Visual Studio Bug: Developer Hit with $6.500 AWS Bill Carlo, a South African developer who is familiar with Git, explained that his code was uploaded to a public repository instead of a private one. This was due to a bug in Visual Studio 2015’s GitHub extension. Although the bug has been fixed and AWS will refund the large bill, Carlo shared his experience to highlight security issues when working with cloud computing. Carlo stated that developers need to be aware and follow best practices when pushing source to the cloud. “Things aren’t set in stone yet. We are creating the rules as we go.” This could be a fascinating case study. I hope it raises awareness about the dangers of cloud version control, especially when combined with limitless cloud accounts such as AWS. Carlo explained how he decided to forgo his usual practice of using Git command line and instead used the built-in Visual Studio IDE functionality to commit a local repository to a private repository on GitHub. It ended up in a public repository, which was not what he expected. AWS sent him a message advising him that his account was compromised by the disclosure of an access code. He tried to contain the damage but it was too late. Bitcoin miners had already found the key and put it to good use. Carlo explained that bitcoin miners constantly scan GitHub source code to find Amazon access keys. These keys are used to spawn large numbers EC2 instances that can mine bitcoins. They make a lot of money while the ones who were exploited end up with huge bills. Bitcoin.org describes Bitcoin as “an innovative payment network, and a new type of money.” Bitcoin uses peer-to-peer technology, which allows it to operate without central banks or central authorities. The network manages transactions and issues bitcoins. Bitcoin users can use exposed access keys to mine other bitcoins by leveraging them. Carlo stated that all they need is one key. A single click through a buggy interface or unintentional click can expose your data to all the world in a matter of seconds. Many companies store their source code and data in the cloud. With multiple developers having access, we will see significant data leaks in future. This is a frightening prospect for us all. Carlo stated that he was contacted to resolve the matter by Microsoft and AWS executives. He received a but fix and AWS bill reimbursement. He also had some advice for AWS developers: