20 ms·

Hackers claim to have breached Okta systems

1158 points by obi1kenobi 5y ago

moepstar 5y ago
With all those recent news of compromises done by Lapsus$, i really wonder what they're doing "differently" to the rest - do they have an especially large arsenal of exploits or is everything compromised anyways and one just doesn't read about it in the public because no one knows...
- tyingq 5y ago
  One theory is that they are based in South America, and have working knowledge of all the outsourced support that's gone to Brazil, Chile, Argentina, Costa Rica, etc. So they are well positioned for social engineering those workers, how the support systems generally work, etc.
- pm90 5y ago
  The latter. Businesses love to outsource and with technology there are just so many leaky pipes everywhere built by whoever could build them cheapest.
unclekev 5y ago
Wonder how long it will take Okta to say something. I bet a lot of IntoSec departments are stressing right now because of this tweet.
- Johnny555 5y ago
  https://www.usnews.com/news/technology/articles/2022-03-22/authentication-services-firm-okta-says-it-is-investigating-report-of-breach https://www.usnews.com/news/technology/articles/2022-03-22/a... WASHINGTON (Reuters) - Authentication services company Okta Inc said on Tuesday it is investigating a report of a digital breach after hackers posted screenshots of what they claimed were its internal company environment. A hack at Okta could have potential major consequences because thousands of other companies rely on the San Francisco-based firm to manage access to their own networks and applications. The screenshots were posted by a group of ransom-seeking hackers known as LAPSUS$ on their Telegram channel late on Monday.
  - unclekev 5y ago
    I saw this, but where is the actual statement? > Authentication services company Okta Inc said on Tuesday Where? What did they say? To who? The person writing the article?
    - Johnny555 5y ago
      It's a developing story, click back to the article and there are more details now, including the name of the Okta official that made the statement: WASHINGTON (Reuters) -Authentication services provider Okta Inc is investigating a report of a digital breach, the company said on Tuesday, after hackers posted screenshots showing what they claimed was its internal company environment. A hack at Okta could have major consequences because thousands of other companies rely on the San Francisco-based firm to manage access to their own networks and applications. The company was aware of the reports and was investigating, Okta official Chris Hollis said in a brief statement. "We will provide updates as more information becomes available," he added. The screenshots were posted by a group of ransom-seeking hackers known as LAPSUS$ on their Telegram channel late on Monday. In an accompanying message, the group said its focus was "ONLY on Okta customers." Security experts told Reuters the screenshots appeared to be authentic. "I definitely do believe it is credible," said independent security researcher Bill Demirkapi, citing pictures of what appeared to be Okta's internal tickets and its in-house chat on the Slack messaging app. Dan Tentler, the founder of cybersecurity consultancy Phobos Group, said he too believed the breach was real and urged Okta customers to be "very vigilant right now." In an email, Tentler added, "There are timestamps and dates visible in the screenshots indicating January 21st of this year, which suggests they may have had access for two months."
- fyzllgig 5y ago
  Can confirm. I had just tucked into bed when this tweet got shared with me. Now, in the "is it real or not" stage I'm refreshing constantly, trying to decide if I should go back to bed because folks know how to page me or if it makes more sense to just stay up. If I'm going to get paged in an hour anyway, might as well know what's going on.
smcl 5y ago
Any word on whether this affects Auth0? The company were bought by Okta last year but I don’t imagine they have consolidated everything yet so I’m hoping our Auth0 tenants are unaffected
bob778 5y ago
It appears they’ve had access since at least January. I wonder how many customer accounts have been breached? It’s a giant list of targets if so. It’s also very disappointing this is surfacing via tweets and not a breach notice from Okta, who apparently suspended at least one account used for entry.
- deleted 5y ago
  [deleted]
jms703 5y ago
Ugh. This is bad if true. Godspeed to incident response, enterprise security, and infrastructure teams. If you're not an Okta customer, you might want to tabletop this anyway.
- wingmanjd 5y ago
  Tomorrow is our "Armageddon Tabletop Exercise", which is bringing up our business from a complete datacenter failure. I don't envy the blue teams doing it for real.
  - bogomipz 5y ago
    Can you say more about what "bringing up" from complete failure entails? Do you have an HA backup DC that you fail over to or something else?
    - deleted 5y ago
      [deleted]
    - babelfish 5y ago
      Not OP, but at a previous company we were given access to a new AWS environment with nothing in it and were timed on how quickly we could get all of our services operational. Fleet teams went first, then networking, then T1 services (identity, platform, etc) and so on
      - lanstin 5y ago
        So roughly how long did it take? I participated in table exercises of that sort and couldn’t convincingly get less than two weeks. And not two fun weeks.
        wingmanjd 5y ago
        I suppose it all depends on how much infra needs to be stood up for the absolute necessities of the business to operate. Does the company need that internal ticketing system in place to process external client transactions? Probably not, but it'll need it eventually (so maybe that moves to 2nd tier restore process?). My company's RTO is 24hrs to processing new client transactions. Restoring old ones will definitely take longer, but at least new ones can proceed. If your own company's RTO is 2w, that sounds like a lot needs to be in place. Part of the business continuity/ disaster recovery is getting management to sign off on those types of numbers, big or small. Make sure they're realistic. You're right that this type of recovery is not fun. Bryan Cantrill gives a great presentation about managing an outage (https://www.youtube.com/watch?v=30jNsCVLpAE https://www.youtube.com/watch?v=30jNsCVLpAE). One of my biggest takeaways, if you're looking at a sweeping outage and a long haul of a recovery, do sleep management asap with your team. Dead tired people are more likely to make brain dead decisions.
jordigh 5y ago
Interesting point. Speculation that rootkitting all of your employees made the problem worse: https://twitter.com/BillDemirkapi/status/1506117152461496323 https://twitter.com/BillDemirkapi/status/1506117152461496323
- pm90 5y ago
  Honestly: fuck corporate security and leadership who kept pushing for spying on their workers with increasingly intrusive tools. I can’t remember how many times I argued with IT that MITMing SSL was not ok (there are some tools.. crowdstrike maybe? That do this). They made their bed, now they gotta sleep in it.
  - unethical_ban 5y ago
    It's always interesting to hear people think they have rights on corporate networks. It is a complex issue with entry of nuance I'm too tired to thumb type. I know there are lines that shouldn't be crossed. But it is so naive to think companies shouldn't have an eye on their data. Do you think banks shouldn't have cameras in their lobbies? Or that tellers can walk in and out of the vault with black bags and no one ask what's inside?
    - morbia 5y ago
      I don't think the OP's point was about rights as an individual on a corporate network, more about trying to backdoor your staff's equipment and the consequences of that. To use your camera analogy, you better have a good lock on the security room holding the tapes.
  - bitwize 5y ago
    MITMing SSL is also Zscaler's MO, and guess what my job is preparing to mandate. Organizational endpoint security seems to be much more about incident response than incident prevention. That is, it's more focused on providing a nice audit trail that can be used to find and fire/arrest the perp once a breach occurs than it is at preventing breaches from happening. It probably fills a due-diligence tickbox somewhere, allowing the company to say "if a breach occurs (the probability of which is always nonzero) then we have measures in place to find out how, where, and by whom and mitigate the damage" to shareholders and important customers.
gzer0 5y ago
And this explains how the LAPSUS hacker group was able to breach Microsoft, NVIDIA, and countless others. Apparently, they have been inside of OKTA systems for nearly 2 months now. [1] https://www.theregister.com/2022/03/21/microsoft_lapsus_breach_probe/ https://www.theregister.com/2022/03/21/microsoft_lapsus_brea... [2] https://www.wired.com/story/lapsus-hacking-group-extortion-nvidia-samsung/ https://www.wired.com/story/lapsus-hacking-group-extortion-n... [3] https://analyticsindiamag.com/lapsus-hack-leaves-nvidia-in-a-tight-spot/ https://analyticsindiamag.com/lapsus-hack-leaves-nvidia-in-a...
