Hacker News Reader

I still don't totally understand, can anyone read between the lines to explain what's going on here? The attackers stole what sort of OAuth tokens with what sort of access?

View on HN

I could be wrong but you know when you sign up for services you have option of signing in with github or other oAuth providers? I think they used this to gain access to various private repos, npms, cloud credentials.

So it seems like if your company had some super secret project running on github, heroku, AWS, they had full access to it.

This is my rough understanding just skimming so could be wrong.

I guess here's what I'm wondering: did they somehow get multiple Oauth keys, one per account compromised on github -- from both Heroku and Travis, just coincidentally both heroku and travis exposed their customers keys somehow?

Or did they get one Oauth key each from Heroku and Travis that exposed all of their customers data on github? Are there keys that would do this, set up for what purpose?

Reply on news.ycombinator.com