10 ms·

OneLogin suffers breach–customer data said to be exposed, decrypted

125 points by mercutio2 9y ago

rbinv 9y ago
One thing I have always wondered: how do companies like this actually detect such a breach in the first place? HTTP and SSH log files? Also, how do they ensure that their systems are no longer compromised?
- troydavis 9y ago
  Of the 6-7 breaches I've heard the details of, they were detected because either: - an engineer stumbled upon clear evidence of a rootkit, like a leftover dotfile or shell history entries - the exfiltrated data got used and someone noticed (Different story for active intrusions, where the intruder is detected when they first breach a system. At least anecdotally, the passive after-the-fact detection above seems more common, though.)
  - rbinv 9y ago
    Thanks for your reply. I assume many startups use AWS or GCE (with auto scaling) and thus don't necessarily setup/SSH into each and every machine/VM. Wouldn't this make rootkit detection more difficult? edit: how would an active intrusion detection take place?
    - pmoriarty 9y ago
      You don't have to ssh in to a system in order to detect a rootkit or intrusion. You could run a rootkit detection app like rkhunter[1] or chrootkit[2] (though I don't know how good these programs are at doing what they claim to do) or run a filesystem integrity monitoring app or HIDS[3] like Samhain[4]. You might also pick up intrusions via a network intrusion detection system like Snort[5]. [1] - https://en.wikipedia.org/wiki/Rkhunter https://en.wikipedia.org/wiki/Rkhunter [2] - https://en.wikipedia.org/wiki/Chkrootkit https://en.wikipedia.org/wiki/Chkrootkit [3] - https://en.wikipedia.org/wiki/Host-based_intrusion_detection_system https://en.wikipedia.org/wiki/Host-based_intrusion_detection... [4] - https://en.wikipedia.org/wiki/Samhain_(software) https://en.wikipedia.org/wiki/Samhain_(software) [5] - https://en.wikipedia.org/wiki/Snort_(software) https://en.wikipedia.org/wiki/Snort_(software)
      - ryanlol 9y ago
        > don't know how good these programs are at doing what they claim to do They're good for checking old backups to see if you were hacked in the 90s, not so useful for today.
        throwanem 9y ago
        The first two, sure. Snort, at least, remains under active maintenance, and while I'm not in network security myself any more, those I know who still are have had good things to say about it.
        pmoriarty 9y ago
        So what would you use today?
        ryanlol 9y ago
        I don't think there is any useful software intended for the same purpose as those two. You'll need something like Samhain to spot the breach when it happens.
    - trashcan 9y ago
      It will definitely require some configuration, but AIDE is an awesome tool. You take hashes of files when they are in a known good state (and are not supposed to change) and then monitor them for changes. http://aide.sourceforge.net/ http://aide.sourceforge.net/ It takes a good amount of setup because there are a lot of files that routinely change that you will want to ignore.
  - zitterbewegung 9y ago
    For a really great book about an Active Intrusion this is a classic. https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787 https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espiona...
    - jk563 9y ago
      Is this the one that started to realise what was happening due to unpaid time on a machine amounting to 25c or similar?
      - packetized 9y ago
        That's the one. I remember reading it in 1991 or 1992, and just having my mind blinded by the whole story.
      - bungie4 9y ago
        Yup. Cliff Stoll. His first book is a great read. The second as well, but he caught a lot of flack for his 'Luddite' views. Personally, and with the aid of hindsight, I think he just undershot on his predictions.
      - throwanem 9y ago
        I think so. It's also the one in which the protagonist stalled the attacker by means of a keyring, which is not so much a thing you can do any more.
    - ebcase 9y ago
      I re-read Cuckoo's Egg recently, and it was still a riveting read! Especially when considering that it all happened over telnet.
- LyndsySimon 9y ago
  LastPass issued a security warning in June 2015 that was originally triggered by their having detected network activity from an unknown source. For what it's worth, their handling of this event was the reason I adopted LastPass. https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h...
eatbitseveryday 9y ago
I don't trust putting all my passwords into the hands of another system for this reason.
- wand3r 9y ago
