7 ms·

I don't understand how the CSO can write this: "In this post, I want to provide a timeline and my perspective on what has transpired, and where we are today wi

I don't understand how the CSO can write this: "In this post, I want to provide a timeline and my perspective on what has transpired, and where we are today with this investigation. I hope that it will illuminate why I am confident in our conclusions that the Okta service has not been breached and there are no corrective actions that need to be taken by our customers." And then go on to write paragraphs of detail and a timeline that explicitly shows for a five day period an unauthorized user had full super user access to the service. He explicitly says, "The report from the forensic firm highlighted that there was a five-day window of time between January 16-21, 2022 when the threat actor had access to the Sitel environment, which we validated with our own analysis." This is some unbelievable double speak to try to claim that Okta was not breached. Any trust I had in this company is completely in the toilet, just based on this response. How is the CEO not responding to this too? The hole just keeps getting dug deeper the more they say.

Buttons840 5y ago
Sounds like the main point of disagreement is the definition of a single word, "breached". Otherwise, everyone is in agreement about what happened, right? I agree with your definition of the word for whatever it's worth. At this point, it would be helpful for Okta to stop using the term "breached", because apparently they aren't using the word in the same way everyone else is, and it's a point of contention.
- Closi 5y ago
  Everyone else is using the plain English definition because it’s accurate. Okta is intentionally using their own definition to down-play what’s happened. A breach is simply ‘to overcome defences’ (ie to get access to something you shouldn’t). In this case their defence against someone else accessing the super user application was the support employee and their credentials, but this defence was clearly overcome by the hackers. I agree that they need to stop using the word.
- kerng 5y ago
  Agreed. It's obvious that lawyers are deeply involved already at this point. The most likely reason they dont wanna use the common sense term "breached" is because it implies legally a breach of contract, which means liability and getting sued and having to show up in front of congress. Very sad to see their response be so intransparent and flawed. I wish technical people would be more involved in writing these responses, not lawyers.
  - Beltiras 5y ago
    The breach is technical in nature. The disclosure and response is a legal matter.
- zmmmmm 5y ago
  I actually think the definitional conflict might be on the term "Okta service" - > the Okta service has not been breached If you consider the Okta service as the infrastructure acutally providing auth services to customers - then it wasn't breached. Only Okta support services were breached and that did not (going with Okta's line here) actually allow for somebody to access the actual Okta auth services.
bigDinosaur 5y ago
I view this hack as a public service - we're seeing how awfully these big security companies actually handle security in the worst case. Let that be a lesson to everyone who is in favour of mass centralisation. There needs to be a security solution where Okta essentially provides the skeleton of the infrastructure but not the entire solution, such that an Okta compromise does not compromise everyone who uses them.
- qbasic_forever 5y ago
  It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many levels of indirection that it took months to figure out the full impact of the breach and incident. This does not seem like a healthy or responsible security policy for a company whose primary business is... authentication security.
  - tgsovlerkhgsel 5y ago
    But it was cheap!
  - salmo 5y ago
    No, definitely not full admin access. Just a support tool called “SuperUser”. It was a customer service rep who could send password reset emails. Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed. Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool. They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access. Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company. The fact that the tool is named Super User is killing them more than anything here.
  - a2tech 5y ago
    And don't forget that they meet all the governments BS standards and auditing checks. So lots of government contractors use them.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
a-dub 5y ago
> And then go on to write paragraphs of detail and a timeline that explicitly shows for a five day period an unauthorized user had full super user access to the service. it sounds like they built the support tool (with its unfortunate name) such that it places limited trust in support contractors and the information technology that supports them. because of this they're able to identify potentially affected customers and even audit all activities that have taken place. in other words, the system worked as designed. this is very different (and orders of magnitude less severe) than an actual compromise of the production service itself.
- qbasic_forever 5y ago
  A person who should not have had access to the system gained near full admin access for five whole days. That is the textbook definition of a breach of security. It doesn't matter if they did it by fooling or paying a low level CS rep to get access to their account vs. using their 'leet hacking skillz' to pwn the electronic defenses. A breach is a breach and the CSO of all people has to own up to that fact.
  - a-dub 5y ago
