Cybersafetyconnections October 23,2023 vol#140
- Again, from Konbriefing Okta suffered unauthorized access to its support case management system 2 months after a social engineering cyberattack.
- Some of Okta’s customers were affected and have been notified.
- It is possible the unauthorized access has something to do with troubleshooting sessions.
- Okta took further steps to mitigate loss.
What happened?
Okta Security has identified that an unauthorized individual gained access to Okta’s support case management system using a stolen credential. According to Cybersecurity dive the attack involved a threat actor who accessed customer support tickets and files containing sensitive data. Okta’s Chief Security Officer, David Bradbury, confirmed that the threat actor was able to view files uploaded by certain Okta customers as part of recent support cases .
Who was affected?
Some of Okta’s customers were affected. It’s important to note that the Okta support case management system is separate from the production Okta service, which has not been impacted and is fully operational. It is worth noting that the attack comes two months after four of Okta’s customers fell victim to social-engineering attacks that compromised the accounts of highly privileged users.
Additionally, the Auth0/CIC case management system was not impacted by this incident. All customers who were impacted by this issue have been notified. If an Okta customer has not received any communication from Okta, then there is no impact to their Okta environment or support tickets.
Why did this happen?
A possible cause of unauthorized access could be found in the troubleshooting process. It is possible that during the normal course of business, Okta support may have asked customers to upload an HTTP Archive (HAR) file to troubleshoot issues by replicating browser activity. However, HAR files can contain sensitive data such as cookies and session tokens, which can be used by malicious actors to impersonate valid users.
How is the loss being mitigated?
- Okta has worked with affected customers to investigate and has taken measures to protect them, including revoking embedded session tokens.
- In general, Okta recommends sanitizing all credentials and cookies/session tokens within a HAR file before sharing it.
- Okta is sharing Indicators of Compromise to help customers perform their own threat hunting activities.
- Okta also recommends referring to their previously published advice on how to search System Log for any suspicious session, user, or IP. It is worth noting that most of the indicators are commercial VPN nodes according to Okta’s enrichment information.
Conclusion
This second cyberattack incident highlights the importance of staying alert and being vigilant against suspicious activity.
Subscribe to get the latest blog post.
