7 ms·
> Additionally, we recommend disconnecting Heroku from your GitHub repositories. I have respect for the Heroku/Salesforce Security team for willing to ask user
by frays 5y ago
> Additionally, we recommend disconnecting Heroku from your GitHub repositories.
I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards.
My thoughts are with the team working on responding to this incident on Easter Friday.
- ryantgtg 5y agoFrom what I can tell from the update from a couple minutes ago, this recommendation wasn’t deemed to be enough. Now they’re revoking all tokens.
- czbond 5y agoFor anyone wondering where this is....it is in your project -> "Deploy" -> "Deployment method" -> "Connect to Github".
- forgingahead 5y agoFor some reason for the single app I had used this for, there was no "Disconnect" button - so I just did the nuke option of deleting the connection right from the main settings page: https://dashboard.heroku.com/account/applications#third-party-applications https://dashboard.heroku.com/account/applications#third-part... For checking your Github audit logs, you can go directly here (replace ORG_NAME with your own): https://github.com/organizations/<ORG_NAME>/settings/audit-log https://github.com/organizations/<ORG_NAME>/settings/audit-l... Or from: Organization > Settings > Archive > Logs > Audit Log I hope we get some more clarity on the extent of this incident soon. We'll rotate our keys anyway but I really hope the attackers did not have access to the ENV vars that are commonly set on Heroku directly.
- pselbert 5y agoFor many accounts the audit log isn’t going to show some crucial information—git activity. Clone events are only available through the REST API for Enterprise customers.
- paradite 5y agoThe GitHub pipeline integration doesn't show up on the third party applications page here: https://dashboard.heroku.com/account/applications#third-party-applications https://dashboard.heroku.com/account/applications#third-part... I had to remove them one by one.
- franciscop 5y agoI can confirm that ~2h ago my integration was working but now it's not, so it seems they automatically disconnected everyone. Not sure if "they" is Github or Heroku here, but my master branch is not autodeploying anymore and trying to reconnect results into an error.
- heartbreak 5y agoMy personal account audit log says “salesforce-revocation-bot” removed my Heroku Dashboard OAuth Application a few hours ago.
- kall 5y ago"Github System" removed the Heroku Dashboard key and a personal user account of someone that seems to work at neither GitHub nor Travis removed my Travis CI key (????)
- mtmail 5y agoIf you saw the user 'shairyar', he works at Travis based on linkedin profile page (but not based on github profile page). I was confused as well when I saw that.
- kall 5y agoI guess maybe, but this is incredibly badly communicated. Just now they showed up as a member of travis GitHub orgs, but the only member? https://github.com/orgs/travis-ci/people https://github.com/orgs/travis-ci/people It's very possible (likely) this is all fine, but done in a way that feels strange/fishy. I haven't even gotten an email from travis. They must be in fire-extinguishing mode.
- jmarneweck 5y agoI would have expected that they would have used a known human rather than look like someone with unauthorised access was doing so. I see he now has access to three travis-ci organisations on GitHub.
- SnowHill9902 5y agoInternet applications have become dangerously correlated.