51–60 of 162 posts
I received an email yesterday asking me to change my password. I did, and updated our services with the regenerated Heroku API key. This morning, I was unable to log into my account and had to reset again. And update our services again.
> Due to the nature of this issue, you may be required to reset your passwords again in the future.
On 17 May 2019, Salesforce performed maintenance on their databases that clear permission sets for users. My team was able to piece together that the incident happened at about 0200 CDT, and Salesforce didn't take ANY noticeable action for at least 9 hours when they locked all customers out of the platform. Salesforce "fixed" the issue, which meant our Admins had to go in and reapply a bunch of profile settings...no big deal, right? Just a little bit of work for everyone to fix their own accounts. Salesforce acted like it wasn't a big deal.
Wrong.
If you were a Salesforce customer that built a tool using the Portal or Community tools Salesforce provides for external users, there was a 9 hour window when a customer could log in and instead of seeing the data you were sharing with them, they would see all data for all users. The permissions that indicated that a user should only be able to see their own data was gone.
The only reason we knew about this was because we were paying extra for advanced logging. We were able to see a few of our users logged in during this time and looked at customer records they should not have had access to.
Salesforce stood fast that exposing data through their Community and Portal tools this did not constitute a breach or even a violation of their SOC-2 Type II compliance. We were lucky that the only people that had access at the time were licensed partners. Nevertheless, our users lost their jobs and were stripped of their licenses.
Anyone that was using those tools at the time for any sort of direct customer interaction that shared order history, customer engagement, referral programs, etc. was not so lucky; doubly so if they weren't paying for advanced logging and/or didn't know what to look for. Salesforce was more concerned about covering up their mistakes than they were about telling their customers that there was a problem.
Seeing the Heroku notification page gives me PTSD. This looks all-too-familiar to me and I sympathize with those affected by this. I still feel like they were negligent back then, and I wish I knew who to tell to warn others.
Earlier quoted context omitted.
The last couple large places I work specifically split out the auth/password DB from the rest of the user data. They're used for different things and they have different types of sensitivity around them.
For any individual/organization remotely competent at security (i.e. not using Passw0rd! as password and reusing elsewhere), a leak of hashed password is probably the least of concerns. Compared to this anyway: > According to GitHub, the threat actor began enumerating metadata about customer repositories with the downloaded OAuth tokens on April 8, 2022. On April 9, 2022, the attacker downloaded a subset of the Herok…
We did so much work in open source it was just easier to assume everything was always publicly viewable, or that what you were doing now might be open sourced in the future along with the full commit history. Whether something was private or public was more a business decision around competitive risks and not a security-led one. To that end I'm far more concerned about a database and passwords getting popped.
But who knows, a lot can change in 10 years. Maybe private repos being exposed is also very bad.
This isn't the first time Salesforce Cybersecurity has left us in the lurch while they perform damage control. On 17 May 2019, Salesforce performed maintenance on their databases that clear permission sets for users. My team was able to piece together that the incident happened at about 0200 CDT, and Salesforce didn't take ANY noticeable action for at least 9 hours when they locked all customers out of the platform.…
Why am I hearing about this on checks the fucking date on May 5th instead of, like, month ago.
> On April 7, 2022, a threat actor obtained access...GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation. Can some experienced security professionals weigh in on the cultural and organizational factors that allow this kind of major breach to go unnoticed for a week, that too in a reputed company like Heroku? I'm not asking this rhetoric…
The three days after being notified to actually revoke the tokens isn't ideal either. Surely if GitHub comes to you and warns you of suspected unauthorised access you'd spend a very limited amount of time and then revoke the credentials to be on the safe side.
This isn't the first time Salesforce Cybersecurity has left us in the lurch while they perform damage control. On 17 May 2019, Salesforce performed maintenance on their databases that clear permission sets for users. My team was able to piece together that the incident happened at about 0200 CDT, and Salesforce didn't take ANY noticeable action for at least 9 hours when they locked all customers out of the platform.…
Salesforce’s monitoring, availability, incident handling, transparency, and accountability, are abysmal. We too we’re affected by the incident. I sincerely hope they lose some of their compliance certifications, because their behavior is unacceptable.
I don't recall there being any notes of material deficiency in their SOX reporting for the fiscal year either.
Earlier quoted context omitted.
Aptible (though geared more towards Healthcare/Compliance space). ^ Note: I use to work for Aptible. Great company. Great people. Now working for one of their spin outs.
This is super cool. I think you just saved me a massive headache, as I plan to roll out a healthcare app with PHI in the next few months.
Really, really bad form from the Salesforce Trust team here. Hopefully the Slack acquisition means better, quicker communications. On a scale of Slack to Oracle on breach notifications, this was definitely closer to Oracle.