  The threat model these defend against best is using a single login and password across a host of secure and unsecured systems out of convenience. Some pass managers are better than others and on balance are better than the solutions non-technical (and many technical) would otherwise use. This is highly dependent on your threat model, degree of technical skill, actual data risk, and behavior.
- ViViDboarder 9y ago
  They aren't a password manager, but a SSO provider. The downside is also the upside. If a credential is leaked, having a single provider makes it easy to revoke access to all systems.
devrandomguy 9y ago
On a tangent, has anyone tried using Vault as a personal keyring, rather than using a cloud based password manager? In particular, how much would I need to trust each device that runs a Vault instance, if I was concerned mainly about malware running alongside it? Right now, I have everything in Keepass, and no good way to synchronize that between devices. Merging key repos is a royal pain, but mainly, I don't like the idea of trusting everything to an organization that I can't hold accountable. Running my own service on a generic tiny EC2 cluster feels like an improvement, although I would still worry a little about the virtual neighbors.
- dbingham 9y ago
  Please, someone build an open source solution similar to Lastpass backed by a Vault instance with browser plugins and a web front end to allow for key management. That would be amazing. Lastpass is almost necessary for me to keep all my passwords moderately secure and still usable. But I really do not love trusting all of my info to a 3rd party.
  - UnoriginalGuy 9y ago
    > But I really do not love trusting all of my info to a 3rd party. You don't need to. You need to trust Lastpass's design. A Lastpass database is an AES-256 encrypted blob, encrypted using a "slow" hash of your master password (PBKDF2, rounds are configurable). Lastpass don't know your password. When they authenticate you they test to see if your database is decryptable with the password you entered (after it is hashed). If you set 2F then they won't even allow attempts until 2F is satisfied (Google Authenticator is free). Lastpass's biggest weakness is also applicable to this theoretical OpenSource alternative: Javascript. Javascript is delivered from Lastpass (for the browser extension) and after you decrypt your password database, that JS has full access to it. If a "bad guy" is able to inject evil JS between you and them, then they could trivially steal already decrypted passwords. As I said, this weakness has nothing to do with Lastpass, it would equally apply to all password managers which integrate into the browser with an extension. In effect you've exchanged convenience for security. And you can already read the Lastpass browser extension's source code, being more open source doesn't make you immune from this issue. So you can choose to trust Lastpass, or not, but the design is sound. Slapping the words "open source" onto something won't mitigate any of LastPass's inherent design issues, and you'd still want to follow a similar design since it is a good compromise between security and convenience. Coming up with a superior design that doesn't sacrifice convenience would be awesome, but it is a hard problem...
dwwatk01 9y ago
Another tangent: I see OneLogin, on their main site, lists the customers using their solution. I know this is a very common practice, but can anyone explain any (not short-sightedly financial) benefit possible for a company allowing this disclosure?
- Kalium 9y ago
  Sure! I can offer one reason that isn't purely "because we got a discount". Imagine that you're a company not necessarily known for security prowess. Now imagine that you want to be able to demonstrate to users / customers / investors that you take security seriously and work with reputable vendors. You could list off the vendors you use, but then they're just taking your word for it. Wouldn't it be better if the vendor listed you? Alternately, perhaps there are common investors or board members exerting influence.
- ViViDboarder 9y ago
  Pricing. Sometimes you can get better contract terms by allowing them to cite you as a customer. Usually pricing, but there are other terms you may negotiate as well. As a side note... I imagine well probably see some of those customers coming down soon.
- deleted 9y ago
  [deleted]
- ecnahc515 9y ago
  In addition to to what the others have said l, sometimes the other business is willing to be a reference because they're happy with the product and want you to succeed. After all, they're using your product, its in their best interest that you succeed.
- pbarnes_1 9y ago
  Discounts, etc. But usually these lists of "customers" is just someone trawling the user database for @foocorp.com and anyone signed up from there makes the company a "customer".
- tptacek 9y ago
wdr1 9y ago
This is why I won't use mint.com for anything but my credit cards.

