[ad_1]
Heroku has now revealed that stolen GitHub integration OAuth tokens last month further led to the compromise of an internal customer database.
The Salesforce-owned cloud platform acknowledged that attackers used the same compromised token to leak encrypted and salted customer passwords from “a database.”
The Heroku update comes after BleepingComputer contacted Salesforce yesterday.
Like many users, we unexpectedly received a password reset email from Heroku, even though BleepingComputer doesn’t have any OAuth integration that uses Heroku or GitHub apps. This indicated that these password resets were related to something else.
Heroku explains forced password resets
This week, Heroku began performing forced password resets for a subset of its user accounts after last month’s security incident, without fully explaining why.
On Tuesday night, some Heroku users received emails titled “Heroku Security Notification: User Account Password Reset May 4, 2022,” informing users that their account passwords were being reset in security incident response. The reset would also invalidate all API access tokens and require users to generate new ones, the email explained.
But, the original security incident referenced involved threat actors stealing OAuth tokens issued to Heroku and Travis-CI and abusing them to download data from private GitHub repositories belonging to dozens of organizations, including npm.
“On April 12, GitHub Security launched an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm,” GitHub said. previously disclosed.
These tokens had previously been used by Travis-CI and Heroku OAuth apps to integrate with GitHub to deploy apps.
By stealing these OAuth tokens, threat actors could access and download data from GitHub repositories belonging to those who authorized the compromised Heroku or Travis CI OAuth apps with their accounts. Please note that GitHub’s private infrastructure, systems, or repositories were not affected by the incident.
But that still didn’t explain why Heroku would need to reset some user account passwords, until now.
It turns out that the compromised token for a Heroku machine account obtained by threat actors also allowed unauthorized access to Heroku’s internal database of customer accounts:
“Our investigation also revealed that the same compromised token was leveraged to gain access to a database and leak the salted and encrypted passwords of customer user accounts,” Heroku explains in an updated security notification.
“For this reason, Salesforce ensures that all Heroku user passwords are reset and potentially affected credentials are updated. We have rotated internal Heroku credentials and implemented additional detections. We are continuing to investigate the source of the token compromise.” .
A YCombinator Hacker News reader alleged that the referenced “database” might be what was once called “core-db”.
The reader in question seems to be craig kerstiens of the PostgreSQL CrunchyData platform, which was previously affiliated with Heroku.
“The latest report claims about ‘a database’ which is presumably the internal database,” says the reader.
“I don’t want to speculate too much, but it seems [the attacker] had access to internal systems. GitHub were the ones who caught it and noticed and reported it to Heroku. I don’t disagree that there should be more clarity, but it’s better to follow up with Salesforce on that.”
Clients call vague disclosure a ‘train wreck’
Heroku’s original disclosure of the security incident indicated that the unauthorized access had been related to GitHub repositories belonging to accounts using compromised OAuth tokens from Heroku.
“Compromised tokens could provide the threat actor with access to the customer’s GitHub repositories, but not to the customer’s Heroku accounts,” the company had previously stated.
But the password reset emails legitimately raised concerns among customers that Heroku’s investigation might have uncovered more malicious activity by threat actors that went undisclosed.
Some YCombinator Hacker News readers called the disclosure “a complete train wreck and a case study in how not to communicate with your customers.”
In its quest to be more transparent with the community, Heroku has shed some light on the incident that started a few hours ago.
“We value transparency and understand that our customers are seeking a deeper understanding of the impact of this incident and our response to date,” says Heroku.
The cloud platform further stated that after working with GitHub, threat intelligence providers, industry partners, and law enforcement during the investigation, it had reached a point where more information could be shared without compromising the ongoing investigation:
GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation. As a result, on April 16, 2022, we revoked all GitHub integration OAuth tokens, which prevented customers from deploying GitHub apps through the Heroku dashboard or through automation. We remain committed to ensuring the integration is secure before re-enabling this functionality.”
By contrast, another third-party integrator, Travis-CI, revealed the business day following GitHub’s original notification that the incident had not affected customer data.
Heroku users are encouraged to continue to monitor the security notification page for updates related to the incident.
[ad_2]
