The comms for this security breach is a textbook case study of what NOT to do
Heroku Security Notification
151–160 of 162 posts
Re: Heroku Security Notification
#152Earlier quoted context omitted.
Heroku is heavily connected with Salesforce now with Heroku Connect, I doubt this is part of the plan.
There was already a plan by salesforce to kill it and make it into salesforce functions. Someone else here called it project periwinkle.
That's frustrating. Heroku is one of the nicest cloud services I've ever used, and am currently using.
Re: Heroku Security Notification
#153Earlier quoted context omitted.
Google allowed 6 character passwords for a while, and didn't expire them when they increased minimum to 8 for google workspace accounts. This has been fantastic, as users can remember their password forever even if its higher complexity (google does a password strength eval). No rotations either. I'm pretty confident google will pick-up someone trying to brute force a 6 character password. That google will notice con…
For Workspace accounts, an admin can choose to enforce complexity requirements on next login after making changes to the complexity requirements.
Right, we've found actually simple passwords but with the mandatory 2FA turned on works really well. The 2FA google uses is a gentle touch in most cases (can persist on a device for 30 days).
Google has nice 2FA controls. In a workspace setup you can actually tweak them to match your needs because the lockout / reset path (was) pretty reasonable (when it was onsite). Ie, we could disable certain methods and for some higher security groups you can provide hardware keys and then turn that group up a bit.
Never had to rotate passwords and users are glad for that I think.
I do wish google offered "Cloud Chrome" for admin staff to open email / click on links etc. Basically a remote VM with chrome but no file access directly.
Re: Heroku Security Notification
#154Earlier quoted context omitted.
Re: Render + Cloudflare, all data is encrypted all the way to Render. What is the specific issue you're referring to?
The main problem is that data is transferred out of EU, it is simply not acceptable for a EU company regardless of any DPA (history have shown here that any such DPA would be invalid in the near future). However some of our clients (for example in health or financial industry) would be concerned that data is proxied through a third-party, doesn't matter if it is encrypted (also it's unclear to me how keys etc are man…
Agreed, this would also be a deal-breaker for us.
Re: Heroku Security Notification
#155Earlier quoted context omitted.
Heroku reported it on 4/15. Read the beginning of the string of updates on the notification page posted here. Also, https://news.ycombinator.com/item?id=31048646
And they reported that the credentials were leaked on 5/3. That took a long time.
Which credentials are you referring to? They reported the loss of OAuth tokens on April 15. What am I missing?
https://status.heroku.com/incidents/2413
"On April 13, 2022, Salesforce Security was notified by GitHub that a subset of Heroku’s GitHub private repositories, including some source code, was downloaded by a threat actor on April 9, 2022. Based on Salesforce’s initial investigation, it appears that unauthorized access to Heroku's GitHub account was the result of a compromised OAuth token. Salesforce immediately disabled the compromised user’s OAuth tokens and disabled the compromised user’s GitHub account. Additionally, GitHub reported that the threat actor was enumerating GitHub customer accounts using OAuth tokens issued to Heroku’s OAuth integration dashboard hosted on GitHub. Based on the information GitHub shared with us, we are investigating how the threat actor gained access to customer OAuth tokens. The compromised tokens could provide the threat actor access to customer GitHub repos, but not customer Heroku accounts. With the access to customer OAuth tokens, the threat actor may have read and write access to customer GitHub repositories connected to Heroku. Given the incident is still active, please review the recommended actions provided below."
Posted 21 days ago, APR 15, 2022 23:36 UTC
Re: Heroku Security Notification
#156Earlier quoted context omitted.
And they reported that the credentials were leaked on 5/3. That took a long time.
Which credentials are you referring to? They reported the loss of OAuth tokens on April 15. What am I missing? https://status.heroku.com/incidents/2413 "On April 13, 2022, Salesforce Security was notified by GitHub that a subset of Heroku’s GitHub private repositories, including some source code, was downloaded by a threat actor on April 9, 2022. Based on Salesforce’s initial investigation, it appears that unauthoriz…
You’re missing the 5/3 update about username and password credentials.
> our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts.
From the link we are commenting on.
Re: Heroku Security Notification
#157There's going to be a question about the expected probability of this across cloud service providers. I've done security work for multiple cloud service providers and know a lot of people in the industry. I'm not really privy to give details. I can say: dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, secur…
(Founder of Aptible, a Heroku-like PaaS focused on security and compliance) > dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, security operations teams have a lot of data points to look at, and in theory even changes in personnel in a couple of teams can have an impact on the threat posture for a given set…
> In practice though (as we're seeing), these platforms can introduce new security vulnerabilities in the layer they introduce on top of IaaS.
Isn't Aptible another layer on top of IaaS?
Re: Heroku Security Notification
#158What are some good Heroku alternatives these days?
Re: Heroku Security Notification
#159Earlier quoted context omitted.
(Founder of Aptible, a Heroku-like PaaS focused on security and compliance) > dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, security operations teams have a lot of data points to look at, and in theory even changes in personnel in a couple of teams can have an impact on the threat posture for a given set…
> In practice though (as we're seeing), these platforms can introduce new security vulnerabilities in the layer they introduce on top of IaaS. Isn't Aptible another layer on top of IaaS?
That's how most of our customers use Aptible, yes. That said, we currently have our first customers running Aptible as an integration with AWS, and we believe this will be the most popular way to use Aptible in the future.
With this new product model, you integrate Aptible with your AWS account, and we provide functionality to provision high-level constructs like apps and databases that simply set up and coordinate AWS services like ECS, EKS, RDS, etc. Aptible only needs permission to write to a set of SQS queues in your account. To make sure things stay compliant, we set up AWS Config checks for every security control relevant to your chosen compliance framework(s), and maintain a set of managed IAM roles that you can assign to your dev team to ensure least-privilege access without having to constantly update IAM.
Re: Heroku Security Notification
#160Earlier quoted context omitted.
"Access to the environment was gained by leveraging a compromised token for a Heroku machine account" This is the equivalent of saying "the car was stolen because the car keys were laying on the kitchen table." They still don't know how they got into the house to get the car keys. GitHub was just one branch that the attacker took to further access, another being the download of the accounts database. We don't know ho…
"a compromised token for a Heroku machine account" sounds more like a master key was stolen from a car dealer.
That would imply a breach of AWS itself, which I do not believe to be the case.