- technion 5y ago
  It would be confusing to me if Microsoft were utilising Okta themselves. Their own Azure offerings provide everything Okta does (and usually bundled into something you're already buying).
  - gzer0 5y ago
    Over the weekend, LAPSUS$ posted a screenshot to its Telegram channel of what appeared to be information taken from an internal developer account for Azure, its cloud computing division. https://gizmodo.com/microsoft-investigating-potential-lapsus-hack-1848680418 https://gizmodo.com/microsoft-investigating-potential-lapsus...
    - technion 5y ago
      Yes I've seen that, but I don't see how people are making the leap to assume that this Azure leak came through Okta.
      - staticassertion 5y ago
        I'd be kinda shocked to find that Okta isn't anywhere in Microsoft, just given acquisitions. But yeah, no evidence that it's directly related.
        5y ago
deleted 5y ago
[deleted]
bush-bby 5y ago
Maybe a stupid question but it seems very foolish to target fedramp companies? I mean why would this not attract the attention of some very effective 3 letter agencies? Granted it’s not technically supply chain, but the recent fed retaliation to darkside, etc. comes to mind.I just feel it’s phenomenally hubristic to brag on social media about penetrating fed ramp certified federal contractors…they are highly likely to be interacting with top secret level info.
- photon12 5y ago
  If you are operating from a jurisdiction that's already under heavy sanctions or severed diplomatic relations and extradition is unlikely, the laws of another country don't really matter.
  - bush-bby 5y ago
    I understand that, but I was thinking more in terms of retaliation. The sword cuts both ways. Haven’t the feds been bringing down the hammer on these sorts of groups lately?(by that I mean attacking back)
    - photon12 5y ago
      There have been some headlines about what you reference but I'm skeptical that work has amounted to anything lasting.
      - bush-bby 5y ago
        That’s fair, I guess I’m relatively skeptical as well. I’m just surprised it’s still worth the risk for these groups.
        photon12 5y ago
        It's worth noting we don't know what the true motive of any group that claims to be solely about ransomware and extortion actually is.
ro_bit 5y ago
Good luck to all the people putting out the fires from this one
deleted 5y ago
[deleted]
DitheringIdiot 5y ago
For people without twitter accounts: https://nitter.net/_MG_/status/1506109152665382920 https://nitter.net/_MG_/status/1506109152665382920
- unnouinceput 5y ago
  I don't have a twitter account, but I can read everything just fine. Sometime twitter is poping a "login to continue" crap, but by using zapper from uBlock Origin I just shed that crap away and I can continue scrolling.
  - technion 5y ago
    That seems to depend on how often you click such links, or something else I haven't thought of. I used to have your experience. Now I just get a person's profile pic and a logon prompt. If I uBlock zap that, there's nothing accessible behind it.
    - jiveturkey 5y ago
      Same. My theory is ... well I don't have a good theory on this. I think maybe links to a specific thread are not blocked. Links to a person (to just browse) get blocked.
    - unnouinceput 5y ago
      I should've mention that I also have NoScript and I am using Firefox, if that may of help to you. NoScript has google tag manager, google adsense and a few other stuff related to both google and amazon blocked always. As for how often I open twitter links, is as often as they make it to HN front page. So something along of one twitter link around every 2 days.
  - sundarurfriend 5y ago
    Apart from a guarantee of no such annoying popups, Nitter also always loads significantly faster than Twitter for me; and I much prefer its visual design for actually reading things, makes it much easier to focus on the content.
babelfish 5y ago
Okta response: “Authentication services company Okta Inc said on Tuesday it is investigating a report of a digital breach after hackers posted screenshots of what they claimed were its internal company environment.” https://www.reuters.com/article/okta-breach-idUSL2N2VP07B https://www.reuters.com/article/okta-breach-idUSL2N2VP07B
- lucasyvas 5y ago
  Ah yes, the "Oh fuck, just say we're looking into it" initial response.
  - wingmanjd 5y ago
    “Okta knew and didn’t disclose it for months AWS-style” and “Okta didn’t know” are both extremely terrifying. - Corey Quinn, https://twitter.com/QuinnyPig/status/1506120181839409159?t=yP7GZKRUjeBtdfBbBMJcsA https://twitter.com/QuinnyPig/status/1506120181839409159?t=y...
    - deleted 5y ago
      [deleted]
  - deleted 5y ago
    [deleted]
  - gurjeet 5y ago
    What else do you expect them to say? Put yourself in their shoes for a moment. It’s perfectly okay to not say anything prematurely that can cause any confusion; with the employees, customers, and media. All eyes are on them; it’s better not to screw up whatever little trust they have left.
  - YPPH 5y ago
    They are simply looking into it. Not offering unwarranted speculation or conjecture. Not providing any information that could assist attackers. And not being unreasonably dismissive, nor downplaying it. I really don't see the problem with their response. What would you propose in the circumstances?
paxys 5y ago
Godspeed all the corporate IT and security departments who are about to have a sleepless night. Surprisingly haven't heard a peep from Okta over an hour later. Wonder who is sweating more, their engineers or lawyers..
- paranoidrobot 5y ago
  Engineers. The lawyers might be sweating on their next round of bonuses, due to dealing with the fallout. But their jobs are not likely to be on the line.
  - twistedpair 5y ago
    Lawyers, especially external council, are about to have a windfall. Sweating? More like they're drooling.
aaron695 5y ago
Stop being lazy and go to LAPSUS$ release location for yourselves on Telegram - https://t.me/minsaudebr https://t.me/minsaudebr Why are people Nittering something they can view from source. This is why propaganda is so easy, it's what people want.
camwhite 5y ago
naïve question: Is there anything regular consumers can/should do in light of this information? Changing passwords etc seems futile if hackers have internal developer access anyway
- mrorbitman 5y ago
  is there an app that can send bulk gdpr data deletion requests for no-longer-used services? seems like it'd be possible write an app that scans email history to detect services that have your data, scrape their websites to determine support email address(es), and send a GDPR data deletion request template to each of the selected ones.
- paxys 5y ago
  I doubt too many people are using Okta as a regular consumer. If your work stuff uses it, the general advice has always been to keep it aggressively partitioned from your personal life. Hacked or not, your IT admin has always had access to everything, and I don't know if I'd trust them with my data any more than Lapsus$.
cfinnberg 5y ago
I didn't see anywhere,for those who have Telegram and want to see the claim, it's here: https://t.me/minsaudebr https://t.me/minsaudebr (Unfortunately web preview without Telegram seems to be not working right now)
9dev 5y ago
And this is why I would ultimately never trust a centralised company with our authentication infrastructure: because something like Okta is an infinitely more attractive target than we are. Their offering is sweet, and I’m always tempted to just give in, but this confirms me in my decision.
- njsubedi 5y ago
  +1 to this. Why outsource the most business-critical parts like auth and email to a third party, knowing that they're the biggest target? I know that the most common argument is "they know $service more than we do", but don't really have a counter argument against it.
  - staticassertion 5y ago
    Because auth is super hard? Have you tried implementing SSO for arbitrary OAuth2 providers?
    - 9dev 5y ago
      No, but there are both open source libraries, and complete authorisation servers. If you trust Okta, you can trust these, and embed them in your infrastructure. Auth only gets super hard if you try to be smart and deviate from best practices.
      - staticassertion 5y ago
        Can you link me to these open source libraries that will handle arbitrary oauth2 providers?
        m12k 5y ago
        This seems to be one of the more popular ones: https://www.keycloak.org/ https://www.keycloak.org/
taurath 5y ago
