Heroku Security Notification
status.heroku.com
Heroku Security Notification
1–10 of 162 posts
Re: Heroku Security Notification
#2I had posted the most relevant paragraphs in https://news.ycombinator.com/item?id=31255450 but it probably should be here too:
>On April 7, 2022, a threat actor obtained access to a Heroku database and downloaded stored customer GitHub integration OAuth tokens. Access to the environment was gained by leveraging a compromised token for a Heroku machine account. According to GitHub, the threat actor began enumerating metadata about customer repositories with the downloaded OAuth tokens on April 8, 2022. On April 9, 2022, the attacker downloaded a subset of the Heroku private GitHub repositories from GitHub, containing some Heroku source code.
...
> Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. For this reason, Salesforce is ensuring all Heroku user passwords are reset and potentially affected credentials are refreshed. We have rotated internal Heroku credentials and put additional detections in place. We are continuing to investigate the source of the token compromise.
Re: Heroku Security Notification
#3> Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts.
What else was in this database? Typically the password field is stored alongside the rest of the user record. So was this the entire customer database that was stolen? Usernames, emails, salted/hashed passwords, what else?
I feel like at some point they're just going to go completely radio silent because the extent of the breach will become such that they'll have no choice but to just lawyer up.
Re: Heroku Security Notification
#4Ugh - I got the password reset email w silly password complexity - never a good sign.
Re: Heroku Security Notification
#5What are some good Heroku alternatives these days?
Re: Heroku Security Notification
#6What are some good Heroku alternatives these days?
Render.com
Re: Heroku Security Notification
#7I really feel like people don't value intrusion detection enough. Why was Heroku's intrusion detection system "rely on Github's intrusion detection system"?
Re: Heroku Security Notification
#8> Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. What else was in this database? Typically the password field is stored alongside the rest of the user record. So was this the entire customer database that was stolen? Usernames, emails, salted/hashed passwords, what else?…
The last couple large places I work specifically split out the auth/password DB from the rest of the user data. They're used for different things and they have different types of sensitivity around them.
Re: Heroku Security Notification
#9> Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. What else was in this database? Typically the password field is stored alongside the rest of the user record. So was this the entire customer database that was stolen? Usernames, emails, salted/hashed passwords, what else?…
Yeah, the comms around this has been very concerning. Do I need to rotate every config var on all of my apps? Re-install every add-on?
While the nature of what limited things they had disclosed to date pointed to this situation part of me wanted to believe it wasn't as bad as I was assuming. And now the trendline on this suggests I should have already done everything I've outlined above. And I'm low confidence anybody is going to be proactive in telling me until it's absolutely obvious that these things have been compromised and exploited.
Re: Heroku Security Notification
#10Why am I hearing about this on checks the fucking date on May 5th instead of, like, month ago.