Hacker News

Google API ki dem no bi sikrit, bot den Gemini chenj di rules

Kɔmɛnt dɛn

21 min read Via trufflesecurity.com

Mewayz Team

Editorial Team

Hacker News

We "Pɔblik bay Dizayn" Bi Sikyuriti Layabiliti

Fɔ lɛk tu dikɔs, divɛlɔpa dɛn we de bil pan Google in ekosistim lan wan subtil bɔt impɔtant lɛsin: Google API ki dɛn nɔto rili sikrit. If yu ɛmbas wan YouTube Data API ki insay wan JavaSkript fayl, Google nɔ bin alarm. If yu Maps API ki sho na pɔblik GitHub ripɔsitɔri, di sikyɔriti ansa na bin essentially wan shrug ɛn wan mɛmba fɔ sɛt domɛyn ristrikshɔn. Di ɔl mɔdel bin bil rawnd di asɔmpshɔn se dɛn ki ya go liv insay klaynt-sayd kɔd, we dɛn go ɛksplɔz to ɛnibɔdi we opin DevTools.

Dat filɔsofi bin mek sɛns fɔ lɔng tɛm. Wan Maps API ki we dɛn ɛksplɔz we nɔ gɛt domɛyn ristrikshɔn kin rak ɔp wan sɔprayz bil, bɔt i nɔ bin go kɔmprɔmis pasɛnt rɛkɔd ɔ dreyn wan bank akaun. Di blast radius bin fayn ɛn i bin ebul fɔ manej. Google in tul — rifera ristrikshɔn, IP waytlist, kwota limit — dɛn bin mek am fɔ kɔntinyu di damej, nɔto fɔ mek dɛn nɔ ɛksplɔz am ɔl.

Den Gemini kam, en di rules chenj. Di prɔblɛm na dat, bɔku bɔku divɛlɔpa dɛn nɔ gɛt di mɛmo.

Di Legacy Mental Model We De Naw Gɛt Divɛlɔpa dɛn Bɔn

Di ol Google divɛlɔpa ɛkspiriɛns bin de bay wilful fɔ alaw am. We yu mek wan Maps JavaScript API ki, di dɔkyumentri bin prɛktikal ɛnkɔrej yu fɔ drɔp am dairekt insay yu HTML. Di sikyɔriti mɔdel nɔ bin sikrit — na bin ristrikshɔn. Yu go lɔk di ki fɔ yu domɛyn, sɛt kwota alɛt, ɛn go bifo. Dis na bin pragmatik injinɛri: klaynt-sayd aplikeshɔn dɛn rili nɔ kin ebul fɔ kip sikrit frɔm di wan dɛn we dɔn disayd fɔ yuz am, so Gugl bil wan sistɛm we gri se na da rial tin de.

Dis mek wan jɛnɛreshɔn fɔ divɛlɔpa dɛn — ɛn mɔ impɔtant, wan jɛnɛreshɔn fɔ institiushɔnal abit dɛn — usay Google API ki dɛn bin ɔkup difrɛn mental kategori pas, lɛ wi se, wan Stripe sikrit ki ɔ wan AWS akses kredibiliti. Yu nɔ go pas yu Stripe sikrit ki na pɔblik repo. Bɔt yu Maps ki? Dat na bin prɛktikal kɔnfigyushɔn valyu, nɔto sikrit. Bɔku tim dɛn bin de kip dɛn na pɔblik-fes kɔnfig fayl dɛn, README fayl dɛn, ivin insay klaynt-sayd ɛnvayrɔmɛnt vɛriɔbul dɛn we dɛn prɛfiks wit NEXT_PUBLIC_ ɔ REACT_APP_ we dɛn nɔ tink bɔt am bak.

Sekyuriti risach pipul dɛm we de skan GitHub fɔ ɛksplɔz kredibiliti lan fɔ trit Google API ki dɛn difrɛn we bak. Wan Maps ki we lik na bin wan low-severity finding. Wan Gemini ki we lik na wan ɔl difrɛn tɔk.