This is a really nasty breach of the supply chain given how many companies nowadays consider IT to be a cost center - even capable engineering orgs end up using Okta because the cost of building and maintaining your own SSO especially throughout an entire business is seen as not worth the cost. This is another situation where the cheaper option (buy-in SSO as a SaaS) can be worse simply because you're actually buying into an enormous attack surface.
- sdoering 5y ago
  I remember being told more often than I can count that it is nest to leave stuff like this to the experts who all day long do nothing else. Like actually being told that as reason to use Microsoft AD. Or the nobody is better dealing with spam than Google (when I was at a G Suite company). Or never to roll your own security library. All these were in the same ballpark and in some occasions the latter one was used to drive home the others. I am not sure what to do/say about it. I am not (by trade) an IT person but hopefully learned a bit in my time. Trying to understand how all the different tools on my corporate device work (together?) to enhance security is impossible to me. I can't name them but from anti virus, to compliance checking to additional compliance checking by VPN software to endpoint monitoring to remote install capabilities to windows management to remote desktop capabilities and many more. To me this sounds like too many potential attack vectors waiting to be exploited.
itsjloh 5y ago
Cloudflare CEO's response: https://twitter.com/eastdakota/status/1506143353544478724 https://twitter.com/eastdakota/status/1506143353544478724 (I'm aware he's often on here as well, hi eastdakota!)
- bpye 5y ago
  Would Cloudflare be a better auth provider? https://twitter.com/eastdakota/status/1506148082194386949 https://twitter.com/eastdakota/status/1506148082194386949
- ec109685 5y ago
  Interesting that a CloudFlare email address appears on one of the Okta screens leaked: https://twitter.com/BillDemirkapi/status/1506109956298317830/photo/1 https://twitter.com/BillDemirkapi/status/1506109956298317830...
different_sort 5y ago
The screenshots on the linked tweet make it look like okta dog foods their own product for access to various services and someone has access to one of their admin accounts. Which is bad, but that could mean “we phished this one person who works at okta” and not “we compromised okta and have unfettered access to their customers/valuable assets”. The news of the coming days may well prove me wrong, but i am not assuming the worst from this yet. Many companies whether or not they use an idaas do things like login anomalie detecting, and users coming in from weird locations and weird times of day would be sure to set of alarm bells at some of the big targets. Heck, AWS does it for customers with guard duty.
- tuwtuwtuwtuw 5y ago
  The breached account shown in screenshot belong to a user at a 3rd party outsourcing firm providing support services for Okta. So he is technically not an Okta employee. It seems strange that such a user would have wide access. It could be that his account was just used to gain further access, or it could be that his account had wide access by mistake. Or the user doesn't actually have that wide access. There are talks about superuser access. But is that referring to the user's actual privileges or the fact that he has access to the tool called "superuser" shown in the screenshots? I need more patience.
  - tyingq 5y ago
    The screenshot in question: https://twitter.com/BillDemirkapi/status/1506110405793492992 https://twitter.com/BillDemirkapi/status/1506110405793492992
supergirl 5y ago
why do the hackers disclose the hack though? why not keep it silent and abuse more seems pretty easy to hack a SaaS anyway. just need to phish an engineering employee account. often they have superuser access to debug customer issues
- itsjloh 5y ago
  One of the various twitter threads mentions that the account they used was suspended so perhaps they no longer have access.
  - tuwtuwtuwtuw 5y ago
    They (lapsus) also mentioned that the account was blocked in their "announcement" of this in telegram: > yes we know the URL has a email address. the account is suspended - we dont care
    - ec109685 5y ago
      Suspended, but then Okta doesn't tell the world they were breached isn't a great look.
      - tuwtuwtuwtuw 5y ago
        That is too early to say. It could be that his account was suspended because he left the job, changed job responsibilities or something else. Not saying this looks good and really not trying to defend Okta, but a user account being terminated isn't proof that Okta knew about it.
jaimex2 5y ago
Serious question looking at the Okta site. Does Gartner have any credibnility other than being a pay to be endorsed shill?
- ztjio 5y ago
  In October 2020 I did a deep analysis on commercially supported and/or hosted Kubernetes distributions and platforms (think Rancher, OpenShift, Tanzu, EKS, GKE, etc.) and after doing most of my analysis, a Gartner report found its way to me. It largely matched my results with some skewing for factors I don't consider as important, but, were clearly explained in the report. So, while I realize this is a small data point, it is one backed by quite a bit of data/analysis. Their report was well reasoned and accurate given the stated priors. I would say that their credibility is fine so long as you read the reports fully and not simply glance at their magic quadrant figures.
  - deleted 5y ago
    [deleted]
yewenjie 5y ago
Should end users be worried about password breach or something like that?
blinded 5y ago
wow, just imagine typing okta.okta.com all day.
maze-le 5y ago
Do you know a good alternative identity provider that I can run out-of-the box on my own servers/pods? I've used Okta quite extensively in the past and always recommended it to clients because: "They have more expertise around network security than your small team". I kind of regret this now... But I also don't want to implement my own IdP from scratch...
- red0point 5y ago
  Keycloak is pretty standard for this. https://www.keycloak.org/ https://www.keycloak.org/
- Loic 5y ago
  At the moment I am exploring Caddy Security[0]. I was surprised how simple and elegant the design is. But it is a relatively young project. If some people are using it, I would enjoy their feedback. [0]: https://github.com/greenpau/caddy-security https://github.com/greenpau/caddy-security
- geektips 5y ago
  "supertokens" is an option. https://supertokens.com/ https://supertokens.com/
  - advaitruia 5y ago
    Founder here, happy to answer any questions! There is a lot of conversation here about building your own vs using something 'centralized'. All software comes with the “build vs buy” tradeoff. Our goal at SuperTokens is to minimise those tradeoffs and give you the best of both worlds. That is - The power of build and the speed of buy. You can migrate to and from a completely self hosted solution to a managed service as your needs change
  - kailanb 5y ago
    Forgive me if I'm misunderstanding, but this looks like an end-user authentication system that you would implement in your own app rather than a corporate directory like Okta. Different use cases.
nstart 5y ago
For people wondering about how they get access to these systems, it feels like they use the weakest human link in the chain. I checked their telegram group and I can see that they specifically recruit people with access to VPNs/internal support systems. This okta breach seems to have happened through similar means. The group has made specific calls for access to gaming companies, hosting providers, telcos, call centers, and bpm providers. They offer payment. It doesn’t feel difficult to see how some overworked, underpaid support agent (or even a well paid disgruntled one) might decide to go with this. Just takes 1 well placed agent to give creds and this group has access to a huge attack surface instantly. This might sound like an overreaction, but corporations in the future might need to make least privilege access and access logging everything a priority from day 1. https://t.me/minsaudebr/162 https://t.me/minsaudebr/162 (Link to the recruitment message)
- zacmps 5y ago
  I wonder if it would be possible to counter this with policy, something like: > If you receive a credible bribe and report it immediately to X we will report to relevant authorities and provide a bonus equal to the value of the bribe (capped at Y).
  - numpad0 5y ago
    Sadly a whistleblower protection becomes an organized victim blaming too fast and easily
  - sfe22 5y ago
    This assumes money is the only factor and motivation.
    - jjav 5y ago
      > This assumes money is the only factor and motivation. Only if you assert that it is only useful if it solves 100% of the cases. There are other motivations, but money is a big one. If you could block X% for a large value of X (I'd say easily > 50) then you're better off than before, even if some insiders driven by other motivations still remain.
belter 5y ago
https://nitter.net/_MG_/status/1506109152665382920 https://nitter.net/_MG_/status/1506109152665382920
watersb 5y ago
