The IT Nerd

Bleeping Computer is reporting that threat actors have managed to hack into Okta’s private GitHub repositories and swipe source code:

BleepingComputer has obtained a ‘confidential’ security incident notification that Okta has been emailing to its ‘security contacts’ as of a few hours ago. We have confirmed that multiple sources, including IT admins, have been receiving this email notification.

Earlier this month, GitHub alerted Okta of suspicious access to Okta’s code repositories, states the notification.

“Upon investigation, we have concluded that such access was used to copy Okta code repositories,” writes David Bradbury, the company’s Chief Security Officer (CSO) in the email.

Despite stealing Okta’s source code, attackers did not gain unauthorized access to the Okta service or customer data, says the company. Okta’s “HIPAA, FedRAMP or DoD customers” remain unaffected as the company “does not rely on the confidentiality of its source code as a means to secure its services.” As such, no customer action is needed.

At the time of writing our report, the incident appears to be relevant to Okta Workforce Identity Cloud (WIC) code repositories, but not Auth0 Customer Identity Cloud product, given the email wording.

Well, given that Okta provides authentication services and Identity and Access Management services to major companies around the world, this isn’t good. Neither is the fact that this isn’t the first time that Okta has been pwned. Craig Burland, CISO of Inversion6 had this to say:

This continues an awful year for Okta in terms of cybersecurity, adding to high-profile issues in March and September.  While these events appear to be disconnected, it seems possible that the breaches could be part of a larger event, foreshadowing a significant supply chain attack for organizations reliant upon Okta for identity and access services.

As an Okta customer, I would be worried about three things: 1) Is there a fundamental problem with how Okta is managing their environments?  2) Has the Okta platform been somehow compromised that would threaten my operation?  3) What, if anything, can I do quickly to minimize or mitigate the risk to my organization?

How Okta responds to this event and reassures its customers will set the tone for 2023 and may be telling about Okta’s future as the premier provider in this space.

At this point, seeing as Okta can’t secure itself, you have to wonder if they can secure their customers. Because I am questioning that at this very moment.

This must be a weird experience. The Guardian which is one of the U.K.’s biggest newspapers is reporting that they have been likely pwned by ransomware:

The Guardian has been hit by a serious IT incident, which is believed to be a ransomware attack.

The incident began late on Tuesday night and has affected parts of the company’s technology infrastructure, with staff told to work from home.

There has also been some disruption to behind-the-scenes services.

Online publishing is largely unaffected, with stories continuing to be written and published to the Guardian website and app.

The company said it was confident it could still produce Thursday’s print newspaper.

At least they are reporting about their own issues and not hiding anything from what I can tell. That’s better than most companies who don’t come anywhere near that level of transparency.

Dr. Darren Williams, CEO and Founder of BlackFog had this commentary:

     “As we head into the holiday season and people start to take well-deserved time off, an increase in cyberattacks is unfortunately expected. Cybercriminals certainly don’t take a break over the holiday season, as is evident by today’s news about the Guardian. While there are many unknowns about the suspected ransomware attack on the Guardian, we can be confident that data exfiltration was the motive for the attackers. While we are glad to hear the publishers will continue to operate and publish the paper in the run up to the holidays, it’s the aftermath of the cyberattack that is cause for concern. With virtually all new attacks focusing on data exfiltration to extract valuable data for extortion, the damage is often unknown for quite some time. We may be well into the New Year before we know the extent of the fallout.”

It will be interesting to see if that transparency continues and The Guardian tells the world how it was hit and how extensive the pwnage was. Stay tuned to this space.