Identity & Access Management
,
Security Operations
Salesloft Says Hackers Broke Into Its GitHub Repository
Cybersecurity firms Tenable and Qualys are the latest to fall to an ongoing wave of attacks stemming from hacker theft of authentication tokens from a third-party tool often integrated into Salesforce software.
See Also: Identity-Based Attacks – When MFA Isn’t Enough
The firms disclosed their exposure to the supply chain attack that lifted OAuth access tokens from marketing-as-a-service software provider Salesloft’s Drift artificial intelligence chat agent in blog posts on Sept. 3 and Sept. 6, respectively.
The two firms join a growing list of companies, including cybersecurity firms Zscaler, Palo Alto Networks, CyberArk, Cloudflare, Elastic and Rubrik that have had hackers steal information such as contact information from vulnerable instances of Salesforce integrated with Salesloft’s Drift AI chat agent (see: Salesloft Drift Attacks Exposed Zscaler Customer Data).
Salesloft on Saturday disclosed that hackers from March through June accessed its GitHub account and was then able to access the Drift Amazon Web Services environment, where they stole OAuth tokens.
Google Mandiant, hired by Salesloft to investigate the breach, attributes the hack to a group it tracks as UNC6395. It hasn’t linked that group to any known cybercrime group or nation-state. The ShinyHunters extortion group initially claimed to BleepingComputer that they were behind the attacks, before retracting that statement. In a Sunday LinkedIn post, Hudson Rock co-founder Alon Gal said the technique of breaking into a GitHub account to look for tokens inside repositories “is a method Shinyhunters/Lapsus$/Scattered Spider used since 2020 (or even before) and it’s evidently still working.”
Will Thomas, a senior threat intelligence adviser at Team Cymru identified many of the internet protocol addresses used by attackers to siphon information from Drift integrations as forming part of the Tor anonymity network. “Allowing easily identifiable Tor Exit Nodes to bulk download files or perform administration actions indicates very weak or no controls in place,” he said.
Tenable detected on Sept. 3 an unauthorized user gaining unrestricted access to customer information, a database stored in the company’s Salesforce server. The information stored there includes names, business email addresses, phone numbers, location references, subject lines and initial case descriptions, written by Tenable customers, when opening a support request.
Qualys said the previously stolen OAuth token credentials allowed unidentified threat actors to gain limited access to Qualys’ Salesforce information, which includes info found on Salesloft Drift.
Each company said its products and services were unaffected and fully operational. They also said they disabled the Salesloft Drift application, revoking its system integrations post-breach.
With reporting by Information Security Media Group’s Mathew Schwartz in Scotland and David Perera in Northern Virginia.