Can someone please explain what Okta is all about? I had never heard of it. It's an auth/ID service provider for many of the things I have heard about, I guess. For internal IT systems? Or for customer (public-facing) auth?
- bawolff 5y ago
  Its basically corporate single sign on and auth management. Its very popular in the corporate space, but you are unlikely to see it as an ordinary consumer.
  - tyingq 5y ago
    >but you are unlikely to see it as an ordinary consumer They have plenty of business customers using it for auth to their external public customers. You can see MGM resorts, Major League Baseball, Albertson's Groceries, etc, here: https://www.okta.com/customers/ https://www.okta.com/customers/
th3iedkid 5y ago
I would expect super admins to be able to cut or set authorisation access but not actually control that. In which case, wouldn’t super admin hijack just amount to DoSing 3rd party systems, rather than compromise?
account-5 5y ago
I've never used this type of service before, single sign on. And consequently have a lack of knowledge in this area. Is auth0 susceptible to the same sort of thing happening? My reasons for avoiding any online, managed by random company, type of service like this is for the risk of a single point of failure demonstrated in this attack.
- smcl 5y ago
  We are on Auth0 (recently acquired by Okta) and are trying to find the same thing. It could be that it's still too soon for them to have started consolidating, but we'll really have to wait and see what Okta say.
  - account-5 5y ago
    I did not know okta had acquired auth0. What alternatives are there in this space?
sydthrowaway 5y ago
COVID, Russian war, Cyber criminal gangs, this world just keeps getting worse.
- twistedpair 5y ago
  I think there's a fair amount of correlation here, rather than random events. CISA has been warning everyone to gird for attack for months now.
- nickmyersdt 5y ago
  Whilst the names may change, there have always been threats and attacks on democracy, wealth, welfare and sovereignty for as long as history records. Typically with the aim of shifting power from one group to another. The world isn't getting worse, we just hear a lot more about what's going on. People are as selfish and power/money hungry as they've always been. Humans haven't changed, there's just a lot more of us each day. We're a long way from global peace and economic and environmental harmony but I feel like there are a lot of people who want to try. More people than ever before and with the Internet providing means of rapid, global communication and coordination those voices are reaching further. If we can replace capitalism with something sustainable that brings peace and equality to all, perhaps then the world will start to be a better place (but will we ever rid ourselves of the selfishness that means some people want to be more equal than others).
cookiengineer 5y ago
My guess is that the attack path is probably some externally hired SOC that was working for Okta. Big corporates usually think it's a wise business decision to hire external cyber security people, with full-blown admin access to everything. Because, technically speaking, Okta advertises with their SOC II / ISO27001 / ISO27017 / ISO27018 compliance certificates [1] and [2]; which means there has to be an incident response system that would've caught this. Well, either that, or the ones that manage the incident response system are the mischiefs themselves. [1] https://trust.okta.com/compliance/ https://trust.okta.com/compliance/ and https://archive.ph/654MX https://archive.ph/654MX [2] https://www.schellman.com/certificate-directory https://www.schellman.com/certificate-directory -> search for Certificate No. "1106074-8"
nstart 5y ago
Okta's CEO just released a statement. And it's very tiny. Unsure what to make of this. Waiting to see LAPSUS$ response > In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor. (1 of 2) > We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2) https://twitter.com/toddmckinnon/status/1506184721922859010 https://twitter.com/toddmckinnon/status/1506184721922859010
- hericium 5y ago
  Oh, this absolutely looks like "an attempt". I'm sure investors are calmed by this tweet. Nothing to see here, move along.
  - twistedpair 5y ago
    Pre-market trading is already -9% (was -14.5% before that tweet).
- chillfox 5y ago
  So, they covered it up in January and now wants us to believe that this is not yet another attempt at covering it up. Up until that statement I was willing to believe that they only just found out about it.
  - open-source-ux 5y ago
    Had the same thought. A security breach in January, and only now are the details of the breach are revealed (by someone not related to Okta). In other words, Okta would never have revealed the security lapse until this leak. One can only imagine the many security breaches that are never revealed (from any company).
    - tyingq 5y ago
Shank 5y ago
Matthew Prince (CEO, Cloudflare): > Can anyone who’s gotten a satisfactory answer to #Log4J #Log4Shell from @Okta raise their hand? We certainly haven’t. #rottenfishstinks https://twitter.com/eastdakota/status/1506168088831569921 https://twitter.com/eastdakota/status/1506168088831569921
alecco 5y ago
How is this not number one story? The points and age are clearly superior to the 6 stories above and it's an important and scary development. Who is flagging this down? @dang? https://www.crunchbase.com/organization/okta https://www.crunchbase.com/organization/okta
- OJFord 5y ago
  It was earlier, it must just be losing steam compared to the more rapidly rising ones above it, no conspiracy.
  - alecco 5y ago
    10. Librem 5: First Impressions (incoherency.co.uk) 262 points by jstanley 13 hours ago | flag | hide | 162 comments 11. Hackers claim to have breached Okta systems (twitter.com/_mg_) 824 points by obi1kenobi 9 hours ago | flag | hide | 280 comments There is no way to justify this. This smells of yet another mass flagging by interested parties and/or their network of friends. Or something worse.
    - xeromal 5y ago
      99% of the time people claim conspiracy on hackernews, it's their own bias.
spacemanmatt 5y ago
Running my own auth server is hard but has taken WAY less time to pay out than I ever anticipated.
thelittleone 5y ago
Outsourcing auth like this just makes too valuable a target.
jrib 5y ago
CEO's reply: > In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor. (1 of 2) > We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2) https://nitter.net/toddmckinnon/status/1506184721922859010 https://nitter.net/toddmckinnon/status/1506184721922859010
teddyh 5y ago
Torrent (allegedly) here: https://sizeof.cat/post/okta-customers-leak/ https://sizeof.cat/post/okta-customers-leak/
sabujp 5y ago
okta claims there was no breach, nothing to see here folks, move along : https://www.cnbc.com/2022/03/22/okta-breach-company-says-it-has-found-no-evidence-of-new-attack.html https://www.cnbc.com/2022/03/22/okta-breach-company-says-it-...
- mwid 5y ago
  This article does not include Okta's statement claiming they had not been breached. Regardless, their statement was a legal word-soup that bounced around the issue. The Lapsus$ team responded to it and said they could reset the passwords and MFA of over 95% of Okta customers which would mean they could get into any account, and thus any service, they wanted, though obviously they would be noticed pretty soon after. This is both sides claiming things without any evidence, mind you, so take it with as many grains of salt as you need.
thricegr8 5y ago
What's really concerning is if this turns out to be true, Okta has, at a minimum 26k (yes), customers right now. A simple enumeration of subdomains reveals this. I've put them here in a paste: https://ghostbin.com/K7tIA https://ghostbin.com/K7tIA
- frays 5y ago
  How can you tell that these subdomains are legitimate? Any URL *.okta.com resolves and loads an Okta login screen but doesn't mean it's an actual customer. For example, https://fake-ycombinator.okta.com https://fake-ycombinator.okta.com works and shows the same login screen as https://pets.okta.com/ https://pets.okta.com/. But only the latter is on the list, how do you know it's a legitimate customer?
  - xeromal 5y ago
    Not saying that their process is right, but I searched for 3 small companies that I know are running with Okta and found them in this list.
- twistedpair 5y ago
  Wildcard domain much?
  - thricegr8 5y ago
    I was wrong on this. See my comment above. I thought inspecting the certificate would be enough to tell you? I don't see the blob in any cert details. Where did I error?
  - deleted 5y ago
    [deleted]
- thricegr8 5y ago
  Ah yes, perhaps a bit more due diligence was required. Can someone help me out then here? I checked the domain here: https://phonebook.cz/ https://phonebook.cz/, but manually inspecting the certificate, I don't see the * in front of okta.com to denote a wildcard domain is in use(*.okta.com). What am I missing?

