Heroku April 2022 Incident Review

Post by jrochkind1 » Tue, Jun 14, 2022, 7:24 PM UTC

nightpool wrote: post #8

jrochkind1 wrote: post #3

Earlier quoted context omitted.

That's basically the only paragraph of new information in the whole... well, let's call it what it is, a press release basically. It is a thing to know. That they had a token checked into source code that probably shouldn't have been, and that the attacker somehow got access to the source code in a private github repo. * yeah, we still don't know how. Which is kind of important. But figuring out how they got access t…

> is to some extent back on github How is it on Github? We know that it was a third-party integration that compromised. Almost every single third-party integration needs the ability to read source code. The fault here lies on Heroku for storing secrets that allowed access to their main customer database in a source code repo that was accessible to a third-party provider, as well as with the third party provider (what…

Post by ectopod » Tue, Jun 14, 2022, 7:43 PM UTC

jarcoal wrote: post #4

ezekg wrote: post #2

> We began investigating how the threat actor gained initial access to the environment and determined it was obtained by leveraging a compromised token for a Heroku machine account. We determined that the unidentified threat actor gained access to the machine account from an archived private GitHub repository containing Heroku source code. We assessed that the threat actor accessed the repository via a third-party in…

It's a little hard to parse parts of that paragraph, but it sounds like the repo (presumably hosted on GitHub) had access tokens granted to third party integrations (similar to Heroku being granted access to GitHub on behalf of their mutual users). Assuming that's true, it should be trivial for GitHub to tell them which third party integration the token was associated with.

Post by drusepth » Tue, Jun 14, 2022, 8:28 PM UTC

Post by Rapzid » Thu, Jun 16, 2022, 6:00 PM UTC

jrochkind1 wrote: post #3

ezekg wrote: post #2

> We began investigating how the threat actor gained initial access to the environment and determined it was obtained by leveraging a compromised token for a Heroku machine account. We determined that the unidentified threat actor gained access to the machine account from an archived private GitHub repository containing Heroku source code. We assessed that the threat actor accessed the repository via a third-party in…

That's basically the only paragraph of new information in the whole... well, let's call it what it is, a press release basically. It is a thing to know. That they had a token checked into source code that probably shouldn't have been, and that the attacker somehow got access to the source code in a private github repo. * yeah, we still don't know how. Which is kind of important. But figuring out how they got access t…