Does anyone know what to look for in the github audit logs, exactly?
Tangentially, You can view your oauth linked services here https://github.com/settings/applications
Heroku Security Notification
61–70 of 123 posts
Re: Heroku Security Notification
#62Earlier quoted context omitted.
I used here: /settings/audit-log" rel="nofollow">https://github.com/organizations/ /settings/audit-l... ... but the real question is what would malicious activity look like, exactly?
I see a heap of "downloaded a zip of repository" but I suspect that's Heroku CI or other CI tool running.
Same. Most belong to 1 member of our team, but a few belong to others on the team. They started happening about 6 months ago (unless logs only go back 6 mo). Would really like to figure out what these are. I asked GH, they said it’s not involved with this breach, and haven’t yet answered my next question (who/what is it?)
Re: Heroku Security Notification
#63This is a much bigger problem than Heroku. There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access). - Productboard - Bugsnag - Sentry - Skylight - Percy - CodeTree - Databox There are heaps of others, these are just some on top the of my mind. A ticking supply chain attack waiting to happen, since these companies make themselves into alluring hacking target…
For a while now I've been worried about this -- either integrations asking for full read/write access for a service that might seem to need only read.
Or maybe worse, integrations asking for access to anything my account has access to, when I only want to grant it to one repo or organization, or only to public repos and not private ones.
Whenever I've reached out to inquire/complain about this, I've been told that github does not give them granular enough auth settings to ask for less than this.
Is this true? I don't know. When I've tried looking at the relevant github docs myself, i quickly get confused.
Does anyone understand the github auth architecture -- does it need to be fixed to allow more granular access, or are integrations just not using it properly? Like... who should I be complaining to?
Re: Heroku Security Notification
#64I have always wondered if putting confidential info in even private git repo was a good idea, although it seems to be a common practice? I feel like that question has been answered, for me anyway.
Re: Heroku Security Notification
#65Earlier quoted context omitted.
I see a heap of "downloaded a zip of repository" but I suspect that's Heroku CI or other CI tool running.
Yeah I see lots of the same. They seem to correspond with Heroku deploys? Anyone know if that happens when a valid heroku deploy occurs? Do they download a zip? I've reached out to Heroku support to ask.
Normal Heroku usage doesn’t download a zip because it uses git directly, but I’ve seen plenty of CI tools download zips.
Re: Heroku Security Notification
#66> Additionally, we recommend disconnecting Heroku from your GitHub repositories. I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards. My thoughts are with the team working on responding to this incident on Easter Friday.
I can confirm that ~2h ago my integration was working but now it's not, so it seems they automatically disconnected everyone. Not sure if "they" is Github or Heroku here, but my master branch is not autodeploying anymore and trying to reconnect results into an error.
My personal account audit log says “salesforce-revocation-bot” removed my Heroku Dashboard OAuth Application a few hours ago.
Re: Heroku Security Notification
#67Earlier quoted context omitted.
Yeah I see lots of the same. They seem to correspond with Heroku deploys? Anyone know if that happens when a valid heroku deploy occurs? Do they download a zip? I've reached out to Heroku support to ask.
Normal Heroku usage doesn’t download a zip because it uses git directly, but I’ve seen plenty of CI tools download zips.
I thought as much. Maybe it is CircleCI then.
Re: Heroku Security Notification
#68Disappointed that the GitHub security log doesn’t show access for personal accounts. Would be rather nice if they temporarily made that available for a short period of time so we can see if any of our repositories have been cloned/downloaded.
I've been disappointed with GitHub's auditing capabilities.
I noticed that some members of my team were committing changes to our enterprise repositories with poorly-configured clients, so it was impossible to tell who made the commit or performed the push.
I understand that git itself doesn't have any protections against this, but GitHub knows who pushed it; why isn't that metadata available?
Re: Heroku Security Notification
#69This is a much bigger problem than Heroku. There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access). - Productboard - Bugsnag - Sentry - Skylight - Percy - CodeTree - Databox There are heaps of others, these are just some on top the of my mind. A ticking supply chain attack waiting to happen, since these companies make themselves into alluring hacking target…
For a while now I've been worried about this -- either integrations asking for full read/write access for a service that might seem to need only read. Or maybe worse, integrations asking for access to anything my account has access to, when I only want to grant it to one repo or organization, or only to public repos and not private ones. Whenever I've reached out to inquire/complain about this, I've been told that gi…
I've been looking into this as I'm building similar per resource scoping for conjure.so's API.
GitHub has 'OAuth Apps' and 'GitHub Apps' [0]. The former's scopes do not permit such granularity (eg the `repo` scope gives access to all repos of the account [1]).
The latter is much more granular, allowing the user to select specific repos to grant permission [2]. The 'GitHub App' owner can see their installations and also determine if the user chose access for all repos or on a per repo basis.
Netlify does such granular installation and will prompt you if you don't see your repo listed in their dashboard to check permissions.
[0] https://docs.github.com/en/developers/apps/getting-started-w...
[1] https://docs.github.com/en/developers/apps/building-oauth-ap...
[2] https://docs.github.com/en/developers/apps/managing-github-a...
Re: Heroku Security Notification
#70This is a much bigger problem than Heroku. There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access). - Productboard - Bugsnag - Sentry - Skylight - Percy - CodeTree - Databox There are heaps of others, these are just some on top the of my mind. A ticking supply chain attack waiting to happen, since these companies make themselves into alluring hacking target…
For a while now I've been worried about this -- either integrations asking for full read/write access for a service that might seem to need only read. Or maybe worse, integrations asking for access to anything my account has access to, when I only want to grant it to one repo or organization, or only to public repos and not private ones. Whenever I've reached out to inquire/complain about this, I've been told that gi…
[deleted]