1158 points by obi1kenobi 5y ago

With all those recent news of compromises done by Lapsus$, i really wonder what they're doing "differently" to the rest - do they have an especially large arsenal of exploits or is everything compromised anyways and one just doesn't read about it in the public because no one knows...

tyingq 5y ago
One theory is that they are based in South America, and have working knowledge of all the outsourced support that's gone to Brazil, Chile, Argentina, Costa Rica, etc. So they are well positioned for social engineering those workers, how the support systems generally work, etc.
pm90 5y ago
The latter. Businesses love to outsource and with technology there are just so many leaky pipes everywhere built by whoever could build them cheapest.

unclekev 5y ago

Wonder how long it will take Okta to say something. I bet a lot of IntoSec departments are stressing right now because of this tweet.

Johnny555 5y ago
https://www.usnews.com/news/technology/articles/2022-03-22/authentication-services-firm-okta-says-it-is-investigating-report-of-breach https://www.usnews.com/news/technology/articles/2022-03-22/a... WASHINGTON (Reuters) - Authentication services company Okta Inc said on Tuesday it is investigating a report of a digital breach after hackers posted screenshots of what they claimed were its internal company environment. A hack at Okta could have potential major consequences because thousands of other companies rely on the San Francisco-based firm to manage access to their own networks and applications. The screenshots were posted by a group of ransom-seeking hackers known as LAPSUS$ on their Telegram channel late on Monday.
- unclekev 5y ago
  I saw this, but where is the actual statement? > Authentication services company Okta Inc said on Tuesday Where? What did they say? To who? The person writing the article?
  - Johnny555 5y ago
    It's a developing story, click back to the article and there are more details now, including the name of the Okta official that made the statement: WASHINGTON (Reuters) -Authentication services provider Okta Inc is investigating a report of a digital breach, the company said on Tuesday, after hackers posted screenshots showing what they claimed was its internal company environment. A hack at Okta could have major consequences because thousands of other companies rely on the San Francisco-based firm to manage access to their own networks and applications. The company was aware of the reports and was investigating, Okta official Chris Hollis said in a brief statement. "We will provide updates as more information becomes available," he added. The screenshots were posted by a group of ransom-seeking hackers known as LAPSUS$ on their Telegram channel late on Monday. In an accompanying message, the group said its focus was "ONLY on Okta customers." Security experts told Reuters the screenshots appeared to be authentic. "I definitely do believe it is credible," said independent security researcher Bill Demirkapi, citing pictures of what appeared to be Okta's internal tickets and its in-house chat on the Slack messaging app. Dan Tentler, the founder of cybersecurity consultancy Phobos Group, said he too believed the breach was real and urged Okta customers to be "very vigilant right now." In an email, Tentler added, "There are timestamps and dates visible in the screenshots indicating January 21st of this year, which suggests they may have had access for two months."
fyzllgig 5y ago
Can confirm. I had just tucked into bed when this tweet got shared with me. Now, in the "is it real or not" stage I'm refreshing constantly, trying to decide if I should go back to bed because folks know how to page me or if it makes more sense to just stay up. If I'm going to get paged in an hour anyway, might as well know what's going on.

smcl 5y ago

Any word on whether this affects Auth0? The company were bought by Okta last year but I don’t imagine they have consolidated everything yet so I’m hoping our Auth0 tenants are unaffected

bob778 5y ago

It appears they’ve had access since at least January. I wonder how many customer accounts have been breached? It’s a giant list of targets if so. It’s also very disappointing this is surfacing via tweets and not a breach notice from Okta, who apparently suspended at least one account used for entry.

deleted 5y ago
[deleted]

jms703 5y ago

Ugh. This is bad if true. Godspeed to incident response, enterprise security, and infrastructure teams. If you're not an Okta customer, you might want to tabletop this anyway.

wingmanjd 5y ago
Tomorrow is our "Armageddon Tabletop Exercise", which is bringing up our business from a complete datacenter failure. I don't envy the blue teams doing it for real.
- bogomipz 5y ago
  Can you say more about what "bringing up" from complete failure entails? Do you have an HA backup DC that you fail over to or something else?
  - deleted 5y ago
    [deleted]
  - babelfish 5y ago
    Not OP, but at a previous company we were given access to a new AWS environment with nothing in it and were timed on how quickly we could get all of our services operational. Fleet teams went first, then networking, then T1 services (identity, platform, etc) and so on
    - lanstin 5y ago
      So roughly how long did it take? I participated in table exercises of that sort and couldn’t convincingly get less than two weeks. And not two fun weeks.
      - wingmanjd 5y ago
        I suppose it all depends on how much infra needs to be stood up for the absolute necessities of the business to operate. Does the company need that internal ticketing system in place to process external client transactions? Probably not, but it'll need it eventually (so maybe that moves to 2nd tier restore process?). My company's RTO is 24hrs to processing new client transactions. Restoring old ones will definitely take longer, but at least new ones can proceed. If your own company's RTO is 2w, that sounds like a lot needs to be in place. Part of the business continuity/ disaster recovery is getting management to sign off on those types of numbers, big or small. Make sure they're realistic. You're right that this type of recovery is not fun. Bryan Cantrill gives a great presentation about managing an outage (https://www.youtube.com/watch?v=30jNsCVLpAE https://www.youtube.com/watch?v=30jNsCVLpAE). One of my biggest takeaways, if you're looking at a sweeping outage and a long haul of a recovery, do sleep management asap with your team. Dead tired people are more likely to make brain dead decisions.

jordigh 5y ago

Interesting point. Speculation that rootkitting all of your employees made the problem worse: https://twitter.com/BillDemirkapi/status/1506117152461496323 https://twitter.com/BillDemirkapi/status/1506117152461496323

pm90 5y ago
Honestly: fuck corporate security and leadership who kept pushing for spying on their workers with increasingly intrusive tools. I can’t remember how many times I argued with IT that MITMing SSL was not ok (there are some tools.. crowdstrike maybe? That do this). They made their bed, now they gotta sleep in it.
- unethical_ban 5y ago
  It's always interesting to hear people think they have rights on corporate networks. It is a complex issue with entry of nuance I'm too tired to thumb type. I know there are lines that shouldn't be crossed. But it is so naive to think companies shouldn't have an eye on their data. Do you think banks shouldn't have cameras in their lobbies? Or that tellers can walk in and out of the vault with black bags and no one ask what's inside?
  - morbia 5y ago
    I don't think the OP's point was about rights as an individual on a corporate network, more about trying to backdoor your staff's equipment and the consequences of that. To use your camera analogy, you better have a good lock on the security room holding the tapes.
- bitwize 5y ago
  MITMing SSL is also Zscaler's MO, and guess what my job is preparing to mandate. Organizational endpoint security seems to be much more about incident response than incident prevention. That is, it's more focused on providing a nice audit trail that can be used to find and fire/arrest the perp once a breach occurs than it is at preventing breaches from happening. It probably fills a due-diligence tickbox somewhere, allowing the company to say "if a breach occurs (the probability of which is always nonzero) then we have measures in place to find out how, where, and by whom and mitigate the damage" to shareholders and important customers.

gzer0 5y ago

And this explains how the LAPSUS hacker group was able to breach Microsoft, NVIDIA, and countless others. Apparently, they have been inside of OKTA systems for nearly 2 months now. [1] https://www.theregister.com/2022/03/21/microsoft_lapsus_breach_probe/ https://www.theregister.com/2022/03/21/microsoft_lapsus_brea... [2] https://www.wired.com/story/lapsus-hacking-group-extortion-nvidia-samsung/ https://www.wired.com/story/lapsus-hacking-group-extortion-n... [3] https://analyticsindiamag.com/lapsus-hack-leaves-nvidia-in-a-tight-spot/ https://analyticsindiamag.com/lapsus-hack-leaves-nvidia-in-a...

