14 ms·

Lots more detail: https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/ https://blog.cloudflare.com/cloudflare-investigation

Lots more detail: https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/ https://blog.cloudflare.com/cloudflare-investigation-of-the-...

ktsayed 5y ago
the difference in level of detail and amount of information provided has been out of this world. Thank you!
- chockchocschoir 5y ago
  Also a fun exercise in "Show don't tell" when it comes to transparency. Okta writes "We are deeply committed to transparency" but shows none in their blogpost in contrast to CloudFlare, that doesn't write anything about transparency but displays a lot of it. A bit like queuing for your internet providers customer support for 3 hour and hearing "We care about customer satisfaction" every five minutes.
indigodaddy 5y ago
I thought that a CF person (can’t remember if it was Prince or not) said in the main HN thread yesterday, that CF uses their own homegrown SSO internally, and Okta externally, but this blog article seems to infer the opposite… Anyway, I likely misinterpreted yesterday’s comment..
- deleted 5y ago
  [deleted]
- 0x0000000 5y ago
  I think you're referring to this tweet: https://twitter.com/eastdakota/status/1506148082194386949 https://twitter.com/eastdakota/status/1506148082194386949 I believe @eastdakota is saying that Cloudflare has their own homegrown SSO internally, but they do not make that available externally to their customers (it's not a public product that one can buy). I don't think that the tweet was saying that they use Okta externally.
cheeze 5y ago
I gotta say, I don't make technical decisions at the "we're using CF" level, but I've been incredibly impressed with their track record over the years. I often evangelize blog post writing and transparency at my company and this is exactly why. What a way to build trust. It's basically free advertising for technical folk by "putting their money where their mouth is." I'd love to see more of this in the industry. CF is, IMO, industry leading here.
- londons_explore 5y ago
  Their blog posts are great, but for a service where reliability really really matters, they've had a few too many global outages. Especially considering their core proxying service doesn't have any requirement for a globally consistent datastore, there is zero excuse for a global outage.
  - tatersolid 5y ago
    > doesn't have any requirement for a globally consistent datastore How do you think they manage configuration for proxying millions of customer websites? Using a globally distributed data store.
polote 5y ago
How is that lots more details ? Your post is only about whether or not CF Okta account has been compromised not about what really happened for all Okta customers
- MrStonedOne 5y ago
  it has more detail on the breach then okta's own statement.
- NicoJuicy 5y ago
  They give more technical details than the Okta post and probably even the Okta customer contact. Eg. > Cloudflare reads the system Okta logs every five minutes and stores these in our SIEM so that if we were to experience an incident such as this one, we can look back further than the 90 days provided in the Okta dashboard. Some event types within Okta that we searched for are: user.account.reset_password, user.mfa.factor.update, system.mfa.factor.deactivate, user.mfa.attempt_bypass, and user.session.impersonation.initiate. It’s unclear from communications we’ve received from Okta so far who we would expect the System Log Actor to be from the compromise of an Okta support employee.
Fabricio20 5y ago
> Suspend the one Cloudflare account visible in the screenshots As far as I can see, there's a lot of cloudflare accounts visible in the screenshots shared by the group. Stuff like cloudflaretv1, etc..
- jgrahamc 5y ago
  Sorry. Should have been clearer. There’s a screenshot showing a password reset about to happen for a specific person. We suspended that account. In parallel, we were using our own logging to look for any password reset/MFA change over the last four months and just went ahead and forced a reset for all those users.

Lots more detail: https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/ https://blog.cloudflare.com/cloudflare-investigation-of-the-...

ktsayed 5y ago

the difference in level of detail and amount of information provided has been out of this world. Thank you!

chockchocschoir 5y ago
Also a fun exercise in "Show don't tell" when it comes to transparency. Okta writes "We are deeply committed to transparency" but shows none in their blogpost in contrast to CloudFlare, that doesn't write anything about transparency but displays a lot of it. A bit like queuing for your internet providers customer support for 3 hour and hearing "We care about customer satisfaction" every five minutes.

indigodaddy 5y ago

I thought that a CF person (can’t remember if it was Prince or not) said in the main HN thread yesterday, that CF uses their own homegrown SSO internally, and Okta externally, but this blog article seems to infer the opposite… Anyway, I likely misinterpreted yesterday’s comment..

deleted 5y ago
[deleted]
0x0000000 5y ago
I think you're referring to this tweet: https://twitter.com/eastdakota/status/1506148082194386949 https://twitter.com/eastdakota/status/1506148082194386949 I believe @eastdakota is saying that Cloudflare has their own homegrown SSO internally, but they do not make that available externally to their customers (it's not a public product that one can buy). I don't think that the tweet was saying that they use Okta externally.

cheeze 5y ago

I gotta say, I don't make technical decisions at the "we're using CF" level, but I've been incredibly impressed with their track record over the years. I often evangelize blog post writing and transparency at my company and this is exactly why. What a way to build trust. It's basically free advertising for technical folk by "putting their money where their mouth is." I'd love to see more of this in the industry. CF is, IMO, industry leading here.

londons_explore 5y ago
Their blog posts are great, but for a service where reliability really really matters, they've had a few too many global outages. Especially considering their core proxying service doesn't have any requirement for a globally consistent datastore, there is zero excuse for a global outage.
- tatersolid 5y ago
  > doesn't have any requirement for a globally consistent datastore How do you think they manage configuration for proxying millions of customer websites? Using a globally distributed data store.

polote 5y ago

How is that lots more details ? Your post is only about whether or not CF Okta account has been compromised not about what really happened for all Okta customers

MrStonedOne 5y ago
it has more detail on the breach then okta's own statement.
NicoJuicy 5y ago
They give more technical details than the Okta post and probably even the Okta customer contact. Eg. > Cloudflare reads the system Okta logs every five minutes and stores these in our SIEM so that if we were to experience an incident such as this one, we can look back further than the 90 days provided in the Okta dashboard. Some event types within Okta that we searched for are: user.account.reset_password, user.mfa.factor.update, system.mfa.factor.deactivate, user.mfa.attempt_bypass, and user.session.impersonation.initiate. It’s unclear from communications we’ve received from Okta so far who we would expect the System Log Actor to be from the compromise of an Okta support employee.

Fabricio20 5y ago

> Suspend the one Cloudflare account visible in the screenshots As far as I can see, there's a lot of cloudflare accounts visible in the screenshots shared by the group. Stuff like cloudflaretv1, etc..

jgrahamc 5y ago
Sorry. Should have been clearer. There’s a screenshot showing a password reset about to happen for a specific person. We suspended that account. In parallel, we were using our own logging to look for any password reset/MFA change over the last four months and just went ahead and forced a reset for all those users.