3 ms·

> In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider It looked

by smcl 5y ago

> In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider It looked kinda successful though...

Helloyello 5y ago
duncan-donuts 5y ago
> The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop. This is consistent with the screenshots that we became aware of yesterday. Yeah, it was.
- djrogers 5y ago
  You can take my laptop from me and have access to it without having compromised my Okta account. In that scenario you wouldn't have my okra password or my MFA - what you would have is transient access to everything I'd already auth'd to until it times out and requests that you auth again.
  - lIIIllllIIII 5y ago
    At which point your browser probably auto-fills the credentials again :-)
    - d3nj4l 5y ago
      But ideally you would have MFA on a second device, so just the credentials aren't enough.
benatkin 5y ago
I think they're meaning it like a login attempt here. If you submit a login form 5 times, that's 5 login attempts. Another similar example is free throw attempts. https://www.statmuse.com/nba/ask/most-free-throw-attempts-per-game-2021 https://www.statmuse.com/nba/ask/most-free-throw-attempts-pe... I wouldn't have realized that unless I'd read far enough to see that Entity A did compromise Account B. Since the author didn't define what an attempt in this context means, I think it would be proper to assume that attempt meant the overall effort to compromise the account.
- smcl 5y ago
  Ahhh you reckon they are being sneaky with language? So something like: - unsuccessful login occurs - successful login + screenshot + various nefarious actions - (some time later) - attacker's access locked down Implying that they detected an unsuccessful login, but doesn't mean that they didn't prevent unauthorized access, which would make what they said technically correct but kinda useless for us users. That is something I did not originally consider, but wow ... maybe. I hope not. I mainly want answers about what is affected, and whether Auth0 was compromised.

by smcl 5y ago

> In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider It looked kinda successful though...

Helloyello 5y ago

duncan-donuts 5y ago

> The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop. This is consistent with the screenshots that we became aware of yesterday. Yeah, it was.

djrogers 5y ago
You can take my laptop from me and have access to it without having compromised my Okta account. In that scenario you wouldn't have my okra password or my MFA - what you would have is transient access to everything I'd already auth'd to until it times out and requests that you auth again.
- lIIIllllIIII 5y ago
  At which point your browser probably auto-fills the credentials again :-)
  - d3nj4l 5y ago
    But ideally you would have MFA on a second device, so just the credentials aren't enough.

benatkin 5y ago

I think they're meaning it like a login attempt here. If you submit a login form 5 times, that's 5 login attempts. Another similar example is free throw attempts. https://www.statmuse.com/nba/ask/most-free-throw-attempts-per-game-2021 https://www.statmuse.com/nba/ask/most-free-throw-attempts-pe... I wouldn't have realized that unless I'd read far enough to see that Entity A did compromise Account B. Since the author didn't define what an attempt in this context means, I think it would be proper to assume that attempt meant the overall effort to compromise the account.

smcl 5y ago
Ahhh you reckon they are being sneaky with language? So something like: - unsuccessful login occurs - successful login + screenshot + various nefarious actions - (some time later) - attacker's access locked down Implying that they detected an unsuccessful login, but doesn't mean that they didn't prevent unauthorized access, which would make what they said technically correct but kinda useless for us users. That is something I did not originally consider, but wow ... maybe. I hope not. I mainly want answers about what is affected, and whether Auth0 was compromised.