snippet that demonstrates how hardcoded secrets can be a security risk:

import crypto from 'crypto';

// Vulnerable: Secret key is hardcoded directly in the source code.
const SECRET_KEY = crypto.scryptSync("my-super-secret-key", 'salt', 32); // Hardcoded secret
const IV = crypto.randomBytes(16); // Initialization vector

export function encryptSensitiveData(data: string): string {
  const cipher = crypto.createCipheriv('aes-256-cbc', SECRET_KEY, IV);
  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
}

In this code, the secret key is hardcoded, making it vulnerable to exposure. The function encryptSensitiveData is designed to encrypt sensitive user data using the AES-256-CBC algorithm with a secret key. It takes a string input, encrypts it, and returns the encrypted data in hexadecimal format.

If the source code is leaked or accessed by unauthorized individuals, they can easily extract this secret key and decrypt sensitive data.