Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

51–60 of 123 posts

Re: Heroku Security Notification

#51

Post by sandstrom »

This is a much bigger problem than Heroku.

There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access).

- Productboard

- Bugsnag

- Sentry

- Skylight

- Percy

- CodeTree

- Databox

There are heaps of others, these are just some on top the of my mind. A ticking supply chain attack waiting to happen, since these companies make themselves into alluring hacking targets.

Most of them need access only to issues (a few need read access to code or recent commits, almost none need write).

Solution:

- Let customers give granular access (only issues, only read to source code, etc) when the integration is setup. This is possible with Github's APIs.

- Try to use push instead of pull where possible, i.e. provide a CLI tool to use with Github actions or use Github's webhooks.

Re: Heroku Security Notification

#52

Post by quickthrower2 »

kadoban wrote: post #29

The attacker got _write_ access to all of these repositories as well? That's extremely worrying. I hope github or someone will be able to track down if any code changes were made.

A forced push could introduce vulnerability into code in a years old commit that is hard to detect. I guess it will look dodgy when your next push is rejected.

Re: Heroku Security Notification

#54

Post by leetrout »

buf wrote: post #38

This is as good a time as any to ask about Render. I've been eyeing it recently and I'm thinking about launching my next project with it. Does anyone have any takeaways from using Render vs Heroku?

Id also recommend a look at Porter.run

Re: Heroku Security Notification

#55

Post by glenngillen »

aaronbrethorst wrote: post #41
mepiethree wrote: post #22

Ughh here I was at 1:30AM after a hard week, checking the news one last time before going to bed, and see this. I hate this dang industry and regret ever becoming a tech lead. I know the Heroku engineers have it worse and all, but just venting.

Probably just Heroku engineer, singular.

What makes you think that?

Re: Heroku Security Notification

#56

Post by andrelaszlo »

jsmeaton wrote: post #50
fxtentacle wrote: post #43

FYI looks like the stolen Heroku OAuth tokens are already being used: https://github.blog/2022-04-15-security-alert-stolen-oauth-u...

Both heroku and travisci were affected? I wonder if and what the common vector would be for two major providers to lose their OAuth tokens.

- Heroku might be using Travis? - They were compromise independently but the hackers decided to start leveraging them at the same time to get the most out of them? - The obvious common denominator: Github? It doesn't make a lot of sense though.

Re: Heroku Security Notification

#57

Post by franciscop »

frays wrote: post #7

> Additionally, we recommend disconnecting Heroku from your GitHub repositories. I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards. My thoughts are with the team working on responding to this incident on Easter Friday.

I can confirm that ~2h ago my integration was working but now it's not, so it seems they automatically disconnected everyone. Not sure if "they" is Github or Heroku here, but my master branch is not autodeploying anymore and trying to reconnect results into an error.

Re: Heroku Security Notification

#58

Post by the_mitsuhiko »

sandstrom wrote: post #51

This is a much bigger problem than Heroku. There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access). - Productboard - Bugsnag - Sentry - Skylight - Percy - CodeTree - Databox There are heaps of others, these are just some on top the of my mind. A ticking supply chain attack waiting to happen, since these companies make themselves into alluring hacking target…

> There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access).

Sentry does not request write access to source code. It requests read/write access to issues and read access to source code. You can also see this on the documentation for the GitHub enterprise integration which lists the exact permissions required: https://docs.sentry.io/product/integrations/source-code-mgmt...

Re: Heroku Security Notification

#60

Post by couchand »

quickthrower2 wrote: post #52
kadoban wrote: post #29

The attacker got _write_ access to all of these repositories as well? That's extremely worrying. I hope github or someone will be able to track down if any code changes were made.

A forced push could introduce vulnerability into code in a years old commit that is hard to detect. I guess it will look dodgy when your next push is rejected.

It would not at all be "hard to detect", the SHAs of it and all subsequent commits would change, it would appear in the GitHub audit log, etc etc
Post reply on HN