4 ms·

Heroku reported it on 4/15. Read the beginning of the string of updates on the notification page posted here. Also, https://news.ycombinator.com/item?id=3104

Heroku reported it on 4/15. Read the beginning of the string of updates on the notification page posted here. Also, https://news.ycombinator.com/item?id=31048646 https://news.ycombinator.com/item?id=31048646

heartbreak 4y ago
And they reported that the credentials were leaked on 5/3. That took a long time.
- dev_tty01 4y ago
  Which credentials are you referring to? They reported the loss of OAuth tokens on April 15. What am I missing? https://status.heroku.com/incidents/2413 https://status.heroku.com/incidents/2413 "On April 13, 2022, Salesforce Security was notified by GitHub that a subset of Heroku’s GitHub private repositories, including some source code, was downloaded by a threat actor on April 9, 2022. Based on Salesforce’s initial investigation, it appears that unauthorized access to Heroku's GitHub account was the result of a compromised OAuth token. Salesforce immediately disabled the compromised user’s OAuth tokens and disabled the compromised user’s GitHub account. Additionally, GitHub reported that the threat actor was enumerating GitHub customer accounts using OAuth tokens issued to Heroku’s OAuth integration dashboard hosted on GitHub. Based on the information GitHub shared with us, we are investigating how the threat actor gained access to customer OAuth tokens. The compromised tokens could provide the threat actor access to customer GitHub repos, but not customer Heroku accounts. With the access to customer OAuth tokens, the threat actor may have read and write access to customer GitHub repositories connected to Heroku. Given the incident is still active, please review the recommended actions provided below." Posted 21 days ago, APR 15, 2022 23:36 UTC
  - heartbreak 4y ago
    You’re missing the 5/3 update about username and password credentials. > our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. From the link we are commenting on.
    - dev_tty01 4y ago
      Got it. Thanks.

heartbreak 4y ago

And they reported that the credentials were leaked on 5/3. That took a long time.

dev_tty01 4y ago
Which credentials are you referring to? They reported the loss of OAuth tokens on April 15. What am I missing? https://status.heroku.com/incidents/2413 https://status.heroku.com/incidents/2413 "On April 13, 2022, Salesforce Security was notified by GitHub that a subset of Heroku’s GitHub private repositories, including some source code, was downloaded by a threat actor on April 9, 2022. Based on Salesforce’s initial investigation, it appears that unauthorized access to Heroku's GitHub account was the result of a compromised OAuth token. Salesforce immediately disabled the compromised user’s OAuth tokens and disabled the compromised user’s GitHub account. Additionally, GitHub reported that the threat actor was enumerating GitHub customer accounts using OAuth tokens issued to Heroku’s OAuth integration dashboard hosted on GitHub. Based on the information GitHub shared with us, we are investigating how the threat actor gained access to customer OAuth tokens. The compromised tokens could provide the threat actor access to customer GitHub repos, but not customer Heroku accounts. With the access to customer OAuth tokens, the threat actor may have read and write access to customer GitHub repositories connected to Heroku. Given the incident is still active, please review the recommended actions provided below." Posted 21 days ago, APR 15, 2022 23:36 UTC
- heartbreak 4y ago
  You’re missing the 5/3 update about username and password credentials. > our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. From the link we are commenting on.
  - dev_tty01 4y ago
    Got it. Thanks.