Wetin Chenj wit Gemini — ɛn Wetin Mek I Impɔtant

Google in Gemini API nɔ de fala di ol plebuk. We yu de jenarayz wan Gemini API ki tru Google AI Studio, yu de mek wan kredibiliti wit wan fundamentally difrɛn risk profayl pas wan Maps ɔ YouTube ki. Gemini ki dɛn de ɔtɛnɛtik akses to big langwej mɔdel infɔmeshɔn — wan savis we de kɔst Google rial kɔmpiut risɔs ɛn we de bil yu bay di token, nɔto bay di pejvyu.

Mɔ krichɔ, Gemini API ki dɛn nɔ gɛt di sem bilt-in domɛyn ristrikshɔn mɛkanism dɛn we mek fɔ ɛksplɔz ɔda Google ki dɛn fɔ liv. No simpul "lɔk dis to mi wɛbsayt in domɛyn" kɔntrol nɔ de we go mek pɔsin we atak we fɛn yu ki na pɔblik ripɔsitɔri nɔ spin dɛn yon aplikeshɔn ɛn it yu kwota — ɔ yu bil limit — frɔm wan sava na ɔda kɔntri.

Di denja nɔto jɔs mɔni biznɛs. Yu kin yuz wan Gemini ki we dɛn dɔn ɛksplɔz fɔ mek tin dɛn we de ambɔg yu, fɔ du injɛkshɔn atak dɛn kwik kwik wan, ɔ fɔ bil tul dɛn we nɔ gri wit Google in tɛm fɔ savis — ɔl dɛn bil dɛn to yu akɔn ɛn dɛn kin tray fɔ no bak to yu aydentiti.

we yu kin yuz

Insay 2024, sikyɔriti risach pipul dɛn bin no bɔku bɔku Gemini API ki dɛn we dɛn dɔn ɛksplɔz na GitHub nɔmɔ, bɔku pan dɛn de na ripɔsitɔri dɛn we bin dɔn ɔs ɔda Google API ki dɛn bifo we nɔ gɛt ɛnitin fɔ apin. Di divɛlɔpa dɛn nɔ bin de bi rɛklɛs bay dɛn yon istri standad — dɛn bin de aplay wan mental mɔdel we Google insɛf bin dɔn tren dɛn fɔ yuz. Di envayrɔmɛnt chenj fast pas aw di abit dɛn chenj.

Di Anatomi fɔ wan Aksidɛntal Ɛksplɔshɔn

Fɔ ɔndastand aw dɛn tin ya kin apin na di fɔs tin we yu fɔ du fɔ mek yu nɔ apin. Di failure mods na remarkably konsistent across tims of ol saiz:

    we dɛn kɔl
  • Envayrɔmɛnt vɛriɔbul misklasifikeshɔn: Divɛlɔpa dɛn we bin de yuz fɔ Google Maps ki dɛn de prɛfiks Gemini ki dɛn wit NEXT_PUBLIC_ ɔ VITE_, we de ɛksplɔz dɛn wantɛm wantɛm insay bɔndɛl klaynt-sayd kɔd.
  • Ripɔsitɔri istri kɔntaminɛshɔn: Dɛn ad wan ki to kɔnfig fayl, kɔmit am, dɔn dɛn pul am — bɔt di git istri de kɔntinyu fɔ fɛn am fɔ lɔng tɛm. Atak pipul dɛn kin yuz tul dɛn lɛk truffleHog ɛn gitleaks spɛshal fɔ mayn dis istri.
  • Notbuk ɛn protɔtayp lik: Data sayɛnsman dɛn we de protɔtayp Gemini intagreshɔn dɛn na Jupyter notbuk dɛn de push dɛn notbuk dɛn de to GitHub wit ki dɛn we dɛn ɛmbas insay sɛl ɔtput dɛn.
  • CI/CD miskɔnfigureshɔn: Ki dɛn we dɛn dɔn kip as ripɔsitɔri sikrit dɛn kin aksidɛntli ɛko insay bild lɔg dɛn we pɔblik kin si na GitHub Akshɔn ɔ di sem kayn pletfɔm dɛn.
  • Tɔd-pati savis sprawl: Divɛlɔpa dɛn kin pas ki dɛn na analitiks dɛshbɔd, nɔ-kɔd tul, ɔ intagreshɔn pletfɔm dɛn we dɛn nɔ de rivyu dɛn pletfɔm dɛn sikyɔriti pozishɔn.
  • Tim kɔmyunikeshɔn chanɛl dɛn: Ki dɛn we dɛn sheb ova Slak, Diskɔd, ɔ imel kin dɔn insay mɛsej istri dɛn we pɔsin kin fɛn we kin liv pas di rɔteshɔn schedule.

