13 ms·
Okta says its GitHub account hacked, source code stolen
- neets 4y agoAt what point are the banks hacked and we just don't know?
- neets 4y agoMaybe some people have audited the fed!?
- jbverschoor 4y agoThey get hacked and robbed regularly. But they’ll never disclose to prevent a run on the bank. There are just a lot of “service interruptions“, like online banking not working for a few hours
- Grimburger 4y agoDon't most western countries have disclosure laws now? This doesn't sound right, not in Australia at least, it would be completely illegal to cover such a thing up and not notify the government cyber agencies.
- Swizec 4y agoTelling the government is not the same as telling you, the consumer. Do disclosure laws say anything about end users? Even if said users aren’t affected?
- sofixa 4y agoGDPR (so the whole of the EU+UK) does, yes.
- SXX 4y agoIf you google for "us bank data breach" you'll find plenty of examples of this happening and being disclosed. However banking regulations are strict and banks own systems are designed to be resistant to insider attacks. So everything usually designed to keep different kind of data within bank own systems isolated and audited. In most of small and middle sized IT companies there is rarely any security measures against insider attacks or just accidental leaks if someone been too incompetent when it come to security. So leaks of sensetive data happen far more often since plenty of SWE and DevOps can easily get access to all the production databases. As result deployment of some single line fix in code of some critical system in a major bank might easily take 3-6 months.
- dzikimarian 4y agoIn EU you have to inform proper officials and everyone who were impacted. Failure to do so may result in fine up to 10 mln euro or 2% global revenue. There's some reports - not that many. Honestly I would say that the banks are not very attractive target - it's not easy to extract reasonable amount of money that way (better to directly scam end user), and security is usually at least a bit above average, so for personal data it's easier to hack some e-commerce store.
- SXX 4y agoThey are hacked, but you will never know or be personally affected. This is why banks are strictly regulated and have insurance for everything and agreements with whoever manage their IT and security.
- pas 4y ago> you will never know maybe. GDPR has a notification of breach requirement. we shall see.
- Nextgrid 4y agoGDPR enforcement is laughable. Come back when Facebook and Google are fined out of existence and then you’ll have a point.
- sofixa 4y agoObligatory https://www.enforcementtracker.com https://www.enforcementtracker.com With regards to Facebook and Google, there are recent news on that front: https://techcrunch.com/2022/11/28/facebook-gdpr-penalty/ https://techcrunch.com/2022/11/28/facebook-gdpr-penalty/ https://www.thedrum.com/news/2022/11/15/googles-400m-penalty-the-impact-the-5-heftiest-data-privacy-fines-2023-ad-plans https://www.thedrum.com/news/2022/11/15/googles-400m-penalty...
- Nextgrid 4y agoMy point is that the “obligatory” link is getting annoying when tallying up the total amount of fines over the last 4 years across all companies is still less than the yearly profit of the single biggest offender. And yes, the news you mention are welcome but I’m not holding my breath - they’ve been allowed to brazenly breach the regulation for 4 years and one of the regulators even ended up being corrupt and collaborated with them behind the scenes.
- SXX 4y agoGDPR is only applies when personal data is involved. Banks usually have all client data well isolated from everyone including most of IT staff so credit card data being stolen isn't always mean that personal data is affected.
- harryf 4y agoCentralized authentication systems. What could go wrong ?
- Nextgrid 4y agoNothing is going wrong as long as adequately dissuasive penalties aren't being levied against companies with terrible security practices. It's business as usual. Okta has been breached previously, with actual access to end-customer data, and so did Equifax, who leaked the credit reports of ~140M people. Both companies are still alive and thriving.
- shusaku 4y agoIf only they had managed their GitHub logins with Okta
- alex_duf 4y agoI know it's probably sarcasm, but just in case: I don't think they should, otherwise they could find themselves in a situation where an outage prevents them from fixing the outage.
- politelemon 4y agoI'm not seeing details of how, though. Was it some leaked tokens? Employee credentials? Also shouldn't this be called a security incident rather than event. https://advisera.com/27001academy/blog/2018/12/03/iso-27001-information-security-event-vs-incident-vs-non-compliance/ https://advisera.com/27001academy/blog/2018/12/03/iso-27001-...
- Godel_unicode 4y agoEveryone uses those words differently and no two groups agree. Event is often used since it’s the most generic. Also, many companies have requirements around their use of certain words and this might not meet their lawyers definition of incident.
- Vanit 4y agoA company I previously worked at would call this a CRI; critical room for improvement.
- pointlessone 4y agoFree involuntary security audit
- js8 4y agoThe results of the audit will be provided to 3rd parties, in the form of additional involuntary free audits.
- vntok 4y agoUnplanned decentralized backup.
- cutemonster 4y agoWrite-only backups, from Okta's perspective
- trallnag 4y agoNot so fast, maybe the attackers will provide the backups for a small fee
- rvz 4y agoSo unprofessional for a security company to be hosting their code on GitHub and connecting with lots of silly integrations, access tokens, etc. Okta has not learned their lesson with security with this hack, especially when they got themselves breached before in January.
- terom 4y agoHow so? It refutes that right there in the advisory: > Okta does not rely on the confidentiality of its source code as a means to secure its services. Would it be more professional for them to host their code in a public repo?
- robertlagrant 4y agoIt might be, yes. With the right protections on pull requests.
- bennyelv 4y agoDid they decide that that was their strategy before or after this breach occurred? They were trying to keep their source code secure, and they failed. Not a great look for a company that ask you to trust them with all of your user accounts.
- grishka 4y agoYes? What do they have to gain from the code not being public?
- madcadmium 4y agoCompetitive advantage?
- papito 4y agoThat's not a bad point. GitHub is convenient, yes, but if you manage security for companies that are collectively worth billions, you want to minimize your attack surface. In my experience, security is usually an afterthought in most tech companies. Just look at how many MongoDB instances in production were running on open ports with the default password, which was... no password.
- jsiepkes 4y agoWonder if we are ever going to known how this happened. Curious to know if Okta themselves were using best practices such as only using a hardware token as 2FA (FIDO2) and disabling SMS 2FA and recovery.
- pedrogpimenta 4y ago[flagged]
- thedataangel 4y agoThat's the stupidest password I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!
- omgmajk 4y agoAnd yet it consistently ranks high on passwords still in use. This is a clickbaity article but there are better ones out there https://www.cnbc.com/2022/11/23/most-common-passwords-of-2022-make-sure-yours-isnt-on-the-list.html https://www.cnbc.com/2022/11/23/most-common-passwords-of-202...
- nosianu 4y agoJust FYI for those who missed it: The previous comments were referring to the famous and really hilarious Mel Brooks movie "Spaceballs", this scene in particular: https://youtu.be/a6iW-8xPw3k https://youtu.be/a6iW-8xPw3k
- fragmede 4y agoHackers claimed to have broken in 9 months ago in a different incident. https://news.ycombinator.com/item?id=30762520 https://news.ycombinator.com/item?id=30762520
- mijoharas 4y agoAccording to this article that was confirmed by Okta: > Okta shortly acknowledged that the hack being referred to had in fact occurred late January 2022
- TechBro8615 4y agoCritically, it was confirmed by Okta only after the hackers went public, despite Okta having knowledge of the breach before then.
- andyjsong 4y agoEven if the hacker was able to start an Okta competitor with their source code, how many companies would actually buy it? Who would maintain it? Or am I missing something here, what would they use the source code for?
- random_savv 4y agoMy first thought: it's a lot easier to find vulnerabilities if you have the source code
- fakedang 4y agoExactly. Why would I start a competitor when I could easily sell zero days to dictatorial regimes and make millions or possible billions? Or utilize them myself?
- SXX 4y agoFirst of all why do you think that everything have to be done to profit off it? A lot of security research including blackhat one is done just for fun and might be it was some kind of white hat attempt gone wrong and was never reported to them as result. Also it very much possible that whoever "hacked" their GitHub account just stumbled into some important API token accidentally left in public by someone of their employees. And even if there is malicious intent there are more ways to use it. E.g Okta is public company and whoever have access to it confidencial data can manipulate their stock.
- revskill 4y agoI don't think it's a surprise. Security is always a tradeoff between complexity and simplicty in software design.
- int0x2e 4y agoWhen your product basically is security, that's not really a compromise you get to make...
- 0xmarcin 4y agoMaybe services like Okta (at least the core part without UI, just like macOS & Darwin) should be open source by default? That would be a good policy to forcibly open source anything connected to encryption/authorization/authentication or PKI. Whoever solen this code can sell it to criminals/evil countries/black hats around the world, so on Okta's place I would start scanning the code with all available static checkers and fix as much and as fast as I could. Okta become quite popular among startups, I used it at my prev work and I use it at my current job. I even considering investing into its stock. My only complain is that it is somehow slow, otherwise UI is acceptable and Chrome plugin is OKish.
- Nextgrid 4y agoThere's nothing in Okta that isn't already open-source in projects like Keycloak or Ory. Okta is a terrible, expensive, and potentially incompetent (this is not their first breach) hosted knockoff of the above.
- toyg 4y agoThey are to auth what Zoom is to webconfs: Just Bad But Good At Marketing. In the winner-takes-all environment of the web economy, they must be making pretty good money.
- lmm 4y agoZoom legitimately has better video quality than everyone else. I wish they didn't but they do.
- theshrike79 4y agoZoom client also Just Works. I can test the mic and video before joining. I can also change my mic and video source after joining. You'd think that both are 100% basic features, but nope. Can't do either in Google Meet or Teams...
- 4y ago
- leftcenterright 4y agoRed flags for me: - Github alerted Okta about the access, they were not able to detect this themselves (https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization https://docs.github.com/en/organizations/keeping-your-organi...) - It only says "access to code repositories" (it does not say anything about the level of that access, it might as well mean write access, capability to trigger actions etc.) - Not relying on the confidentiality of source code is great, but malicious CD workflow actions would still be a risk if attackers had that level of access. - No information about the entry point for compromise. I doubt their 'commitment to transparency'.
- axsharma 4y agoAdd to it that they reviewed "all recent commits to Okta software repositories." Due diligence or indicative of the threat actor having write access? Many unanswered questions.
- twistedpair 4y agoA good reason to give engineers PGP keys and turn on the "required code signing" feature on your org. Alas, security and productivity are perpetual odds.
- chrisshroba 4y agoJust wondering - would this meaningfully impact productivity beyond causing engineers to have to learn how to sign a commit (which would presumable take less than an hour, once)?
- ghostpepper 4y agoActually generating a key and signing commits is pretty easy. I think the harder part would be ensuring all devs safely store the keys, rotate them regularly, etc.
- 4y ago
- luc_ 4y agoIMO, it's a bit weird they would even host their source code on open-facing GitHub. Of course I don't know the whole story, but seems like a company dealing with security would benefit from hosting their on VCS, perhaps GitHub enterprise, behind a VPN..?
- mdaniel 4y agoThat's one of those weird questions: does Okta have more resources for knowing abnormal VCS behavior, or GitHub? IMHO the network is no longer the correct security boundary, and I hope I never encounter a VPN in my career ever again
- madcadmium 4y agoThat would be contrary to Okta's zero-trust security model.
- ngc6677 4y agoWell, let's see how it goes for security by obfuscation; glhf
- noisy_boy 4y agoMaybe they should consider being Github's secret scanning partner.
- mdaniel 4y agoThat goes double because Okta's token scoping is a raging dumpster fire, which forces customers to use God Tokens or GTFO. I hate it with all my heart
- koliber 4y agoMaybe the hackers will be able to fix some of the bugs Okta could never figure out how to fix!
- nonethewiser 4y agoDidnt Okta have another security breach recently?
- wepple 4y ago2021: office network breach via a security camera 2022: hacker group leaked customer information stolen from third part customer support engineer. 2022: this one So not the worst breaches, but also definitely what you want happening to your identity provider. Edit: formatting
- hericium 4y agoIf Okta admits to being breached or having something stolen from them, I wonder how many months ago was that. Guess we'll have to wait for Cloudflare post to get reliable info.
- LinuxBender 4y agoThe bigger concern to me is not Okta but rather the companies it acquired. One of them specifically integrates directly with Okta to manage agents running on production servers as root. This would be an incredibly valuable target, much more so than access to some web front-ends. In some cases the damage done through a web front end can be rolled back assuming an audit trail. Damage done to large numbers of servers in many companies as root would be quite challenging and time consuming to remediate and that is assuming tested backups are in place that root can not tamper with. I have failed to convince companies to have backups that root can not tamper with. If I were Okta that is the first thing I would be locking down ASAP.
- madcadmium 4y agoLocking down what, exactly?
- thedougd 4y agoTheir public repos include .travis.yml files. Perhaps Okta is still feeling effects from the TravisCI breach?
- captn3m0 4y agoThe Early December timeline matches.
- deleted 4y ago[deleted]
- Decabytes 4y agoI don't know how I feel about this. On the one hand Okta's position in the market makes them a high value target to hack. Between the Lapsus$ hack in April and this, Okta has had a rough year. At the same time I feel like they should know better, and I hated the way they handled the Lapsus$ breach, trying to hand wave the potential damage away
- TechBro8615 4y agoIt's pretty clear how to feel about this: unsurprised. Their internal infrastructure was pwned by some 16 year old chavs who broke into support software with unjustifiable "superuser" features accessible by any employee. And Okta never intended to reveal that to us until the chavs themselves made it known. This is a company that "literally" has one job - to protect the security of user accounts and facilitate login. Their product is simple and its development velocity is extremely slow. As a developer who has integrated Okta into multiple products, I've never gotten the feeling it's being run by a competent crew of software engineers, nevermind security professionals. It's entirely unsurprising to me that they would be compromised at this level. Not only are they a juicy target, but they've proven themselves generally incompetent at performing their basic job.
- atonse 4y agoThe only reason we picked okra is because a lot of our downstream vendors had Okta integration. I’m starting to wonder if there’s some kind of incentive given out or whether it’s one of those “let’s support okta cuz everyone uses it.” And then SaaS customers also say “let’s use okta cuz all our SaaS products keep mentioning it”?
- deleted 4y ago[deleted]
- gabrielsroka 4y agohttps://sec.okta.com/articles/2022/12/okta-code-repositories https://sec.okta.com/articles/2022/12/okta-code-repositories
- trallnag 4y agoIn the end somebody has to pay for all the additional investments into security and many are not willing to do that. In addition, a secure system is a moving target and it is difficult to find the right balance. Breaches like this are important for us to refocus. Thanks for your service, Okta!
- sdiacom 4y agoClearly someone is paying for additional investments into security. GitHub, that is.