5 ms·

Timeline matches with the Travis breach. So far likely impacted: 1. Slack 2. Okta (https://news.ycombinator.com/item?id=34081154 https://news.ycombinator.com/

Timeline matches with the Travis breach. So far likely impacted: 1. Slack 2. Okta (https://news.ycombinator.com/item?id=34081154 https://news.ycombinator.com/item?id=34081154) 3. Coa (https://github.com/veged/coa/issues/99#issuecomment-961696885 https://github.com/veged/coa/issues/99#issuecomment-96169688...)

dijit 4y ago
Add yesterdays announcement about CircleCI[0] and you have even more plausible options. [0]: https://circleci.com/blog/january-4-2023-security-alert/ https://circleci.com/blog/january-4-2023-security-alert/
- rad_gruchalski 4y ago
  Wow wow wow. It would have been great for CircleCI to actually send an email with this info. I have a couple of OSS repos with them…
  - baltoo 4y ago
    They did. Or at least I got it
    - flanbiscuit 4y ago
      I got one at 9:31pm Eastern Time last night (Jan 4, 2022): here's what it said: We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing. We will provide you updates about this incident, and our response, as they become available. At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative measures to protect your data as well. Action request: Out of an abundance of caution, we strongly recommend that all customers take the following actions: - Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts. - We also recommend customers review internal logs for their systems for any unauthorized access starting from December 21, 2022 through today, January 4, 2023, or upon completion of your secrets rotation. Additionally, if your project uses Project API tokens, we have invalidated those and you will need to replace them. You can find more information on how to do that in our documentation here. We apologize for any disruption to your work. We take the security of our systems and our customers’ systems extremely seriously. While we are actively investigating this incident, we are committed to sharing more details with customers in the coming days. Thank you for your urgent attention to rotating your secrets.
- berniedurfee 4y ago
  CircleCI uses Travis?
swyx 4y ago
are you implying that travis may have caused compromise of customer codebases? wow
- nightpool 4y ago
  Yes, this is well known, they had a major breach earlier in 2022 that apparently leaked all of their Github tokens. This happened almost simultaneously to the Heroku leak and is thought to be connected to it. From OP's link, it sounds like they had another one recently—maybe another group re-using the first vulnerability?
  - rad_gruchalski 4y ago
    > earlier this year Earlier last year.
    - nightpool 4y ago
      Whoops, thanks :)
    - richbell 4y ago
      3am feels like both "last night" and "this morning"; I feel the same way about 2020-202x.
wut42 4y ago
I was thinking of the Pytorch supply-chain issue as well: https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/ https://www.bleepingcomputer.com/news/security/pytorch-discl... I can see someone working at Slack try a nightly, they surely work with ML.

dijit 4y ago

Add yesterdays announcement about CircleCI[0] and you have even more plausible options. [0]: https://circleci.com/blog/january-4-2023-security-alert/ https://circleci.com/blog/january-4-2023-security-alert/

rad_gruchalski 4y ago
Wow wow wow. It would have been great for CircleCI to actually send an email with this info. I have a couple of OSS repos with them…
- baltoo 4y ago
  They did. Or at least I got it
  - flanbiscuit 4y ago
    I got one at 9:31pm Eastern Time last night (Jan 4, 2022): here's what it said: We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing. We will provide you updates about this incident, and our response, as they become available. At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative measures to protect your data as well. Action request: Out of an abundance of caution, we strongly recommend that all customers take the following actions: - Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts. - We also recommend customers review internal logs for their systems for any unauthorized access starting from December 21, 2022 through today, January 4, 2023, or upon completion of your secrets rotation. Additionally, if your project uses Project API tokens, we have invalidated those and you will need to replace them. You can find more information on how to do that in our documentation here. We apologize for any disruption to your work. We take the security of our systems and our customers’ systems extremely seriously. While we are actively investigating this incident, we are committed to sharing more details with customers in the coming days. Thank you for your urgent attention to rotating your secrets.
berniedurfee 4y ago
CircleCI uses Travis?

swyx 4y ago

are you implying that travis may have caused compromise of customer codebases? wow

nightpool 4y ago
Yes, this is well known, they had a major breach earlier in 2022 that apparently leaked all of their Github tokens. This happened almost simultaneously to the Heroku leak and is thought to be connected to it. From OP's link, it sounds like they had another one recently—maybe another group re-using the first vulnerability?
- rad_gruchalski 4y ago
  > earlier this year Earlier last year.
  - nightpool 4y ago
    Whoops, thanks :)
  - richbell 4y ago
    3am feels like both "last night" and "this morning"; I feel the same way about 2020-202x.

wut42 4y ago

I was thinking of the Pytorch supply-chain issue as well: https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/ https://www.bleepingcomputer.com/news/security/pytorch-discl... I can see someone working at Slack try a nightly, they surely work with ML.