SalesLoft will temporarily shut down its Drift chatbot 'in the very near future' following security breaches affecting several customers.
These customers included prominent global brands, like Cloudflare, Palo Alto Networks, and Zscaler.
The move to take Drift offline comes after the company already paused its Salesforce integration.
In an update posted online on Tuesday, September 2, Drift stated: "This will provide the fastest path forward to comprehensively review the application and build additional resiliency and security in the system to return the application to full functionality.
As a result, the Drift chatbot on customer websites will not be available, and Drift will not be accessible.
SalesLoft Drift is a popular conversational AI application, interacting with website visitors and offering them a personalized buying experience.
Drift is part of SalesLoft’s sales engagement platform, leveraged by over 5,000 brands, including IBM, Shopify, and Stripe, alongside the companies listed above.
What Happened?
In short, attackers stole OAuth bearer tokens that SalesLoft held on its customers' behalf.
These tokens connect Drift with their Salesforce instances. Yet, not only Salesforce. In many reported cases, the tokens connected to Google Workspace, AWS, Azure, and even OpenAI as well.
After stealing the credentials, the attackers began probing what they could access.
Eventually, the stolen tokens gave attackers access to accounts and services, exposing the data of SalesLoft’s customers’ customers.
The saga is a reminder of how messy OAuth can be. It also offers lessons for vendors like SalesLoft, who must protect customer tokens, and businesses, who need to be careful about the integrations they choose and the risks they carry.
There Is No Easy Fix...
The question that looms large over this incident is: how did the tokens disappear in the first place?
Perhaps it was a social engineering attack, a compromise of SalesLoft’s token store, or something else. It’s not clear. What is clear is that this isn’t a simple problem to fix.