    > A person who should not have had access to the system gained near full admin access for five whole days. "This is an application built with least privilege in mind to ensure that support engineers are granted only the specific access they require to perform their roles. They are unable to create or delete users. They cannot download customer databases." not being able to create or delete users seems a far cry from "near full admin access."
    - thesimon 5y ago
      Why? We only know that they are not able to create new users. But at least changing passwords of existing accounts seemed possible according to the screenshots, perhaps disabling 2FA as well. As long as Okta does not provide a list of what the user was able to do, we don't know
kerng 5y ago
They dont wanna use the word "breached" because lawyers write these things - and legally breach has a different meaning than security wise. Very sad that they already prepare on the legal front rather then being open and transparent.
- blakejustblake 5y ago
  Was coming around to make this point that in the cybersecurity world the word "breach" can have a very particular meaning with legal implications. As a cybersecurity professional, we are trained not to refer to anything as a breach while communicating findings of investigations or alerting organizations to activities that we see unless that has already been legally established. There is plenty concerning about their response to this situation, and this phrasing can be confusing, but from my POV in the industry this choice of words is understandable.
caffeine 5y ago
Nope. You are just not understanding it. To simplify: The hackers had minimal access to stuff and couldn’t do much.
- _sword 5y ago
  They could see the names and contacts of employees at Okta’s customers and reset their credentials at a bare minimum per the leaked screenshot. That doesn’t seem that minimal?
  - JshWright 5y ago
    Based on the screenshots, they could trigger password reset emails. They couldn't directly set the new password. Not defending Okta's response here; I think it has been quite terrible.
tuwtuwtuwtuw 5y ago
I think you have misunderstood at least parts of it. "superuser" is a tool which can be used for various tasks. It is not the same thing as "full super user access". As I understand it, the tool superuser doesn't allow you to do whatever you want, like accessing any piece of data in the databases. It is used by their support engineers. Not trying to say there was no impact, but "full super user access" traditionally implies more than being able to run one specific tool with the name superuser. I think people who have written about this and looked at the screen shots has been sloppy and spread misinformation.
insickness 5y ago
The CSO is implying that the super user was able to get into the system but did not have access to sensitive data, or at least did not exfiltrate that data. It's possible if their defenses are layered enough. The security model is defense in depth, rather than the "moat" concept of hard on the outside, soft on the inside. Micro-breaches are expected; it's about detecting and mitigating them. I'm not saying the CSO is telling the truth, but that's how you reconcile someone having access to the system without accessing sensitive data.
snowwolf 5y ago
> Support engineers use a number of customer support tools to get their job done including Okta’s instances of Jira, Slack, Splunk, RingCentral, and support tickets through Salesforce. I like how it just glosses over access to all the other tools which often contain a treasure trove of data. Just Slack can give an attacker worst case credentials pasted into channels and best case loads of information for more targeted social engineering attacks. LAPSUS$ even stated they had access to over 8K channels.
- snowwolf 5y ago
  Reading the other trending article on LAPSUS$ (https://news.ycombinator.com/item?id=30774406 https://news.ycombinator.com/item?id=30774406), access to Slack suits their MO perfectly in terms of mining it for data for more sophisticated escalation of access via social engineering.
h0l0cube 5y ago
> an unauthorized user had full super user access to the service From the article: > The majority of support engineering tasks are performed using an internally-built application called SuperUser or SU for short, which is used to perform basic management functions of Okta customer tenants. This does not provide “god-like access” to all its users. This is an application built with least privilege in mind to ensure that support engineers are granted only the specific access they require to perform their roles. They are unable to create or delete users. They cannot download customer databases. They cannot access our source code repositories.
- sascha_sl 5y ago
  From circulating screenshots, and the omission in the listing here, it looks like they used this account to reset user passwords and MFA on a bunch of tenants. Not being able to create or delete users is meaningless.
  - h0l0cube 5y ago
    Fair call. That's an important clarification.
  - kasey_junk 5y ago
    Why is it a meaningless distinction to prevent account creation but allow password reset? Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all. Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?
    - sascha_sl 5y ago
      Apparently the "password reset" is more of a "password set" feature.
      - 5y ago
nikanj 5y ago
I believe part of the job description for CxO jobs is "willing to bend reality as per needs of the company"
jeffwask 5y ago
At least he didn't blame the intern...
ecf 5y ago
I’m finding it hard to figure out what the role of a CSO is after this incident. They seem to be the least knowledgeable about the product they’re creating as to offer the highest degree of plausible deniability possible.

