Okta, an organization that gives id instruments like multi-factor authentication and single sign-on to 1000’s of companies, has suffered a safety breach involving a compromise of its buyer assist unit, KrebsOnSecurity has realized. Okta says the incident affected a “very small quantity” of shoppers, nevertheless it seems the hackers accountable had entry to Okta’s assist platform for at the least two weeks earlier than the corporate absolutely contained the intrusion.
In an advisory despatched to an undisclosed variety of prospects on Oct. 19, Okta mentioned it “has recognized adversarial exercise that leveraged entry to a stolen credential to entry Okta’s assist case administration system. The risk actor was in a position to view information uploaded by sure Okta prospects as a part of current assist instances.”
Okta defined that when it’s troubleshooting points with prospects it can typically ask for a recording of a Internet browser session (a.ok.a. an HTTP Archive or HAR file). These are delicate information as a result of on this case they embrace the client’s cookies and session tokens, which intruders can then use to impersonate legitimate customers.
“Okta has labored with impacted prospects to research, and has taken measures to guard our prospects, together with the revocation of embedded session tokens,” their discover continued. “Typically, Okta recommends sanitizing all credentials and cookies/session tokens inside a HAR file earlier than sharing it.”
The safety agency BeyondTrust is among the many Okta prospects who obtained Thursday’s alert from Okta. BeyondTrust Chief Know-how Officer Marc Maiffret mentioned that alert got here greater than two weeks after his firm alerted Okta to a possible drawback.
Maiffret emphasised that BeyondTrust caught the assault earlier this month because it was taking place, and that none of its personal prospects have been affected. He mentioned that on Oct 2., BeyondTrust’s safety staff detected that somebody was attempting to make use of an Okta account assigned to one in every of their engineers to create an omnipotent administrator account inside their Okta setting.
When BeyondTrust reviewed the exercise of the worker account that attempted to create the brand new administrative profile, they discovered that — simply half-hour previous to the unauthorized exercise — one in every of their assist engineers shared with Okta one in every of these HAR information that contained a legitimate Okta session token, Maiffret mentioned.
“Our admin despatched that [HAR file] over at Okta’s request, and half-hour after that the attacker began doing session hijacking, tried to replay the browser session and leverage the cookie in that browser recording to behave on behalf of that consumer,” he mentioned.
Maiffret mentioned BeyondTrust adopted up with Okta on Oct. 3 and mentioned they have been pretty assured Okta had suffered an intrusion, and that he reiterated that conclusion in a telephone name with Okta on October 11 and once more on Oct. 13.
In an interview with KrebsOnSecurity, Okta’s Deputy Chief Info Safety Officer Charlotte Wylie mentioned Okta initially believed that BeyondTrust’s alert on Oct. 2 was not a results of a breach in its techniques. However she mentioned that by Oct. 17, the corporate had recognized and contained the incident — disabling the compromised buyer case administration account, and invalidating Okta entry tokens related to that account.
Wylie declined to say precisely what number of prospects obtained alerts of a possible safety problem, however characterised it as a “very, very small subset” of its greater than 18,000 prospects.
The disclosure from Okta comes simply weeks after on line casino giants Caesar’s Leisure and MGM Resorts have been hacked. In each instances, the attackers managed to social engineer staff into resetting the multi-factor login necessities for Okta administrator accounts.
In March 2022, Okta disclosed a breach from the hacking group LAPSUS$, a prison hacking group that specialised in social-engineering staff at focused corporations. An after-action report from Okta on that incident discovered that LAPSUS$ had social engineered its means onto the workstation of a assist engineer at Sitel, a third-party outsourcing firm that had entry to Okta assets.
Okta’s Wylie declined to reply questions on how lengthy the intruder could have had entry to the corporate’s case administration account, or who may need been chargeable for the assault. Nevertheless, she did say the corporate believes that is an adversary they’ve seen earlier than.
“It is a recognized risk actor that we imagine has focused us and Okta-specific prospects,” Wylie mentioned.
Replace, 2:57 p.m. ET: Okta has printed a weblog put up about this incident that features some “indicators of compromise” that prospects can use to see in the event that they have been affected. However the firm confused that “all prospects who have been impacted by this have been notified. In case you’re an Okta buyer and you haven’t been contacted with one other message or technique, there isn’t any impression to your Okta setting or your assist tickets.”
Replace, 3:36 p.m. ET: BeyondTrust has printed a weblog put up about their findings.
