Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

81–90 of 162 posts

Re: Heroku Security Notification

#81

Post by JorgeGT »

curuinor wrote: post #60
Mandatum wrote: post #43

Really, really bad form from the Salesforce Trust team here. Hopefully the Slack acquisition means better, quicker communications. On a scale of Slack to Oracle on breach notifications, this was definitely closer to Oracle.

rule of thumb: company A acquires company B, then company A does not change to become like company B, company B changes to become like company A. there are exceptions, but few. I think Slack's communications are going to become more crap, personally.

Boeing's acquisition of McDonnell Douglas being a sad exception to that rule of thumb.

Re: Heroku Security Notification

#82

Post by staindk »

henryaj wrote: post #75

Obviously Heroku have handled this horribly - but are any small startups out there considering replatforming? Still seems like a lot of hassle and the competition I've tried (Cloud66, excid3's thing) haven't been as good.

I'd maybe use this as an opportunity to prioritise moving everything over to AWS.

I'm sure for some it may be an unwieldy amount of work but for others (depending on tech stack etc.) it ought to be fairly doable. In the long run it'll save money too.

Re: Heroku Security Notification

#83

Post by benevol »

VWWHFSfQ wrote: post #3

> Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. What else was in this database? Typically the password field is stored alongside the rest of the user record. So was this the entire customer database that was stolen? Usernames, emails, salted/hashed passwords, what else?…

> What else was in this database? Typically the password field is stored alongside the rest of the user record.

That is where you are supposed to have encrypted as many data fields of the record as possible - in addition to the conventional database encryption which encrypts the database as a whole.

Re: Heroku Security Notification

#84

Post by ojame »

staindk wrote: post #82
henryaj wrote: post #75

Obviously Heroku have handled this horribly - but are any small startups out there considering replatforming? Still seems like a lot of hassle and the competition I've tried (Cloud66, excid3's thing) haven't been as good.

I'd maybe use this as an opportunity to prioritise moving everything over to AWS. I'm sure for some it may be an unwieldy amount of work but for others (depending on tech stack etc.) it ought to be fairly doable. In the long run it'll save money too.

I’m interested in peoples experience with this and if it’s relatively true.

We (like many others I assume) pay more for Heroku than AWS as it allows us to “outsource” our dev ops. We are a small team (sub 15) with a decent sized, decade old app. We’ve had it on AWS before (and used platforms like BuildKite) but both required much more overhead (in terms of employee salary). Anecdotally I’ve heard the same from friends, though I understand AWS works well and is cheaper if you know AWS well.

Re: Heroku Security Notification

#85

Post by boesboes »

Seems like they don't have much of their notifications in order either.

I haven't heard _anything_ from Heroku on this, my colleague has been getting updates since this started...

We are both admins of our companies account.

Re: Heroku Security Notification

#86

Post by Narkov »

boesboes wrote: post #85

Seems like they don't have much of their notifications in order either. I haven't heard _anything_ from Heroku on this, my colleague has been getting updates since this started... We are both admins of our companies account.

How does a company like Salesforce mess this up for such an extended period of time? I understand that companies can make mistakes early on in a critical incident but this has been going on for weeks?!

Re: Heroku Security Notification

#87

Post by xena »

Narkov wrote: post #86
boesboes wrote: post #85

Seems like they don't have much of their notifications in order either. I haven't heard _anything_ from Heroku on this, my colleague has been getting updates since this started... We are both admins of our companies account.

How does a company like Salesforce mess this up for such an extended period of time? I understand that companies can make mistakes early on in a critical incident but this has been going on for weeks?!

Root cause analysis must have failed pretty bad. I worked at Heroku and with how much headcount they've lost my Salesforce starving the beast over the years, it's not surprising that it would take this long for them to react like this. When you scare away the best people with Salesforce policies, their Jira clone built on Salesforce, and overall being difficult to impossible to get more people on the team; yeah people will pack their shit up and leave.

Given how much of a web of interdependent and undocumented pain heroku is, I'm not surprised it's taken this long. A security team without any context to Heroku must have had to trace through everything system by system. Especially if core-db got popped.

Re: Heroku Security Notification

#88

Post by bigDinosaur »

couchand wrote: post #38
3np wrote: post #24

Earlier quoted context omitted.

> hash the username column Is this giving you any real security benefit? (I'd assume the usernames are indexed elsewhere and that it's a reasonable assumption that whoever gains access to this hashed data has access to the username list as well, making a lookup trivial - or are these not safe assumptions?)

Not GP, but one architecture where there would be a difference is there's a distinct identity provider, responsible solely for exchanging the user's long-lived username/password credentials for a short-lived ticket.

I imagine the process going a bit like https://youtu.be/y8OnoxKotPQ

Re: Heroku Security Notification

#89

Post by bigDinosaur »

chii wrote: post #18
cmeacham98 wrote: post #14

Earlier quoted context omitted.

Even if that's the case, it's still way after April 13th.

it might be that it took this amount of time to establish the facts of the events. If they recounted an incorrect version early, it might do more damage than not telling it. I dont know if the github disclosure "includes" heroku's disclosure : https://github.blog/2022-04-15-security-alert-stolen-oauth-u... - but it was at least april 15th - close-ish to when the event occurred.

Is it ever true that earlier indications that credentials should be rotated leads to worse outcomes, though, as just one example?

I'm sure I've received emails of the form: we suspect there may have been a breach, so we're forcing password resets, and have always taken that fine.

Post reply on HN