Buttons840 5y ago

Sounds like the main point of disagreement is the definition of a single word, "breached". Otherwise, everyone is in agreement about what happened, right? I agree with your definition of the word for whatever it's worth. At this point, it would be helpful for Okta to stop using the term "breached", because apparently they aren't using the word in the same way everyone else is, and it's a point of contention.

Closi 5y ago
Everyone else is using the plain English definition because it’s accurate. Okta is intentionally using their own definition to down-play what’s happened. A breach is simply ‘to overcome defences’ (ie to get access to something you shouldn’t). In this case their defence against someone else accessing the super user application was the support employee and their credentials, but this defence was clearly overcome by the hackers. I agree that they need to stop using the word.
kerng 5y ago
Agreed. It's obvious that lawyers are deeply involved already at this point. The most likely reason they dont wanna use the common sense term "breached" is because it implies legally a breach of contract, which means liability and getting sued and having to show up in front of congress. Very sad to see their response be so intransparent and flawed. I wish technical people would be more involved in writing these responses, not lawyers.
- Beltiras 5y ago
  The breach is technical in nature. The disclosure and response is a legal matter.
zmmmmm 5y ago
I actually think the definitional conflict might be on the term "Okta service" - > the Okta service has not been breached If you consider the Okta service as the infrastructure acutally providing auth services to customers - then it wasn't breached. Only Okta support services were breached and that did not (going with Okta's line here) actually allow for somebody to access the actual Okta auth services.

bigDinosaur 5y ago

I view this hack as a public service - we're seeing how awfully these big security companies actually handle security in the worst case. Let that be a lesson to everyone who is in favour of mass centralisation. There needs to be a security solution where Okta essentially provides the skeleton of the infrastructure but not the entire solution, such that an Okta compromise does not compromise everyone who uses them.

qbasic_forever 5y ago
It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many levels of indirection that it took months to figure out the full impact of the breach and incident. This does not seem like a healthy or responsible security policy for a company whose primary business is... authentication security.
- tgsovlerkhgsel 5y ago
  But it was cheap!
- salmo 5y ago
  No, definitely not full admin access. Just a support tool called “SuperUser”. It was a customer service rep who could send password reset emails. Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed. Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool. They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access. Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company. The fact that the tool is named Super User is killing them more than anything here.
- a2tech 5y ago
  And don't forget that they meet all the governments BS standards and auditing checks. So lots of government contractors use them.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

a-dub 5y ago

> And then go on to write paragraphs of detail and a timeline that explicitly shows for a five day period an unauthorized user had full super user access to the service. it sounds like they built the support tool (with its unfortunate name) such that it places limited trust in support contractors and the information technology that supports them. because of this they're able to identify potentially affected customers and even audit all activities that have taken place. in other words, the system worked as designed. this is very different (and orders of magnitude less severe) than an actual compromise of the production service itself.

qbasic_forever 5y ago
A person who should not have had access to the system gained near full admin access for five whole days. That is the textbook definition of a breach of security. It doesn't matter if they did it by fooling or paying a low level CS rep to get access to their account vs. using their 'leet hacking skillz' to pwn the electronic defenses. A breach is a breach and the CSO of all people has to own up to that fact.
- a-dub 5y ago
  > A person who should not have had access to the system gained near full admin access for five whole days. "This is an application built with least privilege in mind to ensure that support engineers are granted only the specific access they require to perform their roles. They are unable to create or delete users. They cannot download customer databases." not being able to create or delete users seems a far cry from "near full admin access."
  - thesimon 5y ago
    Why? We only know that they are not able to create new users. But at least changing passwords of existing accounts seemed possible according to the screenshots, perhaps disabling 2FA as well. As long as Okta does not provide a list of what the user was able to do, we don't know

kerng 5y ago

They dont wanna use the word "breached" because lawyers write these things - and legally breach has a different meaning than security wise. Very sad that they already prepare on the legal front rather then being open and transparent.

