The IT Nerd

You might recall that Okta’s support systems were pwned by hackers. That led to Okta customers getting pwned shortly thereafter. Well, you won’t believe how Okta got pwned. Here’s the details:

The unauthorized access to Okta’s customer support system leveraged a service account stored in the system itself. This service account was granted permissions to view and update customer support cases. During our investigation into suspicious use of this account, Okta Security identified that an employee had signed-in to their personal Google profile on the Chrome browser of their Okta-managed laptop. The username and password of the service account had been saved into the employee’s personal Google account. The most likely avenue for exposure of this credential is the compromise of the employee’s personal Google account or personal device. 

That’s not good from a specific point of view. More on that in a second. Anurag Gurtu, Chief Product Officer at StrikeReady had this to say:

“The recent security breach at Okta serves as a stark reminder of the potential vulnerabilities that can arise from seemingly innocuous practices, like using personal accounts on company devices. This incident underscores the critical need for organizations to reinforce their cybersecurity policies and ensure that employees are fully aware of the risks associated with mixing personal and professional digital activities.

It’s also a call to action for companies to continuously monitor and manage access privileges, and to deploy multi-layered security measures that can detect and mitigate unauthorized access promptly. Effective cybersecurity is not just about having the right tools; it’s about instilling the right discipline and awareness at every level of the organization. As we assist our clients in navigating their cybersecurity landscape, incidents like these are invaluable learning opportunities to fortify their defenses and prepare for the inevitability of human error.”

Okta said the breach impacted 134 customers, representing less than 1% of all their customers. Not that it matters because one customer who was affected by this is one too many. But to me, it really feels that Okta is throwing the employee under the bus here for having a support system that was clearly vulnerable to attack. Honestly, I think Okta needs to do better here for themselves, and more importantly their customers.

On Friday, Okta disclosed a hack of its support systems.Here’s what Okta had to say about that:

The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases. It should be noted that the Okta support case management system is separate from the production Okta service, which is fully operational and has not been impacted. In addition, the Auth0/CIC case management system is not impacted by this incident.

Note: All customers who were impacted by this have been notified. If you’re an Okta customer and you have not been contacted with another message or method, there is no impact to your Okta environment or your support tickets.

Now Okta has had a rough time of it lately as its products have been implicated in a number of high profile hacks. That would include a spate of intrusions at casinos that crippled Las Vegas hotel rooms for days. The MGM hack is an example of this along with the Caesar’s hack. But the hack of Okta itself has had significant downstream effects. 1Password it turns out was affected by this hack:

On September 29, we detected suspicious activity on our Okta instance that we use to manage our employee-facing apps. We immediately terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.

Since then, we’ve been working with Okta to determine the initial vector of compromise. As of late Friday, October 20, we’ve confirmed that this was a result of Okta’s Support System breach.

See our internal Okta Incident Report for additional details.

Cloudflare was also affected by this hack:

On Wednesday, October 18, 2023, we discovered attacks on our system that we were able to trace back to Okta – threat actors were able to leverage an authentication token compromised at Okta to pivot into Cloudflare’s Okta instance. While this was a troubling security incident, our Security Incident Response Team’s (SIRT) real-time detection and prompt response enabled containment and minimized the impact to Cloudflare systems and data. We have verified that no Cloudflare customer information or systems were impacted by this event because of our rapid response. Okta has now released a public statement about this incident.

This is the second time Cloudflare has been impacted by a breach of Okta’s systems. In March 2022, we blogged about our investigation on how a breach of Okta affected Cloudflare. In that incident, we concluded that there was no access from the threat actor to any of our systems or data – Cloudflare’s use of hard keys for multi-factor authentication stopped this attack.  

Ken Westin, Field CISO, Panther Labs had this to say:

Okta is a prime target for attackers and by compromising their systems, they seek to gain access to their customer’s infrastructure and data. The pivot to 1Password should be a wake-up call for organizations to ensure they are monitoring Okta logs, as well as other identity and password applications.

Clearly Okta needs to do some work here as it’s bad enough that Okta gets hacked. It’s worse that its customers are also affected by said hack. Thus Okta and companies that provide similar services need to get their collective acts together to maximize their security or we are all in very deep trouble.

Okta customers have been targeted in a social engineering scam the company said, and on Friday warned of social engineering attacks orchestrated by threat actors to obtain elevated administrator permissions: 

In recent weeks, multiple US-based Okta customers have reported a consistent pattern of social engineering attacks against their IT service desk personnel, in which the caller’s strategy was to convince service desk personnel to reset all Multi-factor Authentication (MFA) factors enrolled by highly privileged users.

The attackers then leveraged their compromise of highly privileged Okta Super Administrator accounts to abuse legitimate identity federation features that enabled them to impersonate users within the compromised organization.

That’s pretty scary. I’ll explain why in a moment. John Gunn, CEO, Token had this comment:

Cybercriminal organizations intentionally and smartly target the organizations that have the richest assets and that will pay the highest ransoms, and with that they focus on compromising the users that have the greatest privileges to gain immediate access to applications and data they are targeting. Because of Okta’s market dominance they are able to get a perspective not available to others and they share this with the market to the benefit of all.

So, why do I think that this is scary? It once again proves that the weakest link in cybersecurity is the people. This sort of attack will not work if people are properly trained and that training is constantly reinforced with “secret shopper” type exercises where people pretend to be threat actors and target the recipients of the training to see if the knowledge is retained. Thus companies need to get onto that train as quickly as possible to bolster their defences.