125 points by mercutio2 9y ago

One thing I have always wondered: how do companies like this actually detect such a breach in the first place? HTTP and SSH log files? Also, how do they ensure that their systems are no longer compromised?

troydavis 9y ago
Of the 6-7 breaches I've heard the details of, they were detected because either: - an engineer stumbled upon clear evidence of a rootkit, like a leftover dotfile or shell history entries - the exfiltrated data got used and someone noticed (Different story for active intrusions, where the intruder is detected when they first breach a system. At least anecdotally, the passive after-the-fact detection above seems more common, though.)
- rbinv 9y ago
  Thanks for your reply. I assume many startups use AWS or GCE (with auto scaling) and thus don't necessarily setup/SSH into each and every machine/VM. Wouldn't this make rootkit detection more difficult? edit: how would an active intrusion detection take place?
  - pmoriarty 9y ago
    You don't have to ssh in to a system in order to detect a rootkit or intrusion. You could run a rootkit detection app like rkhunter[1] or chrootkit[2] (though I don't know how good these programs are at doing what they claim to do) or run a filesystem integrity monitoring app or HIDS[3] like Samhain[4]. You might also pick up intrusions via a network intrusion detection system like Snort[5]. [1] - https://en.wikipedia.org/wiki/Rkhunter https://en.wikipedia.org/wiki/Rkhunter [2] - https://en.wikipedia.org/wiki/Chkrootkit https://en.wikipedia.org/wiki/Chkrootkit [3] - https://en.wikipedia.org/wiki/Host-based_intrusion_detection_system https://en.wikipedia.org/wiki/Host-based_intrusion_detection... [4] - https://en.wikipedia.org/wiki/Samhain_(software) https://en.wikipedia.org/wiki/Samhain_(software) [5] - https://en.wikipedia.org/wiki/Snort_(software) https://en.wikipedia.org/wiki/Snort_(software)
    - ryanlol 9y ago
      > don't know how good these programs are at doing what they claim to do They're good for checking old backups to see if you were hacked in the 90s, not so useful for today.
      - throwanem 9y ago
        The first two, sure. Snort, at least, remains under active maintenance, and while I'm not in network security myself any more, those I know who still are have had good things to say about it.
      - pmoriarty 9y ago
        So what would you use today?
        ryanlol 9y ago
        I don't think there is any useful software intended for the same purpose as those two. You'll need something like Samhain to spot the breach when it happens.
  - trashcan 9y ago
    It will definitely require some configuration, but AIDE is an awesome tool. You take hashes of files when they are in a known good state (and are not supposed to change) and then monitor them for changes. http://aide.sourceforge.net/ http://aide.sourceforge.net/ It takes a good amount of setup because there are a lot of files that routinely change that you will want to ignore.
- zitterbewegung 9y ago
  For a really great book about an Active Intrusion this is a classic. https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787 https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espiona...
  - jk563 9y ago
    Is this the one that started to realise what was happening due to unpaid time on a machine amounting to 25c or similar?
    - packetized 9y ago
      That's the one. I remember reading it in 1991 or 1992, and just having my mind blinded by the whole story.
    - bungie4 9y ago
      Yup. Cliff Stoll. His first book is a great read. The second as well, but he caught a lot of flack for his 'Luddite' views. Personally, and with the aid of hindsight, I think he just undershot on his predictions.
    - throwanem 9y ago
      I think so. It's also the one in which the protagonist stalled the attacker by means of a keyring, which is not so much a thing you can do any more.
  - ebcase 9y ago
    I re-read Cuckoo's Egg recently, and it was still a riveting read! Especially when considering that it all happened over telnet.
LyndsySimon 9y ago
LastPass issued a security warning in June 2015 that was originally triggered by their having detected network activity from an unknown source. For what it's worth, their handling of this event was the reason I adopted LastPass. https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h...

eatbitseveryday 9y ago

I don't trust putting all my passwords into the hands of another system for this reason.