technion 5y ago
It would be confusing to me if Microsoft were utilising Okta themselves. Their own Azure offerings provide everything Okta does (and usually bundled into something you're already buying).
- gzer0 5y ago
  Over the weekend, LAPSUS$ posted a screenshot to its Telegram channel of what appeared to be information taken from an internal developer account for Azure, its cloud computing division. https://gizmodo.com/microsoft-investigating-potential-lapsus-hack-1848680418 https://gizmodo.com/microsoft-investigating-potential-lapsus...
  - technion 5y ago
    Yes I've seen that, but I don't see how people are making the leap to assume that this Azure leak came through Okta.
    - staticassertion 5y ago
      I'd be kinda shocked to find that Okta isn't anywhere in Microsoft, just given acquisitions. But yeah, no evidence that it's directly related.
      - 5y ago

deleted 5y ago

[deleted]

bush-bby 5y ago

Maybe a stupid question but it seems very foolish to target fedramp companies? I mean why would this not attract the attention of some very effective 3 letter agencies? Granted it’s not technically supply chain, but the recent fed retaliation to darkside, etc. comes to mind.I just feel it’s phenomenally hubristic to brag on social media about penetrating fed ramp certified federal contractors…they are highly likely to be interacting with top secret level info.

photon12 5y ago
If you are operating from a jurisdiction that's already under heavy sanctions or severed diplomatic relations and extradition is unlikely, the laws of another country don't really matter.
- bush-bby 5y ago
  I understand that, but I was thinking more in terms of retaliation. The sword cuts both ways. Haven’t the feds been bringing down the hammer on these sorts of groups lately?(by that I mean attacking back)
  - photon12 5y ago
    There have been some headlines about what you reference but I'm skeptical that work has amounted to anything lasting.
    - bush-bby 5y ago
      That’s fair, I guess I’m relatively skeptical as well. I’m just surprised it’s still worth the risk for these groups.
      - photon12 5y ago
        It's worth noting we don't know what the true motive of any group that claims to be solely about ransomware and extortion actually is.

ro_bit 5y ago

Good luck to all the people putting out the fires from this one

deleted 5y ago

[deleted]

DitheringIdiot 5y ago

For people without twitter accounts: https://nitter.net/_MG_/status/1506109152665382920 https://nitter.net/_MG_/status/1506109152665382920

unnouinceput 5y ago
I don't have a twitter account, but I can read everything just fine. Sometime twitter is poping a "login to continue" crap, but by using zapper from uBlock Origin I just shed that crap away and I can continue scrolling.
- technion 5y ago
  That seems to depend on how often you click such links, or something else I haven't thought of. I used to have your experience. Now I just get a person's profile pic and a logon prompt. If I uBlock zap that, there's nothing accessible behind it.
  - jiveturkey 5y ago
    Same. My theory is ... well I don't have a good theory on this. I think maybe links to a specific thread are not blocked. Links to a person (to just browse) get blocked.
  - unnouinceput 5y ago
    I should've mention that I also have NoScript and I am using Firefox, if that may of help to you. NoScript has google tag manager, google adsense and a few other stuff related to both google and amazon blocked always. As for how often I open twitter links, is as often as they make it to HN front page. So something along of one twitter link around every 2 days.
- sundarurfriend 5y ago
  Apart from a guarantee of no such annoying popups, Nitter also always loads significantly faster than Twitter for me; and I much prefer its visual design for actually reading things, makes it much easier to focus on the content.

babelfish 5y ago

Okta response: “Authentication services company Okta Inc said on Tuesday it is investigating a report of a digital breach after hackers posted screenshots of what they claimed were its internal company environment.” https://www.reuters.com/article/okta-breach-idUSL2N2VP07B https://www.reuters.com/article/okta-breach-idUSL2N2VP07B

lucasyvas 5y ago
Ah yes, the "Oh fuck, just say we're looking into it" initial response.
- wingmanjd 5y ago
  “Okta knew and didn’t disclose it for months AWS-style” and “Okta didn’t know” are both extremely terrifying. - Corey Quinn, https://twitter.com/QuinnyPig/status/1506120181839409159?t=yP7GZKRUjeBtdfBbBMJcsA https://twitter.com/QuinnyPig/status/1506120181839409159?t=y...
  - deleted 5y ago
    [deleted]
- deleted 5y ago
  [deleted]
- gurjeet 5y ago
  What else do you expect them to say? Put yourself in their shoes for a moment. It’s perfectly okay to not say anything prematurely that can cause any confusion; with the employees, customers, and media. All eyes are on them; it’s better not to screw up whatever little trust they have left.
- YPPH 5y ago
  They are simply looking into it. Not offering unwarranted speculation or conjecture. Not providing any information that could assist attackers. And not being unreasonably dismissive, nor downplaying it. I really don't see the problem with their response. What would you propose in the circumstances?

paxys 5y ago

Godspeed all the corporate IT and security departments who are about to have a sleepless night. Surprisingly haven't heard a peep from Okta over an hour later. Wonder who is sweating more, their engineers or lawyers..

paranoidrobot 5y ago
Engineers. The lawyers might be sweating on their next round of bonuses, due to dealing with the fallout. But their jobs are not likely to be on the line.
- twistedpair 5y ago
  Lawyers, especially external council, are about to have a windfall. Sweating? More like they're drooling.

aaron695 5y ago

Stop being lazy and go to LAPSUS$ release location for yourselves on Telegram - https://t.me/minsaudebr https://t.me/minsaudebr Why are people Nittering something they can view from source. This is why propaganda is so easy, it's what people want.

camwhite 5y ago

naïve question: Is there anything regular consumers can/should do in light of this information? Changing passwords etc seems futile if hackers have internal developer access anyway

mrorbitman 5y ago
is there an app that can send bulk gdpr data deletion requests for no-longer-used services? seems like it'd be possible write an app that scans email history to detect services that have your data, scrape their websites to determine support email address(es), and send a GDPR data deletion request template to each of the selected ones.
paxys 5y ago
I doubt too many people are using Okta as a regular consumer. If your work stuff uses it, the general advice has always been to keep it aggressively partitioned from your personal life. Hacked or not, your IT admin has always had access to everything, and I don't know if I'd trust them with my data any more than Lapsus$.

cfinnberg 5y ago

I didn't see anywhere,for those who have Telegram and want to see the claim, it's here: https://t.me/minsaudebr https://t.me/minsaudebr (Unfortunately web preview without Telegram seems to be not working right now)

9dev 5y ago

And this is why I would ultimately never trust a centralised company with our authentication infrastructure: because something like Okta is an infinitely more attractive target than we are. Their offering is sweet, and I’m always tempted to just give in, but this confirms me in my decision.

njsubedi 5y ago
+1 to this. Why outsource the most business-critical parts like auth and email to a third party, knowing that they're the biggest target? I know that the most common argument is "they know $service more than we do", but don't really have a counter argument against it.
- staticassertion 5y ago
  Because auth is super hard? Have you tried implementing SSO for arbitrary OAuth2 providers?
  - 9dev 5y ago
    No, but there are both open source libraries, and complete authorisation servers. If you trust Okta, you can trust these, and embed them in your infrastructure. Auth only gets super hard if you try to be smart and deviate from best practices.
    - staticassertion 5y ago
      Can you link me to these open source libraries that will handle arbitrary oauth2 providers?
      - m12k 5y ago
        This seems to be one of the more popular ones: https://www.keycloak.org/ https://www.keycloak.org/

taurath 5y ago

This is a really nasty breach of the supply chain given how many companies nowadays consider IT to be a cost center - even capable engineering orgs end up using Okta because the cost of building and maintaining your own SSO especially throughout an entire business is seen as not worth the cost. This is another situation where the cheaper option (buy-in SSO as a SaaS) can be worse simply because you're actually buying into an enormous attack surface.

