New Post-Exploitation Attack Method Found Affecting Okta Passwords

A new submit-exploitation attack strategy has been uncovered that allows possible attackers to study users’ passwords and credentials in the audit logs of software by organization identity remedy company Okta.

The system was uncovered by forensic experts Mitiga and discussed in an advisory posted by the crew earlier currently.

“Adversaries with entry to Okta audit logs, whether obtained immediately through the admin console or by way of other units the place logs are shipped, could read through Okta users’ passwords if they had been enter improperly in the username field throughout login,” wrote Okta security scientists Doron Karmi and Or Aspir.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

From a technical standpoint, the flaw derives from the way the Okta system documents unsuccessful login makes an attempt to instances.

“While it may appear like an edge case, this form of password error is a popular a person for users. As a final result, it poses a risk to a lot of Okta buyers,” reads the report.

Karmi and Aspir warned that info attained in such a way could allow danger actors to compromise Okta consumer accounts and accessibility methods or applications that they may have access to, successfully growing the attack’s possible impact.

“By recognizing the credentials of consumers, an attacker can consider to log in as individuals users to any of the organization’s different platforms that use Okta one indicator-on (SSO). Also, this information and facts could be made use of to escalate privileges in the scenario of exposed administrator passwords,” the researchers added.

Browse much more on SSO security right here: Original Entry Broker Activity Doubles in a 12 months

The advisory also prompt that possibly influenced corporations evaluate the use of their log analytics platform or SIEM (security info and occasion administration) where the Okta logs are stored.

“This kind of security risk can arise in any organization that works by using Okta for id and obtain administration,” Karmi and Aspir wrote. “We have established a SQL question that can assist providers determine these likely password exposures.”

Even more, the security researchers recommended that providers use multi-factor authentication (MFA), put into action access controls and checking solutions in SIEM, and educate stop-end users.

In reaction to Mitiga’s disclosure, Otka verified the validity of the exploitation strategy and presented more suggestions for mitigating likely attacks primarily based on it.

The Mitiga advisory comes months soon after Team-IB security scientists unveiled information about a phishing campaign focusing on Okta identification qualifications and connected 2FA codes.

Editorial graphic credit: T. Schneider / Shutterstock.com