Di kɔmɔn trɛd nɔto neglijɛns — na kɔntɛks kollaps. Di bihayvya we bin sef na wan kɔntɛks (Google Maps divɛlɔpmɛnt) na denja na ɔda kɔntɛks (Gemini divɛlɔpmɛnt), ɛn di we aw di kredɛns dɛn fiba di tin dɛn we pɔsin kin si kin mek i izi fɔ mis di difrɛns.

Bil wan Sikrit Manejmɛnt Kɔlchɔ we Skel

Di Gemini sityueshɔn na yusful fɔs fɛnshɔn fɔ sɔntin we bɔku divɛlɔpmɛnt tim dɛn dɔn de difrɛn: fɔ bil aktual sikrit manejmɛnt infrastukchɔ pas ad-hoc we fɔ du tin. Fɔ smɔl tim dɛn, dis kin fil lɛk se dɛn de ɔva ɛnjɛnɛri, bɔt di kɔst fɔ wan kredibiliti ɛksplɔshɔn — bil frod, akɔn saspɛns, data brech notis — pas di tray we dɛn de tray fɔ du dis rayt.

Mɔdan sikrit manejmɛnt de fala wan tayri we. Na di infrastukchɔ lɛvɛl, tul dɛn lɛk HashiCorp Vault, AWS Sikrit Maneja, ɔ Google Sikrit Maneja de gi sɛntralayz, ɔditabl kredibiliti stɔrɔj ​​wit ɔtomatik rɔteshɔn kapabiliti. Dɛn tin ya nɔto jɔs fɔ big ɛntapraiz — savis dɛn lɛk Doppler ɛn Infisical de briŋ di sem patɛn to tim dɛn we gɛt tu ɔ tri divɛlɔpa dɛn na aksesbul prayz pɔynt dɛn.

💡 DID YOU KNOW?

Mewayz replaces 8+ business tools in one platform

CRM · Invoicing · HR · Projects · Booking · eCommerce · POS · Analytics. Free forever plan available.

Start Free →

Na di kɔd lɛvɛl, di disiplin simpul: kredibiliti nɔ de ɛva tɔch sɔs kɔd. Ful stɔp. Nɔto insay kɔmɛnt-ɔut layn dɛn, nɔto insay ɛgzampul fayl dɛn, nɔto insay tɛst fiks dɛn wit fek-luk valyu dɛn we tɔn aut fɔ bi rial. Pri-kɔmit huk dɛn we de rɔn tul dɛn lɛk detect-secrets ɔ gitleaks de kech vayɔlɛshɔn bifo dɛn rich na rimot ripɔsitɔri dɛn. Dɛn huk ya kin tek minit fɔ kɔnfigyut ɛn ia ɔf yu insidɛnt rispɔns wɔri.

Fɔ ɔganayzeshɔn dɛn we de rɔn kɔmpleks ɔpreshɔnal stak dɛn — we de manej ɔltin frɔm CRM wokflɔ to pe rɔl intagreshɔn to kɔstɔma-fes bukin sistɛm — sɛntralayz kredibiliti manejmɛnt kin bi ivin mɔ krichɔ. Plɛtfɔm dɛn lɛk Mewayz, we de mek 207 biznɛs mɔdyul dɛn jɔyn ɔnda wan ɔpreshɔnal ambɔla, dɛn bil dɛn wit dis prinsipul na dɛn kɔr: dɛn de manej kredibiliti ɛn API intagreshɔn dɛn na di pletfɔm lɛvɛl, nɔto skata akɔdin to wan wan mɔdyul dɛn ɔ wan wan divɛlɔpa dɛn ɛnvayrɔmɛnt. We wan ki nid fɔ rɔta, i kin apin wan tɛm, na wan ples, nɔto akɔdin to sɛvintin difrɛn intagreshɔn pɔynt dɛn.