sdoering 5y ago
I remember being told more often than I can count that it is nest to leave stuff like this to the experts who all day long do nothing else. Like actually being told that as reason to use Microsoft AD. Or the nobody is better dealing with spam than Google (when I was at a G Suite company). Or never to roll your own security library. All these were in the same ballpark and in some occasions the latter one was used to drive home the others. I am not sure what to do/say about it. I am not (by trade) an IT person but hopefully learned a bit in my time. Trying to understand how all the different tools on my corporate device work (together?) to enhance security is impossible to me. I can't name them but from anti virus, to compliance checking to additional compliance checking by VPN software to endpoint monitoring to remote install capabilities to windows management to remote desktop capabilities and many more. To me this sounds like too many potential attack vectors waiting to be exploited.

itsjloh 5y ago

Cloudflare CEO's response: https://twitter.com/eastdakota/status/1506143353544478724 https://twitter.com/eastdakota/status/1506143353544478724 (I'm aware he's often on here as well, hi eastdakota!)

bpye 5y ago
Would Cloudflare be a better auth provider? https://twitter.com/eastdakota/status/1506148082194386949 https://twitter.com/eastdakota/status/1506148082194386949
ec109685 5y ago
Interesting that a CloudFlare email address appears on one of the Okta screens leaked: https://twitter.com/BillDemirkapi/status/1506109956298317830/photo/1 https://twitter.com/BillDemirkapi/status/1506109956298317830...

different_sort 5y ago

The screenshots on the linked tweet make it look like okta dog foods their own product for access to various services and someone has access to one of their admin accounts. Which is bad, but that could mean “we phished this one person who works at okta” and not “we compromised okta and have unfettered access to their customers/valuable assets”. The news of the coming days may well prove me wrong, but i am not assuming the worst from this yet. Many companies whether or not they use an idaas do things like login anomalie detecting, and users coming in from weird locations and weird times of day would be sure to set of alarm bells at some of the big targets. Heck, AWS does it for customers with guard duty.

tuwtuwtuwtuw 5y ago
The breached account shown in screenshot belong to a user at a 3rd party outsourcing firm providing support services for Okta. So he is technically not an Okta employee. It seems strange that such a user would have wide access. It could be that his account was just used to gain further access, or it could be that his account had wide access by mistake. Or the user doesn't actually have that wide access. There are talks about superuser access. But is that referring to the user's actual privileges or the fact that he has access to the tool called "superuser" shown in the screenshots? I need more patience.
- tyingq 5y ago
  The screenshot in question: https://twitter.com/BillDemirkapi/status/1506110405793492992 https://twitter.com/BillDemirkapi/status/1506110405793492992

supergirl 5y ago

why do the hackers disclose the hack though? why not keep it silent and abuse more seems pretty easy to hack a SaaS anyway. just need to phish an engineering employee account. often they have superuser access to debug customer issues

itsjloh 5y ago
One of the various twitter threads mentions that the account they used was suspended so perhaps they no longer have access.
- tuwtuwtuwtuw 5y ago
  They (lapsus) also mentioned that the account was blocked in their "announcement" of this in telegram: > yes we know the URL has a email address. the account is suspended - we dont care
  - ec109685 5y ago
    Suspended, but then Okta doesn't tell the world they were breached isn't a great look.
    - tuwtuwtuwtuw 5y ago
      That is too early to say. It could be that his account was suspended because he left the job, changed job responsibilities or something else. Not saying this looks good and really not trying to defend Okta, but a user account being terminated isn't proof that Okta knew about it.

jaimex2 5y ago

Serious question looking at the Okta site. Does Gartner have any credibnility other than being a pay to be endorsed shill?

ztjio 5y ago
In October 2020 I did a deep analysis on commercially supported and/or hosted Kubernetes distributions and platforms (think Rancher, OpenShift, Tanzu, EKS, GKE, etc.) and after doing most of my analysis, a Gartner report found its way to me. It largely matched my results with some skewing for factors I don't consider as important, but, were clearly explained in the report. So, while I realize this is a small data point, it is one backed by quite a bit of data/analysis. Their report was well reasoned and accurate given the stated priors. I would say that their credibility is fine so long as you read the reports fully and not simply glance at their magic quadrant figures.
- deleted 5y ago
  [deleted]

yewenjie 5y ago

Should end users be worried about password breach or something like that?

blinded 5y ago

wow, just imagine typing okta.okta.com all day.

maze-le 5y ago

Do you know a good alternative identity provider that I can run out-of-the box on my own servers/pods? I've used Okta quite extensively in the past and always recommended it to clients because: "They have more expertise around network security than your small team". I kind of regret this now... But I also don't want to implement my own IdP from scratch...

red0point 5y ago
Keycloak is pretty standard for this. https://www.keycloak.org/ https://www.keycloak.org/
Loic 5y ago
At the moment I am exploring Caddy Security[0]. I was surprised how simple and elegant the design is. But it is a relatively young project. If some people are using it, I would enjoy their feedback. [0]: https://github.com/greenpau/caddy-security https://github.com/greenpau/caddy-security
geektips 5y ago
"supertokens" is an option. https://supertokens.com/ https://supertokens.com/
- advaitruia 5y ago
  Founder here, happy to answer any questions! There is a lot of conversation here about building your own vs using something 'centralized'. All software comes with the “build vs buy” tradeoff. Our goal at SuperTokens is to minimise those tradeoffs and give you the best of both worlds. That is - The power of build and the speed of buy. You can migrate to and from a completely self hosted solution to a managed service as your needs change
- kailanb 5y ago
  Forgive me if I'm misunderstanding, but this looks like an end-user authentication system that you would implement in your own app rather than a corporate directory like Okta. Different use cases.

nstart 5y ago

For people wondering about how they get access to these systems, it feels like they use the weakest human link in the chain. I checked their telegram group and I can see that they specifically recruit people with access to VPNs/internal support systems. This okta breach seems to have happened through similar means. The group has made specific calls for access to gaming companies, hosting providers, telcos, call centers, and bpm providers. They offer payment. It doesn’t feel difficult to see how some overworked, underpaid support agent (or even a well paid disgruntled one) might decide to go with this. Just takes 1 well placed agent to give creds and this group has access to a huge attack surface instantly. This might sound like an overreaction, but corporations in the future might need to make least privilege access and access logging everything a priority from day 1. https://t.me/minsaudebr/162 https://t.me/minsaudebr/162 (Link to the recruitment message)

zacmps 5y ago
I wonder if it would be possible to counter this with policy, something like: > If you receive a credible bribe and report it immediately to X we will report to relevant authorities and provide a bonus equal to the value of the bribe (capped at Y).
- numpad0 5y ago
  Sadly a whistleblower protection becomes an organized victim blaming too fast and easily
- sfe22 5y ago
  This assumes money is the only factor and motivation.
  - jjav 5y ago
    > This assumes money is the only factor and motivation. Only if you assert that it is only useful if it solves 100% of the cases. There are other motivations, but money is a big one. If you could block X% for a large value of X (I'd say easily > 50) then you're better off than before, even if some insiders driven by other motivations still remain.

belter 5y ago

https://nitter.net/_MG_/status/1506109152665382920 https://nitter.net/_MG_/status/1506109152665382920

watersb 5y ago

Can someone please explain what Okta is all about? I had never heard of it. It's an auth/ID service provider for many of the things I have heard about, I guess. For internal IT systems? Or for customer (public-facing) auth?

