Pretty good alternative to “We and our customer data got hacked”.
Heroku Security Notification
21–30 of 162 posts
Re: Heroku Security Notification
#22What are some good Heroku alternatives these days?
Aptible (though geared more towards Healthcare/Compliance space).
^ Note: I use to work for Aptible. Great company. Great people. Now working for one of their spin outs.
Re: Heroku Security Notification
#23> Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. What else was in this database? Typically the password field is stored alongside the rest of the user record. So was this the entire customer database that was stolen? Usernames, emails, salted/hashed passwords, what else?…
The last couple large places I work specifically split out the auth/password DB from the rest of the user data. They're used for different things and they have different types of sensitivity around them.
For any individual/organization remotely competent at security (i.e. not using Passw0rd! as password and reusing elsewhere), a leak of hashed password is probably the least of concerns. Compared to this anyway:
> According to GitHub, the threat actor began enumerating metadata about customer repositories with the downloaded OAuth tokens on April 8, 2022. On April 9, 2022, the attacker downloaded a subset of the Heroku private GitHub repositories from GitHub, containing some Heroku source code.
Re: Heroku Security Notification
#24Earlier quoted context omitted.
The last couple large places I work specifically split out the auth/password DB from the rest of the user data. They're used for different things and they have different types of sensitivity around them.
We moved basically everything but username into an entirely different db, went so far as to hash the username column so we don’t even know what’s it is until you log in.
> hash the username column
Is this giving you any real security benefit? (I'd assume the usernames are indexed elsewhere and that it's a reasonable assumption that whoever gains access to this hashed data has access to the username list as well, making a lookup trivial - or are these not safe assumptions?)
Re: Heroku Security Notification
#25I really feel like people don't value intrusion detection enough. Why was Heroku's intrusion detection system "rely on Github's intrusion detection system"?
As described, the attacker quietly retrieved OAuth tokens from a single Heroku database, and then very loudly scraped GitHub.
I'm not saying it would have been impossible to detect the first action, but it's substantially easier to detect the second.
Re: Heroku Security Notification
#26What are some good Heroku alternatives these days?
Porter.run
Re: Heroku Security Notification
#27Why am I hearing about this on checks the fucking date on May 5th instead of, like, month ago.
I first received word about this on 4/15 via an email from Salesforce.
Re: Heroku Security Notification
#28"a Heroku database" was what was known as core-db internally for the longest time. I'm not sure if still the case or not today.
But at one point was the source of everything for Heroku.
Over time things were moved out, so this isn't an everything that exists has been leaked, but it is not a guarantee that attacker didn't move from one area to another.
As someone with some apps on Heroku, having worked there, but no knowledge of the details of the incident more than others... I would:
1. Rotate all creds
2. Ensure logging all connections to the DB (I can't recall how much you can do this on Heroku)
3. Extra heavily audit Github commits and Heroku releases
4. Maybe keep rotating all creds?
Re: Heroku Security Notification
#29Earlier quoted context omitted.
The last couple large places I work specifically split out the auth/password DB from the rest of the user data. They're used for different things and they have different types of sensitivity around them.
This is also why folks advocate for a separate auth system (keycloak was just mentioned here on HN) since they are different types of information. >I feel like at some point they're just going to go completely radio silent because the extent of the breach will become such that they'll have no choice but to just lawyer up. I feel like they are heading this route as well. Possibly even withholding information in order…
> Possibly even withholding information in order to save the company from mass exodus due to the incident. I'm sure they'll be fine.
Trust takes long to build and is easy to break. For anyone able to convert the Heroku buildpack to a Docker and able to move the database, moving away from Heroku shouldn’t be too hard. There are multiple similar services nowadays.
Re: Heroku Security Notification
#30Why not just say hacker ? Know we are on hacker news and hence it is semantically not exactly right. But threat actor … sound more like threaten actor. Just a movie star or drama queen. If one say Heroku was hacked or just sales force … I know one want to manage but somehow the title is not exact right. Too pr.