Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

41–50 of 162 posts

Re: Heroku Security Notification

#41

Post by Abishek_Muthian »

craigkerstiens wrote: post #28

"a Heroku database" was what was known as core-db internally for the longest time. I'm not sure if still the case or not today. But at one point was the source of everything for Heroku. Over time things were moved out, so this isn't an everything that exists has been leaked, but it is not a guarantee that attacker didn't move from one area to another. As someone with some apps on Heroku, having worked there, but no k…

> but it is not a guarantee that attacker didn't move from one area to another.

The incident notification seems like the customers who are using GitHub integration are the ones who are compromised, If the attacker has gained access to other accounts then it needs to be clarified so that we could take repository level mitigations as you've mentioned; Else most will just reset account passwords and be done with it.

Re: Heroku Security Notification

#42

Post by craigkerstiens »

Abishek_Muthian wrote: post #41
craigkerstiens wrote: post #28

"a Heroku database" was what was known as core-db internally for the longest time. I'm not sure if still the case or not today. But at one point was the source of everything for Heroku. Over time things were moved out, so this isn't an everything that exists has been leaked, but it is not a guarantee that attacker didn't move from one area to another. As someone with some apps on Heroku, having worked there, but no k…

> but it is not a guarantee that attacker didn't move from one area to another. The incident notification seems like the customers who are using GitHub integration are the ones who are compromised, If the attacker has gained access to other accounts then it needs to be clarified so that we could take repository level mitigations as you've mentioned; Else most will just reset account passwords and be done with it.

The latest report states about "a database" which is presumably the internal database. I don't want to speculate too much, but it seems attacher had access to internal systems. GitHub were the ones that detected and noticed it and reported to Heroku. Do not disagree that there should be more clarity, but best to follow up with Salesforce on that.

Re: Heroku Security Notification

#43

Post by Mandatum »

Really, really bad form from the Salesforce Trust team here. Hopefully the Slack acquisition means better, quicker communications.

On a scale of Slack to Oracle on breach notifications, this was definitely closer to Oracle.

Re: Heroku Security Notification

#44

Post by dev_tty01 »

cmeacham98 wrote: post #14
VWWHFSfQ wrote: post #12

Earlier quoted context omitted.

My understanding is they didn't even know about this until GitHub told them on April 13th. I'm guessing something got triggered in GitHub's system by a flurry of tokens issued to Heroku trying to enumerate private repositories. If the attacker had just played it low and slow they might never even have known at all. Who knows how long Heroku's internal systems were compromised.

Even if that's the case, it's still way after April 13th.

Heroku reported it on 4/15. Read the beginning of the string of updates on the notification page posted here. Also,

https://news.ycombinator.com/item?id=31048646

Re: Heroku Security Notification

#45

Post by subroutine »

owlninja wrote: post #32

Always interesting to me with events like this that the actions or intentions of the "threat actor" are never discussed. The conversation is always finding tiny holes in the victim's systems and admonishing them for not being prepared.

Actions other than... (1) obtained access to a Heroku database, (2) downloaded customer GitHub integration OAuth tokens, (3) enumerated metadata on customer repos with the OAuth tokens, (4) downloaded some Heroku private GitHub repos containing source code, and (5) exfiltrated customer hashed and salted passwords?

Re: Heroku Security Notification

#47

Post by mike_d »

Abishek_Muthian wrote: post #41
craigkerstiens wrote: post #28

"a Heroku database" was what was known as core-db internally for the longest time. I'm not sure if still the case or not today. But at one point was the source of everything for Heroku. Over time things were moved out, so this isn't an everything that exists has been leaked, but it is not a guarantee that attacker didn't move from one area to another. As someone with some apps on Heroku, having worked there, but no k…

> but it is not a guarantee that attacker didn't move from one area to another. The incident notification seems like the customers who are using GitHub integration are the ones who are compromised, If the attacker has gained access to other accounts then it needs to be clarified so that we could take repository level mitigations as you've mentioned; Else most will just reset account passwords and be done with it.

"Access to the environment was gained by leveraging a compromised token for a Heroku machine account"

This is the equivalent of saying "the car was stolen because the car keys were laying on the kitchen table." They still don't know how they got into the house to get the car keys.

GitHub was just one branch that the attacker took to further access, another being the download of the accounts database. We don't know how many other things they did.

Re: Heroku Security Notification

#49

Post by lovelearning »

> On April 7, 2022, a threat actor obtained access...GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation.

Can some experienced security professionals weigh in on the cultural and organizational factors that allow this kind of major breach to go unnoticed for a week, that too in a reputed company like Heroku?

I'm not asking this rhetorically or in bad faith. It's a genuine question I have based on a project I did. I researched cybersec tech like SOAR, XDR, security logging, and SIEM in depth. On paper, the marketing for such tech gives the impression that by using them, such breaches can be detected and prevented in real-time. But there seems to be a mismatch between the claims and ground realities. If so, why?

Re: Heroku Security Notification

#50

Post by abrkn »

I received an email yesterday asking me to change my password. I did, and updated our services with the regenerated Heroku API key.

This morning, I was unable to log into my account and had to reset again. And update our services again.

Post reply on HN