4 ms·

> This means they could have reset anybody’s credentials and logged in Does it? It specifically says "but are unable to obtain those passwords," which reads to

by bhaney 5y ago

> This means they could have reset anybody’s credentials and logged in Does it? It specifically says "but are unable to obtain those passwords," which reads to me like they are able to trigger a password reset email to the user, but are not actually able to set the password themselves.

spike021 5y ago
What if they have access to some users' emails and then can selectively fire off password reset emails to them? It's probably less likely, but could be a vector.
- evan_ 5y ago
  They wouldn't need to have an Okta CSE account for that, since anyone can go to *.okta.com and fire off a reset password email for any account. (Then again it does look like that's not available for every org. There's not a "reset password" option on cloudflare.okta.com for instance. Why give a CSE the option to do a password reset in those cases, though?) It still sounds to me like they're saying that they could set the password on an account to anything they wanted, but not retrieve an existing password. This would be a big red flag to anyone who's observant and realizes that their password had been changed, but plenty of people would probably simply take it in stride and reset their password thinking they'd forgotten it. Either way the horse is out of the barn.
  - ricardobeat 5y ago
    I don't understand all these crazy assumptions being made. A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case. Especially for a security company. It would be the equivalent of giving the doorman a key that opens everyone's apartment. Obviously support can trigger a reset, that you have to complete from your own e-mail account.
    - evan_ 5y ago
      Confusing analogy, doormen frequently do have a key to every apartment in the building. Anyway I agree it would be bad practice but that doesn't mean it's not done.
      - ricardobeat 5y ago
        > doormen frequently do have a key to every apartment in the building Really? That's insane. I'd like to hear more about that.
        winrid 5y ago
        I've actually had a landlord give the keys to one of the tenants since they didn't have a doorman. The tenant in question was actually a registered sex offender too, but the judge is friends with the landlord so no harm done. Crazy world.
    - nickcox 5y ago
      > A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case I have no idea what an Okta support engineer can or can't do but I know that a regular account administrator can set an arbitrary password for a given user via the Okta UI.
- bhaney 5y ago
  > What if they have access to some users' emails Then those users are hosed anyway? They could always trigger a normal user-facing password reset email without any access to support systems.
- giaour 5y ago
  Can't you request a reset without any special access? Many (but not all) applications have a publicly accessible log in page with a "Forgot your password?" link that takes an email as input.
  - spike021 5y ago
    I think the original reason I posed the question is because I used Okta a while back for one org and IIRC there was no password reset available to me; I had to contact one of our IT admin to do it.
- rsweeney21 5y ago
  If they have access to some users' emails, they wouldn't need access to okta to reset the password and take control of the account. If a hacker has access to your email then you've already been pwnd.
- panqueque 5y ago
  That's pretty common and wouldn't lead to a compromise. It's a potential DOS vector, yes, but not a compromise. However, I wonder if Okta tech support is also able to change a user's registered email...
chockchocschoir 5y ago
The text is a bit ambiguous (and probably on purpose, I'm sure it passed through multiple layers where multiple lawyers have reviewed it too). Okta says Lapsus$ were unable to "obtain" the passwords, but they didn't say they were unable to set their own passwords (for example). Neither is the MFA tokens mentioned, although they do mention MFA in the text.
- creativenolo 5y ago
  Then they'd have obtained it, no? It seems pertinent a support engineer could trigger a password reset if they were worried a password had been compromised for a user.
  - baobabKoodaa 5y ago
    > Then they'd have obtained it, no? If you change a password, then you didn't "obtain" the previous password. Weasel words but there you go.
  - sodality2 5y ago
    I think "obtain" here is specifically meant to mean "get existing passwords in plaintext", not "get a valid password via resetting it to a known one".
adrr 5y ago
If OKTA gates email like at most organizations, reset email doesn't work. It has to be the ability to set a temp password.

by bhaney 5y ago

spike021 5y ago

What if they have access to some users' emails and then can selectively fire off password reset emails to them? It's probably less likely, but could be a vector.

evan_ 5y ago
They wouldn't need to have an Okta CSE account for that, since anyone can go to *.okta.com and fire off a reset password email for any account. (Then again it does look like that's not available for every org. There's not a "reset password" option on cloudflare.okta.com for instance. Why give a CSE the option to do a password reset in those cases, though?) It still sounds to me like they're saying that they could set the password on an account to anything they wanted, but not retrieve an existing password. This would be a big red flag to anyone who's observant and realizes that their password had been changed, but plenty of people would probably simply take it in stride and reset their password thinking they'd forgotten it. Either way the horse is out of the barn.
- ricardobeat 5y ago
  I don't understand all these crazy assumptions being made. A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case. Especially for a security company. It would be the equivalent of giving the doorman a key that opens everyone's apartment. Obviously support can trigger a reset, that you have to complete from your own e-mail account.
  - evan_ 5y ago
    Confusing analogy, doormen frequently do have a key to every apartment in the building. Anyway I agree it would be bad practice but that doesn't mean it's not done.
    - ricardobeat 5y ago
      > doormen frequently do have a key to every apartment in the building Really? That's insane. I'd like to hear more about that.
      - winrid 5y ago
        I've actually had a landlord give the keys to one of the tenants since they didn't have a doorman. The tenant in question was actually a registered sex offender too, but the judge is friends with the landlord so no harm done. Crazy world.
  - nickcox 5y ago
    > A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case I have no idea what an Okta support engineer can or can't do but I know that a regular account administrator can set an arbitrary password for a given user via the Okta UI.
bhaney 5y ago
> What if they have access to some users' emails Then those users are hosed anyway? They could always trigger a normal user-facing password reset email without any access to support systems.
giaour 5y ago
Can't you request a reset without any special access? Many (but not all) applications have a publicly accessible log in page with a "Forgot your password?" link that takes an email as input.
- spike021 5y ago
  I think the original reason I posed the question is because I used Okta a while back for one org and IIRC there was no password reset available to me; I had to contact one of our IT admin to do it.
rsweeney21 5y ago
If they have access to some users' emails, they wouldn't need access to okta to reset the password and take control of the account. If a hacker has access to your email then you've already been pwnd.
panqueque 5y ago
That's pretty common and wouldn't lead to a compromise. It's a potential DOS vector, yes, but not a compromise. However, I wonder if Okta tech support is also able to change a user's registered email...

chockchocschoir 5y ago

The text is a bit ambiguous (and probably on purpose, I'm sure it passed through multiple layers where multiple lawyers have reviewed it too). Okta says Lapsus$ were unable to "obtain" the passwords, but they didn't say they were unable to set their own passwords (for example). Neither is the MFA tokens mentioned, although they do mention MFA in the text.

creativenolo 5y ago
Then they'd have obtained it, no? It seems pertinent a support engineer could trigger a password reset if they were worried a password had been compromised for a user.
- baobabKoodaa 5y ago
  > Then they'd have obtained it, no? If you change a password, then you didn't "obtain" the previous password. Weasel words but there you go.
- sodality2 5y ago
  I think "obtain" here is specifically meant to mean "get existing passwords in plaintext", not "get a valid password via resetting it to a known one".

adrr 5y ago

If OKTA gates email like at most organizations, reset email doesn't work. It has to be the ability to set a temp password.