bawolff 5y ago
Its basically corporate single sign on and auth management. Its very popular in the corporate space, but you are unlikely to see it as an ordinary consumer.
- tyingq 5y ago
  >but you are unlikely to see it as an ordinary consumer They have plenty of business customers using it for auth to their external public customers. You can see MGM resorts, Major League Baseball, Albertson's Groceries, etc, here: https://www.okta.com/customers/ https://www.okta.com/customers/

th3iedkid 5y ago

I would expect super admins to be able to cut or set authorisation access but not actually control that. In which case, wouldn’t super admin hijack just amount to DoSing 3rd party systems, rather than compromise?

account-5 5y ago

I've never used this type of service before, single sign on. And consequently have a lack of knowledge in this area. Is auth0 susceptible to the same sort of thing happening? My reasons for avoiding any online, managed by random company, type of service like this is for the risk of a single point of failure demonstrated in this attack.

smcl 5y ago
We are on Auth0 (recently acquired by Okta) and are trying to find the same thing. It could be that it's still too soon for them to have started consolidating, but we'll really have to wait and see what Okta say.
- account-5 5y ago
  I did not know okta had acquired auth0. What alternatives are there in this space?

sydthrowaway 5y ago

COVID, Russian war, Cyber criminal gangs, this world just keeps getting worse.

twistedpair 5y ago
I think there's a fair amount of correlation here, rather than random events. CISA has been warning everyone to gird for attack for months now.
nickmyersdt 5y ago
Whilst the names may change, there have always been threats and attacks on democracy, wealth, welfare and sovereignty for as long as history records. Typically with the aim of shifting power from one group to another. The world isn't getting worse, we just hear a lot more about what's going on. People are as selfish and power/money hungry as they've always been. Humans haven't changed, there's just a lot more of us each day. We're a long way from global peace and economic and environmental harmony but I feel like there are a lot of people who want to try. More people than ever before and with the Internet providing means of rapid, global communication and coordination those voices are reaching further. If we can replace capitalism with something sustainable that brings peace and equality to all, perhaps then the world will start to be a better place (but will we ever rid ourselves of the selfishness that means some people want to be more equal than others).

cookiengineer 5y ago

My guess is that the attack path is probably some externally hired SOC that was working for Okta. Big corporates usually think it's a wise business decision to hire external cyber security people, with full-blown admin access to everything. Because, technically speaking, Okta advertises with their SOC II / ISO27001 / ISO27017 / ISO27018 compliance certificates [1] and [2]; which means there has to be an incident response system that would've caught this. Well, either that, or the ones that manage the incident response system are the mischiefs themselves. [1] https://trust.okta.com/compliance/ https://trust.okta.com/compliance/ and https://archive.ph/654MX https://archive.ph/654MX [2] https://www.schellman.com/certificate-directory https://www.schellman.com/certificate-directory -> search for Certificate No. "1106074-8"

nstart 5y ago

Okta's CEO just released a statement. And it's very tiny. Unsure what to make of this. Waiting to see LAPSUS$ response > In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor. (1 of 2) > We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2) https://twitter.com/toddmckinnon/status/1506184721922859010 https://twitter.com/toddmckinnon/status/1506184721922859010

hericium 5y ago
Oh, this absolutely looks like "an attempt". I'm sure investors are calmed by this tweet. Nothing to see here, move along.
- twistedpair 5y ago
  Pre-market trading is already -9% (was -14.5% before that tweet).
chillfox 5y ago
So, they covered it up in January and now wants us to believe that this is not yet another attempt at covering it up. Up until that statement I was willing to believe that they only just found out about it.
- open-source-ux 5y ago
  Had the same thought. A security breach in January, and only now are the details of the breach are revealed (by someone not related to Okta). In other words, Okta would never have revealed the security lapse until this leak. One can only imagine the many security breaches that are never revealed (from any company).
  - tyingq 5y ago

Shank 5y ago

Matthew Prince (CEO, Cloudflare): > Can anyone who’s gotten a satisfactory answer to #Log4J #Log4Shell from @Okta raise their hand? We certainly haven’t. #rottenfishstinks https://twitter.com/eastdakota/status/1506168088831569921 https://twitter.com/eastdakota/status/1506168088831569921

alecco 5y ago

How is this not number one story? The points and age are clearly superior to the 6 stories above and it's an important and scary development. Who is flagging this down? @dang? https://www.crunchbase.com/organization/okta https://www.crunchbase.com/organization/okta

OJFord 5y ago
It was earlier, it must just be losing steam compared to the more rapidly rising ones above it, no conspiracy.
- alecco 5y ago
  10. Librem 5: First Impressions (incoherency.co.uk) 262 points by jstanley 13 hours ago | flag | hide | 162 comments 11. Hackers claim to have breached Okta systems (twitter.com/_mg_) 824 points by obi1kenobi 9 hours ago | flag | hide | 280 comments There is no way to justify this. This smells of yet another mass flagging by interested parties and/or their network of friends. Or something worse.
  - xeromal 5y ago
    99% of the time people claim conspiracy on hackernews, it's their own bias.

spacemanmatt 5y ago

Running my own auth server is hard but has taken WAY less time to pay out than I ever anticipated.

thelittleone 5y ago

Outsourcing auth like this just makes too valuable a target.

jrib 5y ago

CEO's reply: > In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor. (1 of 2) > We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2) https://nitter.net/toddmckinnon/status/1506184721922859010 https://nitter.net/toddmckinnon/status/1506184721922859010

teddyh 5y ago

Torrent (allegedly) here: https://sizeof.cat/post/okta-customers-leak/ https://sizeof.cat/post/okta-customers-leak/

sabujp 5y ago

okta claims there was no breach, nothing to see here folks, move along : https://www.cnbc.com/2022/03/22/okta-breach-company-says-it-has-found-no-evidence-of-new-attack.html https://www.cnbc.com/2022/03/22/okta-breach-company-says-it-...

mwid 5y ago
This article does not include Okta's statement claiming they had not been breached. Regardless, their statement was a legal word-soup that bounced around the issue. The Lapsus$ team responded to it and said they could reset the passwords and MFA of over 95% of Okta customers which would mean they could get into any account, and thus any service, they wanted, though obviously they would be noticed pretty soon after. This is both sides claiming things without any evidence, mind you, so take it with as many grains of salt as you need.

thricegr8 5y ago

What's really concerning is if this turns out to be true, Okta has, at a minimum 26k (yes), customers right now. A simple enumeration of subdomains reveals this. I've put them here in a paste: https://ghostbin.com/K7tIA https://ghostbin.com/K7tIA

frays 5y ago
How can you tell that these subdomains are legitimate? Any URL *.okta.com resolves and loads an Okta login screen but doesn't mean it's an actual customer. For example, https://fake-ycombinator.okta.com https://fake-ycombinator.okta.com works and shows the same login screen as https://pets.okta.com/ https://pets.okta.com/. But only the latter is on the list, how do you know it's a legitimate customer?
- xeromal 5y ago
  Not saying that their process is right, but I searched for 3 small companies that I know are running with Okta and found them in this list.
twistedpair 5y ago
Wildcard domain much?
- thricegr8 5y ago
  I was wrong on this. See my comment above. I thought inspecting the certificate would be enough to tell you? I don't see the blob in any cert details. Where did I error?
- deleted 5y ago
  [deleted]
thricegr8 5y ago
Ah yes, perhaps a bit more due diligence was required. Can someone help me out then here? I checked the domain here: https://phonebook.cz/ https://phonebook.cz/, but manually inspecting the certificate, I don't see the * in front of okta.com to denote a wildcard domain is in use(*.okta.com). What am I missing?