wand3r 9y ago
The threat model these defend against best is using a single login and password across a host of secure and unsecured systems out of convenience. Some pass managers are better than others and on balance are better than the solutions non-technical (and many technical) would otherwise use. This is highly dependent on your threat model, degree of technical skill, actual data risk, and behavior.
ViViDboarder 9y ago
They aren't a password manager, but a SSO provider. The downside is also the upside. If a credential is leaked, having a single provider makes it easy to revoke access to all systems.

devrandomguy 9y ago

On a tangent, has anyone tried using Vault as a personal keyring, rather than using a cloud based password manager? In particular, how much would I need to trust each device that runs a Vault instance, if I was concerned mainly about malware running alongside it? Right now, I have everything in Keepass, and no good way to synchronize that between devices. Merging key repos is a royal pain, but mainly, I don't like the idea of trusting everything to an organization that I can't hold accountable. Running my own service on a generic tiny EC2 cluster feels like an improvement, although I would still worry a little about the virtual neighbors.

dbingham 9y ago
Please, someone build an open source solution similar to Lastpass backed by a Vault instance with browser plugins and a web front end to allow for key management. That would be amazing. Lastpass is almost necessary for me to keep all my passwords moderately secure and still usable. But I really do not love trusting all of my info to a 3rd party.
- UnoriginalGuy 9y ago
  > But I really do not love trusting all of my info to a 3rd party. You don't need to. You need to trust Lastpass's design. A Lastpass database is an AES-256 encrypted blob, encrypted using a "slow" hash of your master password (PBKDF2, rounds are configurable). Lastpass don't know your password. When they authenticate you they test to see if your database is decryptable with the password you entered (after it is hashed). If you set 2F then they won't even allow attempts until 2F is satisfied (Google Authenticator is free). Lastpass's biggest weakness is also applicable to this theoretical OpenSource alternative: Javascript. Javascript is delivered from Lastpass (for the browser extension) and after you decrypt your password database, that JS has full access to it. If a "bad guy" is able to inject evil JS between you and them, then they could trivially steal already decrypted passwords. As I said, this weakness has nothing to do with Lastpass, it would equally apply to all password managers which integrate into the browser with an extension. In effect you've exchanged convenience for security. And you can already read the Lastpass browser extension's source code, being more open source doesn't make you immune from this issue. So you can choose to trust Lastpass, or not, but the design is sound. Slapping the words "open source" onto something won't mitigate any of LastPass's inherent design issues, and you'd still want to follow a similar design since it is a good compromise between security and convenience. Coming up with a superior design that doesn't sacrifice convenience would be awesome, but it is a hard problem...

dwwatk01 9y ago

Another tangent: I see OneLogin, on their main site, lists the customers using their solution. I know this is a very common practice, but can anyone explain any (not short-sightedly financial) benefit possible for a company allowing this disclosure?

Kalium 9y ago
Sure! I can offer one reason that isn't purely "because we got a discount". Imagine that you're a company not necessarily known for security prowess. Now imagine that you want to be able to demonstrate to users / customers / investors that you take security seriously and work with reputable vendors. You could list off the vendors you use, but then they're just taking your word for it. Wouldn't it be better if the vendor listed you? Alternately, perhaps there are common investors or board members exerting influence.
ViViDboarder 9y ago
Pricing. Sometimes you can get better contract terms by allowing them to cite you as a customer. Usually pricing, but there are other terms you may negotiate as well. As a side note... I imagine well probably see some of those customers coming down soon.
deleted 9y ago
[deleted]
ecnahc515 9y ago
In addition to to what the others have said l, sometimes the other business is willing to be a reference because they're happy with the product and want you to succeed. After all, they're using your product, its in their best interest that you succeed.
pbarnes_1 9y ago
Discounts, etc. But usually these lists of "customers" is just someone trawling the user database for @foocorp.com and anyone signed up from there makes the company a "customer".
tptacek 9y ago

wdr1 9y ago

This is why I won't use mint.com for anything but my credit cards.