12 ms·
Lapsus has responded https://img.guildedcdn.com/ContentMedia/e4149dc99f447074cb2c385f1929d262-Full.webp?w=513&h=1033 https://img.guildedcdn.com/ContentMedia/e4
by templapsusread 5y ago
Lapsus has responded https://img.guildedcdn.com/ContentMedia/e4149dc99f447074cb2c385f1929d262-Full.webp?w=513&h=1033 https://img.guildedcdn.com/ContentMedia/e4149dc99f447074cb2c...
- templapsusread 5y agothey edited and added more content https://img.guildedcdn.com/ContentMedia/372280f522049aa0b0eb1f5255d1b921-Full.webp?w=483&h=1700 https://img.guildedcdn.com/ContentMedia/372280f522049aa0b0eb...
- intunderflow 5y agoTo note in some of the earlier screenshots you can see they have the EC2 Instances menu open in their tabs - that's a bit concerning, why does a support engineer need AWS EC2 access?
- Consultant32452 5y agoThe LAPSUS$ post suggests that they queried the AWS keys out of Slack. So the support engineers just have access to Slack, and Okta engineers were dumb enough to put those keys in Slack.
- gedy 5y agoI'm incredulous an auth focused company would do this without someone freaking out? Even my much smaller SaaS companies would react quickly to stop and rotate these if this happened.
- zmmmmm 5y agolooking closely at that I'm suspicious that lapsus$ is playing up what were perhaps trivial or ephemeral keys that were non-sensitive ... eg: test / dev / debug instances etc. The reason I think that is because if they really had keys for production machines it seems very unlikely they wouldn't have used them to produce some more damaging collateral than they've presented.
- icedchai 5y agoThe things that go on at small SaaS companies would horrify many. One SaaS company I worked for had a "god-mode" password hard coded into the source code. It was visible in plain text in the source, and you could login as any customer if you knew this master password. Of course, this was not logged anywhere. When employees left, they'd change the password and deploy a new build.
- twistedpair 5y agoDPL scanners in Slack, anyone? Figured Okta would definitely have those. We get alerts when folks are sharing tutorial code with fake keys like DEADBEEF in them. It's nice to know DPL works, if you use it.
- deleted 5y ago[deleted]
- intunderflow 5y agoCan you open the web console with just an access key? My impression was you could only use that to act through a CLI tool, at least officially you need to have powers or act as a user with powers to use the web console directly?
- allyant 5y agoNot using access keys- although using the cli you could create a user which does have the ability to login to the portal.
- different_sort 5y agoUntrue, any valid access key pair set can call “GetSignInToken” and access the aws console.
- hughrr 5y agoYou can add users with console access from the IAM API if you have enough reach.
- zerkten 5y agoFrequently, support teams have lab environments. Hopefully, it'd be an account per engineer, but at least isolated from production. If software engineers access these for reviewing issues which made their ways to bugs, then potentially this is a vector that organizations should be concerned about. Attackers will be happy to make 20+ pivots, so even an isolated AWS account for a support engineer is a nice base.
- viraptor 5y agoIf it's just a tab heading, we don't know if they have access or not. You can always open that page as long as you can log in. But it may show "you don't have permissions to display the instances". If you're thinking instead "why does a support engineer need AWS access" - cloudwatch metrics/logs come to mind.
- politelemon 5y ago8600 channels? Wouldn't that overwhelm you? I'm trying to think up scenarios where an org would need so many, but I can't. Is this normal?
- radicaldreamer 5y agoThere's probably a support channel for each customer and agents tasked with floating amongst them.
- detaro 5y agoI suspect lots of small channels with only a few people in them. They have 5k employees, it adds up.
- eugenekolo 5y agoSupport tickets, or incidents, or escalations might require creating a new slack channel
- raffraffraff 5y agoIt's not a bad idea to create channels for incidents. Ever tried to keep an incident timeline in a Jira ticket? It's absolutely horrendous. We used to automatically create a slack channel whenever a Jira incident ticket was created, and post it into the engineering channel with a message like "SEV1 incident, please join channel #INCIDENT-21". Slack is real nice for posting graphs, links, screenshots, going off on different investigation threads, pinning a status that gets constantly updated, calling out for people to join the channel using @you-hoo and running automations using bots. Jira absolutely sucks for live incident handling. Of course, you still wouldn't have 8500 channels. That's a lot of incidents.
- maldeh 5y agoA more poignant elegy to the modern landscape of compliance theater I have never seen: > Security Standards. Okta's ISMP includes adherance to and regular testing of the key controls, systems and procedures of its ISMP to validate that they are properly implemented and effective in addressing the threats and risks identified. Such testing includes: > a) Internal risk assessments; > b) ISO 27001, 27002, 27017 and 27018 certifications; > c) NIST guidance; and > d) SOC2 Type II (or successor standard) audits annually performed by accredited third-party auditors ("Audit Report"). I don't think storing AWS keys within Slack would comply to any of these standards?
- hughrr 5y agoYep. All these standards are tick boxing for liability. Nothing more. They are not effective security controls and never will be and should never be a measure of that.
- disillusioned 5y agoI don't know if tick boxing was a spoonerism or intentional or a real thing but I love it and am stealing it. (Upon further review, it appears to be the more UK way of saying it! Ha!)
- hughrr 5y agoYep UK here. Normal here :)
- dvtrn 5y agoWe’ve been monitoring this internally, as customers of an Okta-like service. I’ve also been closely monitoring the responses from our CTO and VP of Security when someone from our DevOps team posted a link to the Verge article in slack this morning. Which brings me to this inquiry: How are your orgs responding to this? We have a dependency on an Okta-like provider and my first thought when reading this news was “you know, wonder if we should give our shit a sanity check”, and someone beat me to this, proposed it in slack but the idea was turned down by our SecOps team.
- zmmmmm 5y agotbh it is a reassuringly weak response. Mostly picking apart logical inconsistencies in the language and / or re-emphasising the already disclosed info. Does not seem like they were able to produce any hard collateral to contradict anything Okta stated which probably means it's at least ball park accurate.
- imron 5y agoWhat happened to point 3
- deleted 5y ago[deleted]
- vxNsr 5y agoWhat telegram channel is this?
- Shank 5y agoIt's https://t.me/minsaudebr https://t.me/minsaudebr.
- andai 5y agoI could read the posts, but when I clicked to read the comments I got this: https://de.catbox.moe/ovt7t7.jpeg https://de.catbox.moe/ovt7t7.jpeg I remember healing a while ago that certain Telegram channels would be blocked on iOS devices due to Apple's content policy, that's what this seems to be about. Update: Yeah I can view them on desktop just fine.
- Shank 5y ago> Update: Yeah I can view them on desktop just fine. Yeah, this is the fabled content moderation block for App Store distributed apps. The Mac App Store version of Telegram also blocks it, but the direct download dmg does not. I think the direct download apps are also updated more frequently, but I could be wrong on this.
- bob1029 5y agoThis physically hurts to read now that I understand the official position of Okta. I am eagerly looking forward to the unfolding of consequences.