4 ms·
> It appears that in our case, the threat-actor was able to hijack a session token from a support ticket which was created by a Cloudflare employee. How does a
by donmcronald 3y ago
> It appears that in our case, the threat-actor was able to hijack a session token from a support ticket which was created by a Cloudflare employee.
How does a session token end up in a support ticket? Are they putting session tokens in URLs or something?
- JshWright 3y agoIt was in a HAR file
- sophacles 3y agoOkta asks for a HAR file of your okta session. By default this includes okta session tokens. The attacker who compromised oktas support systems (again) then used this session token to access customer's okta accounts as the first step in trying to gain access to the customer's systems.