Di Bil Atak Vɛktɔ: Wan Thrɛt Mɔdel Divɛlɔpa dɛn Ɔndaɛstimat

Bɔku tɛm, di tɔk bɔt sikyɔriti kin pe atɛnshɔn pan di we aw pipul dɛn de brok di data ɛn we dɛn nɔ gɛt rayt fɔ yuz am. Di Gemini ɛksplɔshɔn prɔblɛm ad wan tɔd trɛt mɔdel we fɔ gɛt ikwal atɛnshɔn: bil frod na skel.

Big langwej mɔdel infɔmeshɔn na dia. GPT-4 ɛn Gemini Ultra de prosɛs token dɛn pan frakshɔn dɛn we na wan sɛnt ɛvri wan, bɔt pan skel — tawzin rikwest, milyɔn token — dɛn frakshɔn dɛn de ad to tawzin dɔla rili kwik. Atak pipul dɛn we de diskɔba di AI API ki dɛn we dɛn dɔn ɛksplɔz nɔ kin rili want yu data. Dɛn want fri kɔmpyuta. Dɛn go yuz yu kredɛns fɔ rul dɛn yon AI savis, sɛl infɔmeshɔn kapasiti bak, ɔ strɛs-tɛst dɛn aplikeshɔn dɛn — ɔl dis we di bil de go to yu.

Wan divɛlɔpa bin dokumɛnt we i wek pan $23,000 bil frɔm wan Gemini ki we dɛn bin dɔn ɛksplɔz na pɔblik ripɔsitɔri fɔ lɛs dan siks awa. Di pɔsin we atak bin dɔn ɔtomayz di ɛksplɔyshɔn wantɛm wantɛm, i bin de rɔn ay-throughput jenɛreshɔn wok dɛn kɔntinyu te di frod ditekshɔn we Google gɛt kech am. Di divɛlɔpa bin dɔn mek dɛn rivɛns di chaj dɛn afta wan lɔng dispyut prɔses, bɔt dɛn bin stɔp di akɔn insay da tɛm de, ɛn tek di prodakshɔn savis dɛn dɔŋ wit am.

Dis na di rizin we mek bil alert ɛn kwota limit nɔto sɔbstityuyt fɔ di rayt sikrit manejmɛnt — na las layn fɔ difens we yu op se yu nɔ go ɛva nid. Fɔ sɛt had mɔnt spɛndin limit pan AI API akɔn na tebul stej naw, bɔt di rial protɛkshɔn na fɔ mek shɔ se dɛn kredibiliti dɛn de nɔ ɛva lik insay di fɔs ples.

Praktikal Step fɔ Tim dɛn we De Mek di Transishɔn

If yu tim bin de bil Google API intagreshɔn ɔnda di ol mental mɔdel ɛn naw de ad Gemini to di stak, na wan rial rimɛdyeshɔn chɛklist ya:

