Documented incidentDisclosed 2022-04-15GitHub / Heroku / Travis CIEngineering postmortem

Stolen OAuth tokens from two integrators are used to download private repositories (Heroku and Travis CI, 2022)

GitHub found an attacker abusing stolen OAuth user tokens that had been issued to two third-party integrators, Heroku and Travis CI.

What happened

  • The attacker used the tokens to download private repositories belonging to dozens of organizations.Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators
  • GitHub revoked the tokens, notified affected users and recommended reviewing authorized applications.Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Minimise and protect stored OAuth tokensStore integration tokens encrypted, scope them narrowly, expire them and revoke quickly on suspicion.
  • Monitor token use for anomaliesAlert on tokens used from unexpected networks or enumerating many repositories.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern