3 ms·
> an unauthorized user had full super user access to the service From the article: > The majority of support engineering tasks are performed using an internal
by h0l0cube 5y ago
> an unauthorized user had full super user access to the service
From the article:
> The majority of support engineering tasks are performed using an internally-built application called SuperUser or SU for short, which is used to perform basic management functions of Okta customer tenants. This does not provide “god-like access” to all its users. This is an application built with least privilege in mind to ensure that support engineers are granted only the specific access they require to perform their roles. They are unable to create or delete users. They cannot download customer databases. They cannot access our source code repositories.
- sascha_sl 5y agoFrom circulating screenshots, and the omission in the listing here, it looks like they used this account to reset user passwords and MFA on a bunch of tenants. Not being able to create or delete users is meaningless.
- h0l0cube 5y agoFair call. That's an important clarification.
- kasey_junk 5y agoWhy is it a meaningless distinction to prevent account creation but allow password reset? Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all. Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?
- sascha_sl 5y agoApparently the "password reset" is more of a "password set" feature.
- kasey_junk 5y agoWhere was that outlined? All of the screen dumps I saw showed what looked like a reset.
- yibg 5y agoWhy is password reset considered a big issue? If I know your email / login I can go reset your password for a bunch of stuff now without any breach.
- ecf 5y agoKinda unrelated, but how did job title inflation get this bad? Support _Engineer_ that is using a prebuilt application to do stuff like reset MFA. In what world does this have anything to do with engineering?