Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

11–20 of 123 posts

Re: Heroku Security Notification

#11

Post by ryantgtg »

frays wrote: post #7

> Additionally, we recommend disconnecting Heroku from your GitHub repositories. I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards. My thoughts are with the team working on responding to this incident on Easter Friday.

From what I can tell from the update from a couple minutes ago, this recommendation wasn’t deemed to be enough. Now they’re revoking all tokens.

Re: Heroku Security Notification

#12

Post by TheSpiciestDev »

pineconewarrior wrote: post #9
TheSpiciestDev wrote: post #6

I do remember hooking up Heroku to Github for auto-deployments and thinking to myself something along the lines of, "why does Heroku need ALL of this access?" It'd be great if Github could allow read/write permission grants on a per-repo basis. Maybe they do already!.. in which case I'd much rather have and setup that granular detail than have a token that goes across all my public/private repos... Edit: I do see in…

> It'd be great if Github could allow read/write permission grants on a per-repo basis. Maybe they do already! They totally do. Shopify's Github integration works this way, and it is fantastic!

Thanks and I'm not surprised, it's a pretty intuitive feature! So really the only thing Heroku gets from these all-inclusive tokens is something to drive their type-a-head input on their integration page, right? Totally not worth it, I'd rather use Github's prompt.

Re: Heroku Security Notification

#13

Post by czbond »

frays wrote: post #7

> Additionally, we recommend disconnecting Heroku from your GitHub repositories. I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards. My thoughts are with the team working on responding to this incident on Easter Friday.

For anyone wondering where this is....it is in your project -> "Deploy" -> "Deployment method" -> "Connect to Github".

Re: Heroku Security Notification

#15

Post by forgingahead »

czbond wrote: post #13
frays wrote: post #7

> Additionally, we recommend disconnecting Heroku from your GitHub repositories. I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards. My thoughts are with the team working on responding to this incident on Easter Friday.

For anyone wondering where this is....it is in your project -> "Deploy" -> "Deployment method" -> "Connect to Github".

For some reason for the single app I had used this for, there was no "Disconnect" button - so I just did the nuke option of deleting the connection right from the main settings page: https://dashboard.heroku.com/account/applications#third-part...

For checking your Github audit logs, you can go directly here (replace ORG_NAME with your own): /settings/audit-log" rel="nofollow">https://github.com/organizations//settings/audit-l...

Or from: Organization > Settings > Archive > Logs > Audit Log

I hope we get some more clarity on the extent of this incident soon. We'll rotate our keys anyway but I really hope the attackers did not have access to the ENV vars that are commonly set on Heroku directly.

Re: Heroku Security Notification

#16

Post by pselbert »

forgingahead wrote: post #15
czbond wrote: post #13

Earlier quoted context omitted.

For anyone wondering where this is....it is in your project -> "Deploy" -> "Deployment method" -> "Connect to Github".

For some reason for the single app I had used this for, there was no "Disconnect" button - so I just did the nuke option of deleting the connection right from the main settings page: https://dashboard.heroku.com/account/applications#third-part... For checking your Github audit logs, you can go directly here (replace ORG_NAME with your own): /settings/audit-log" rel="nofollow">https://github.com/organizations/ /settin…

For many accounts the audit log isn’t going to show some crucial information—git activity. Clone events are only available through the REST API for Enterprise customers.

Re: Heroku Security Notification

#18

Post by paradite »

forgingahead wrote: post #15
czbond wrote: post #13

Earlier quoted context omitted.

For anyone wondering where this is....it is in your project -> "Deploy" -> "Deployment method" -> "Connect to Github".

For some reason for the single app I had used this for, there was no "Disconnect" button - so I just did the nuke option of deleting the connection right from the main settings page: https://dashboard.heroku.com/account/applications#third-part... For checking your Github audit logs, you can go directly here (replace ORG_NAME with your own): /settings/audit-log" rel="nofollow">https://github.com/organizations/ /settin…

The GitHub pipeline integration doesn't show up on the third party applications page here: https://dashboard.heroku.com/account/applications#third-part...

I had to remove them one by one.

Re: Heroku Security Notification

#20

Post by duxup »

Interesting I had an OLD project associated with a Gmail email address that would send emails in some cases.

Yesterday I got a notification that someone tried logging into that Gmail account. The password was hard coded in the code…

Post reply on HN