6 ms·

And this explains how the LAPSUS hacker group was able to breach Microsoft, NVIDIA, and countless others. Apparently, they have been inside of OKTA systems for

• technion 5y ago
  It would be confusing to me if Microsoft were utilising Okta themselves. Their own Azure offerings provide everything Okta does (and usually bundled into something you're already buying).
  • gzer0 5y ago
    Over the weekend, LAPSUS$ posted a screenshot to its Telegram channel of what appeared to be information taken from an internal developer account for Azure, its cloud computing division. https://gizmodo.com/microsoft-investigating-potential-lapsus-hack-1848680418 https://gizmodo.com/microsoft-investigating-potential-lapsus...
    • technion 5y ago
      Yes I've seen that, but I don't see how people are making the leap to assume that this Azure leak came through Okta.
      • staticassertion 5y ago
        I'd be kinda shocked to find that Okta isn't anywhere in Microsoft, just given acquisitions. But yeah, no evidence that it's directly related.
        • weq 5y ago
          Azure B2C is a direct competitor to Okta... If MS isnt dogfooding this, when what would they dogfood?
          • eurasiantiger 5y ago
            Azure B2C is awful though
            • peakaboo 5y ago
              Azure is awful in general. Microsoft can't even copy other clouds efficiently.
              • dijit 5y ago
                In my admittedly limited experience it is “alright”, and their sales people don’t pretend that it’s magic like the AWS sales people do. Honestly I’m so unimpressed with AWS that I find it hard to say Azure is terrible, because the bar for terrible is set much lower.
            • davidspiess 5y ago
              Do yourself a favor and stay away from it.
            • cco 5y ago
              I haven't had direct experience with Azure B2C, why is it awful?
              • eurasiantiger 5y ago
                Laborious, confusing, error-prone and extremely extensively but poorly documented.
        • freeone3000 5y ago
          Acquisitions get authentication replaced fast (well, fast-ish, we got a year to change over). It might be around somewhere, but, AAD is used nearly universally and I've never seen Okta.
  • deleted 5y ago
    [deleted]
  • deleted 5y ago
    [deleted]
  • MrStonedOne 5y ago
• photon12 5y ago
  Seems a bit premature to assume this was the vector used for those other breaches.
  • gurjeet 5y ago
    One possible route: a Microsoft employee using an Okta protected product/service. That other product/service was compromised, which let hackers hack into MS employee’s computer, which gave them access to Azure infrastructure.
    • Johnny555 5y ago
      That seems like an attack vector unrelated to the Okta breach -- if it was possible to attack the MS employee's computer from a compromised app, then whether or not that app was protected by Okta seems immaterial.
      • gurjeet 5y ago
        Perhaps the app was not compromised, to begin with. Hackers might’ve gotten into the build infrastructure of the app, rewrote it to make it compromised, and then all the users of that app are now compromised. Lesson: ask your (in this case Microsoft) employees to not use work computers for any personal use. /me goes to check if my password manager company uses Okta.
        • Johnny555 5y ago
          Again, this is not related to an Okta hack, employees could be using an app that has nothing to do with Okta and be compromised through this same attack vector. This is just wild speculation to make up a scenario where Microsoft could be affected by the Okta hack with no evidence to back it up.
          • gurjeet 5y ago
            Agreed. It’s all speculation at this point. I hope I did not make it sound like I have any evidence to backup my speculation. I was just trying to come up with a threat vector to explain how it might be possible.
• paxys 5y ago
  Pretty sure Microsoft uses Azure Active Directory for SSO, not a direct competitor (source: used to work there).
  • deleted 5y ago
    [deleted]
  • pitterpatter 5y ago
    That's generally true but the thing about Microsoft is that it's so huge I wouldn't be surprised at them being customers of a lot of SaaS offerings. Could be via an acquired company that is partially integrated? Or some kind of federated login for partners.
    • NicoJuicy 5y ago
      Euh, nope.
    • tailspin2019 5y ago
      This is a reasonable take in my view. When you acquire a company, you don't get to replace their entire tech stack on day 1. And sometimes there are chains of dependencies that need to be swapped out in sequence. So from acquisitions alone it would seem reasonable to expect that Microsoft at any point in time has at least a handful of usages of certain SaaS offerings, even if MS themselves offer their own versions of those services. That said, the surface area of these "unofficial" 3rd party systems is likely to be quite small in comparison to whatever their official tech stack looks like (which does -- I would assume -- centre around Azure AD). I'm not expressing an opinion on whether the GP is correct to make this link... I've worked with some very large companies where internally they (surprisingly to me) make use of competitors' products even when that company makes their own version of that product. There are all sorts of legitimate reasons why this happens.
• bogomipz 5y ago
  Is it reasonable that they been inside Okta for 2 months and Okta hasn't noticed?
  • k4ch0w 5y ago
    Yes, this is very common especially when you're living off the land. You take over the one unmonitored host and then you use the internal tools as if you were a normal employee.
  • lostmsu 5y ago
    The well hidden secret among large tech companies is that persistent threats are quite often discovered after ~6 months active presence going unnoticed. Some persist for years.
    • milkshakes 5y ago
      much longer than that sadly. now guess what most companies set log retention to?
      • fruit2020 5y ago
        2 weeks?
  • 867-5309 5y ago
    "the quieter you are, the more you will hear"
• gzer0 5y ago
  The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords [1] https://twitter.com/BillDemirkapi/status/1506109956298317830/photo/1 https://twitter.com/BillDemirkapi/status/1506109956298317830...
  • dhx 5y ago
    It's not particularly worrisome as shown in the screenshot. It appears the attacker could only send a password reset link or temporary password to the e-mail address of the user account. There is nothing in the screenshot indicating that the attacker could have changed the e-mail address to one controlled by the attacker, thus being able to reset the user's account.