    we dɛn kɔl
  1. Odit di ripɔsitɔri dɛn we dɔn de wantɛm wantɛm. Rɔn truffleHog ɔ gitleaks agens yu ful git istri, nɔto jɔs di HƐD we de naw. Fokus mɔ pan ɛni ripɔsitɔri we dɔn gɛt Google API ki yus trade.
  2. Rotate ɔl di ɛksplɔz ki dɛm. If wan Gemini ki dɔn ɛva apia na kɔmit, tek am se i dɔn kɔmprɔmis. Rivok am ɛn jenarayz nyu wan. Nɔ tray fɔ asɛs if ɛnibɔdi "aktually" fɛn am.
  3. Impliment pri-kɔmit skan. Instɔl sikrit ditekshɔn huk dɛn na ɛvri divɛlɔpa in mashin ɛn insay CI/CD paip layn dɛn as get we nɔ de baypas.
  4. Establish wan ki invɛntari. No us savis dɛn gɛt us kredɛnshal, udat gɛt dɛn, ustɛm dɛn las chenj dɛn, ɛn usay dɛn yuz dɛn. Sprɛdshit na fayn say fɔ bigin; wan sikrit manija na di say we dɛn de go.
  5. Sɛt bil alɛt ɛn had limit. Na ɛvri AI API akɔn, kɔnfigyut alert dɛn na 50% ɛn 80% pan di mɔni we yu de op fɔ spɛn ɛvri mɔnt, ɛn sɛt had limit dɛn we go mek bad bad bil ivin dɛn nɔ apin.
  6. Dokumɛnt di nyu mental mɔdel klia wan. Ɔpdet yu tim in onbɔdin matirial ɛn injinɛri hanbuk fɔ tɔk klia wan se Gemini API ki na ay-sɛnsitiviti kredibiliti we nid di sem tritmɛnt lɛk pemɛnt prɔsesɔ sikrit.

Di Broda Lɛsin fɔ Plɛtfɔm-Dipɛndent Biznɛs

Di Gemini sityueshɔn de sho wan patɛn we de afɛkt ɛni biznɛs we dip wan wit tɔd-pati pletfɔm dɛn: di pletfɔm dɛn de evolv, ɛn di sikyɔriti postɔ rikwaymɛnt dɛn de evolv wit dɛn, bɔt di institiushɔnal abit dɛn we tim dɛn we de yuz dɛn pletfɔm dɛn de gɛt bɔku tɛm nɔ kin kip paz. Wetin bin sef yestede na denja tide, ɛn di gap bitwin dɛn tu stet dɛn de na di say we brech de apin.

Dis na patikyula akyu fɔ biznɛs dɛn we de rɔn kɔmpleks ɔpreshɔnal stak dɛn. Wan kɔmni we de yuz AI-pawa ficha dɛn akɔdin to kastoma savis, analitiks, kɔntinyu jenɛreshɔn, ɛn prodak rɛkɛmɔndeshɔn kin gɛt Gemini intagreshɔn dɛn insay wan duzin difrɛn kɔntɛks — ɛni wan pan dɛn na pɔtɛnɛshɛl ɛksplɔshɔn pɔynt if dɛn de handle kredibiliti dɛn we nɔ kɔnsistɛns. Di sɔlv nɔto jɔs bɛtɛ wan wan divɛlɔpa abit dɛn; na akitɔkchral tin. Kredibiliti akses nid fɔ sɛntralayz, ɔdit, ɛn gɔvmɛnt na di pletfɔm lɛvɛl.

Mɔdan biznɛs ɔpreshɔn sistɛm dɛn de disayn mɔ ɛn mɔ wit dis na dɛn maynd. We Mewayz intagret AI kapabiliti akɔdin to in suit — frɔm intɛligent CRM wokflɔ to ɔtomatik analitiks insay in 207-mɔdyul ɛkosistim — dɛn de handle kredibiliti manejmɛnt na di infrastukchɔ layt, nɔto di aplikeshɔn layt. Wan wan mɔdyul divɛlɔpa dɛn nɔ de handle raw API ki dɛn; dɛn kin akses kapabiliti tru abstrakshɔn layers we de ɛnfɔs roteshɔn polisi, ɔdit akses, ɛn limit blast rayus if sɔntin go rɔng. Dis na di akitɛkɛt we di Gemini tɛm de aks fɔ: nɔto jɔs bɛtɛ abit, bɔt bɛtɛ sistɛm we de mek di rayt abit di wangren opshɔn we de.

