4 ms·
> Support engineers do have access to limited data - for example, Jira tickets and lists of users - that were seen in the screenshots. Support engineers are als
by koolba 5y ago
> Support engineers do have access to limited data - for example, Jira tickets and lists of users - that were seen in the screenshots. Support engineers are also able to facilitate the resetting of passwords and MFA factors for users, but are unable to obtain those passwords.
This means they could have reset anybody’s credentials and logged in. There would a record of it if the audit logs are valid, but saying no action is needed may be a stretch.
- giaour 5y agoIt's been a minute since I was an admin in an Okta directory, but don't all resets use a self-service flow? In order to log in to someone's account, I think you need to compromise their email, too.
- dhagz 5y agoThey do indeed use a self-service flow.
- codebje 5y agoSuper admins can set a temporary password. But they can also change a user's email address, disable password and email change notifications, lock out all other admins... They have complete control of the org. It's pretty clear there is no super admin breach here. None of the screenshots show an admin interface - the app portal shot clearly shows a distinct lack of the "Admin" button. No user directory shots. There is a single image of a password reset confirmation, but those are also in documentation so it's hardly a smoking gun. It seems far more likely that a support engineer had their laptop compromised and their limited access was used to try and make a mountain out of a molehill. Not like a ransomware group would have reason to over-exaggerate their access and ability, right?
- bhaney 5y ago> This means they could have reset anybody’s credentials and logged in Does it? It specifically says "but are unable to obtain those passwords," which reads to me like they are able to trigger a password reset email to the user, but are not actually able to set the password themselves.
- spike021 5y agoWhat if they have access to some users' emails and then can selectively fire off password reset emails to them? It's probably less likely, but could be a vector.
- evan_ 5y agoThey wouldn't need to have an Okta CSE account for that, since anyone can go to *.okta.com and fire off a reset password email for any account. (Then again it does look like that's not available for every org. There's not a "reset password" option on cloudflare.okta.com for instance. Why give a CSE the option to do a password reset in those cases, though?) It still sounds to me like they're saying that they could set the password on an account to anything they wanted, but not retrieve an existing password. This would be a big red flag to anyone who's observant and realizes that their password had been changed, but plenty of people would probably simply take it in stride and reset their password thinking they'd forgotten it. Either way the horse is out of the barn.
- ricardobeat 5y agoI don't understand all these crazy assumptions being made. A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case. Especially for a security company. It would be the equivalent of giving the doorman a key that opens everyone's apartment. Obviously support can trigger a reset, that you have to complete from your own e-mail account.
- evan_ 5y agoConfusing analogy, doormen frequently do have a key to every apartment in the building. Anyway I agree it would be bad practice but that doesn't mean it's not done.
- ricardobeat 5y ago> doormen frequently do have a key to every apartment in the building Really? That's insane. I'd like to hear more about that.
- paxys 5y agoPassword reset requests still go to your registered email.
- panqueque 5y agoDo you know if Okta support are/were able to change a user's email?
- judge2020 5y agoYou can indeed change the email / login on a user's profile an an org admin, but we probably won't know if Okta support agents themselves can also do that.
- flatiron 5y agobesides the whole "we dug through slack and got your AWS keys" i think the worst case scenario would have been removing MFA from an a compromised account and having access to the e-mail to self-serve the password reset. that and maybe going through JIRA and seeing if anything was of any interest?
- mdoms 5y agoNo it doesn't. The password reset email goes to the user's registered email address and the link can't be obtained by support.
- Consultant32452 5y agoOkta engineers stored some of their AWS keys in Slack. Depending on what those were the keys to it could be REALLY bad. Off the top of my head: direct database access, http server - could push compromised pages to all Okta users The AWS keys really could be the keys to the whole proverbial kingdom.