blakejustblake 5y ago
Was coming around to make this point that in the cybersecurity world the word "breach" can have a very particular meaning with legal implications. As a cybersecurity professional, we are trained not to refer to anything as a breach while communicating findings of investigations or alerting organizations to activities that we see unless that has already been legally established. There is plenty concerning about their response to this situation, and this phrasing can be confusing, but from my POV in the industry this choice of words is understandable.

caffeine 5y ago

Nope. You are just not understanding it. To simplify: The hackers had minimal access to stuff and couldn’t do much.

_sword 5y ago
They could see the names and contacts of employees at Okta’s customers and reset their credentials at a bare minimum per the leaked screenshot. That doesn’t seem that minimal?
- JshWright 5y ago
  Based on the screenshots, they could trigger password reset emails. They couldn't directly set the new password. Not defending Okta's response here; I think it has been quite terrible.

tuwtuwtuwtuw 5y ago

I think you have misunderstood at least parts of it. "superuser" is a tool which can be used for various tasks. It is not the same thing as "full super user access". As I understand it, the tool superuser doesn't allow you to do whatever you want, like accessing any piece of data in the databases. It is used by their support engineers. Not trying to say there was no impact, but "full super user access" traditionally implies more than being able to run one specific tool with the name superuser. I think people who have written about this and looked at the screen shots has been sloppy and spread misinformation.

insickness 5y ago

The CSO is implying that the super user was able to get into the system but did not have access to sensitive data, or at least did not exfiltrate that data. It's possible if their defenses are layered enough. The security model is defense in depth, rather than the "moat" concept of hard on the outside, soft on the inside. Micro-breaches are expected; it's about detecting and mitigating them. I'm not saying the CSO is telling the truth, but that's how you reconcile someone having access to the system without accessing sensitive data.

snowwolf 5y ago

> Support engineers use a number of customer support tools to get their job done including Okta’s instances of Jira, Slack, Splunk, RingCentral, and support tickets through Salesforce. I like how it just glosses over access to all the other tools which often contain a treasure trove of data. Just Slack can give an attacker worst case credentials pasted into channels and best case loads of information for more targeted social engineering attacks. LAPSUS$ even stated they had access to over 8K channels.

snowwolf 5y ago
Reading the other trending article on LAPSUS$ (https://news.ycombinator.com/item?id=30774406 https://news.ycombinator.com/item?id=30774406), access to Slack suits their MO perfectly in terms of mining it for data for more sophisticated escalation of access via social engineering.

h0l0cube 5y ago

> an unauthorized user had full super user access to the service From the article: > The majority of support engineering tasks are performed using an internally-built application called SuperUser or SU for short, which is used to perform basic management functions of Okta customer tenants. This does not provide “god-like access” to all its users. This is an application built with least privilege in mind to ensure that support engineers are granted only the specific access they require to perform their roles. They are unable to create or delete users. They cannot download customer databases. They cannot access our source code repositories.

sascha_sl 5y ago
From circulating screenshots, and the omission in the listing here, it looks like they used this account to reset user passwords and MFA on a bunch of tenants. Not being able to create or delete users is meaningless.
- h0l0cube 5y ago
  Fair call. That's an important clarification.
- kasey_junk 5y ago
  Why is it a meaningless distinction to prevent account creation but allow password reset? Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all. Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?
  - sascha_sl 5y ago
    Apparently the "password reset" is more of a "password set" feature.
    - 5y ago

nikanj 5y ago

I believe part of the job description for CxO jobs is "willing to bend reality as per needs of the company"

jeffwask 5y ago

At least he didn't blame the intern...

ecf 5y ago

I’m finding it hard to figure out what the role of a CSO is after this incident. They seem to be the least knowledgeable about the product they’re creating as to offer the highest degree of plausible deniability possible.