Google nɔ mek mistek fɔ bil wan permissive API key model fɔ Maps ɛn YouTube. Dat mɔdel bin fit fɔ dɛn savis dɛn de. Bɔt as di kapabiliti ɛn kɔst profayl dɛn fɔ API dɛn de evolv dramatik wan — ɛn as AI API dɛn de ripresent sɔntɛm di shapest inflekshɔn pɔynt insay da ɛvolushɔn de — di ɔl industri nid fɔ riset in difɔlt dɛn. Di divɛlɔpa dɛn we de go bifo na dis envayrɔmɛnt nɔ go bi di wan dɛn we lan di ol lɔ dɛn bɛst, bɔt na di wan dɛn we no we di lɔ dɛn dɔn chenj fɔs.

Kwɛshɔn dɛn we dɛn kin aks bɔku tɛm

Wetin mek dɛn bin de tek Google API ki dɛn istri wan sef fɔ ɛksplɔz na pɔblik?

Google bin disayn bɔku pan in API dɛn — Maps, YouTube, Places — fɔ yuz na di klaynt-sayd, we min se dɛn bin dɔn mek ki dɛn bay wilful insay frɔnt-ɛnd kɔd we ɛnibɔdi go si. Di sikyɔriti mɔdel bin dipen pan yuz ristrikshɔn lɛk domɛyn alawlist ɛn rifera chɛk pas ki sikrit. Fɔ lɔng tɛm, dɛn bin de tek wan ɛksplɔz ki as kɔnfigyushɔn ishu, nɔto krichɔ vulnɛbiliti we nid fɔ rɔta wantɛm wantɛm.

Wetin chenj we Google introdyus Gemini API ki?

Difrɛn frɔm di lɛgsi Google API dɛn, Gemini API ki dɛn de wok mɔ lɛk tradishɔnal sikrit — fɔ ɛksplɔz wan kin mek yu chaj yu bil akɔn we yu nɔ alaw, fɔ yuz mɔdel abiuz, ɔ fɔ taya wit kwota we nɔ gɛt ɛni bilt-in domɛyn ristrikshɔn fɔ sev yu. Di shift min se divɛlɔpa dɛn naw fɔ trit Gemini ki dɛn wit di sem disiplin lɛk AWS kredɛns ɔ Stripe sikrit ki dɛn, fɔ kip dɛn na di sava-sayd ɛn nɔ ɛva de na di klayɛnt-fes kɔd.

Aw divɛlɔpa dɛn fɔ sef fɔ manej API ki fɔ AI savis tide?

Bɛst prɔsis na fɔ kip ɔl di AI API ki dɛn as envayrɔmɛnt vɛriɔbul dɛn na di sava, nɔ ɛva insay fayl dɛn we dɛn kin kɔntrol di vɛshɔn ɔ klaynt bɔndɛl dɛn. Yuz sikrit manija, rɔta di ki dɛn ɔltɛm, ɛn sɛt di limit fɔ spɛnd na di prɔvayda lɛvɛl. Plɛtfɔm dɛn lɛk Mewayz — wan 207-mɔdyul biznɛs OS na $19/mo we de na app.mewayz.com — de handle API kredibiliti manejmɛnt insay dɛn infrastukchɔ so tim dɛn nɔ de jɔg ki dɛn wit dɛn an akɔdin to savis dɛn.

Wetin a fɔ du if a dɔn ɔlrɛdi aksidɛntli ɛksplɔz wan Gemini API ki?

Rivɔk di kɔmprɔmis ki wantɛm wantɛm tru Google Klayd Kɔnsol ɛn jenarayz wan riplesmɛnt bifo yu du ɛni ɔda tin. Odit yu bil dashbɔd fɔ yuz spayk dɛn we yu nɔ bin de ɛkspɛkt we go sho se dɛn dɔn avɛst di ki. Dɔn rivyu yu kɔdbɛs, CI/CD ɛnvayrɔmɛnt vɛriɔbul dɛn, ɛn ɛni pɔblik ripɔsitɔri fɔ ɔda kredɛnshal dɛn we lik. Trit di tin we apin lɛk aw yu go trit ɛni pemɛnt kredibiliti we dɛn dɔn ɛksplɔz — tek am se dɛn dɔn fɛn am ɛn akt akɔdin to dat.