Okta’s Support System Breach Exposes Customer Data to Unidentified Threat Actors

Id companies provider Okta on Friday disclosed a new security incident that permitted unidentified threat actors to leverage stolen qualifications to access its aid situation management program.

“The threat actor was able to look at data files uploaded by selected Okta consumers as component of recent help scenarios,” David Bradbury, Okta’s main security officer, claimed. “It need to be observed that the Okta help scenario administration system is individual from the creation Okta company, which is totally operational and has not been impacted.”

The company also emphasized that its Auth0/CIC case management method was not impacted by the breach, noting it has instantly notified shoppers who have been impacted.

Nonetheless, it mentioned that the purchaser assist procedure is also applied to add HTTP Archive (HAR) files to replicate conclusion person or administrator glitches for troubleshooting purposes.

“HAR files can also comprise sensitive details, which include cookies and session tokens, that destructive actors can use to impersonate valid people,” Okta warned.

It more explained it worked with impacted consumers to guarantee that the embedded session tokens ended up revoked to avert their abuse.

Okta did not disclose the scale of the attack, when the incident took area, and when it detected the unauthorized accessibility. As of March 2023, it has more than 17,000 clients and manages all around 50 billion people.

That mentioned, BeyondTrust and Cloudflare are amongst the two customers who have confirmed they had been focused in the most recent assist system attack.

“The danger-actor was in a position to hijack a session token from a guidance ticket which was established by a Cloudflare worker,” Cloudflare explained. “Utilizing the token extracted from Okta, the danger-actor accessed Cloudflare programs on Oct 18.”

Describing it as a advanced attack, the web infrastructure and security corporation mentioned the menace actor guiding the activity compromised two independent Cloudflare employee accounts inside the Okta system. It also explained that no consumer facts or methods had been accessed as a outcome of the occasion.

BeyondTrust said it notified Okta of the breach on October 2, 2023, but the attack on Cloudflare indicates that the adversary had access to their guidance devices at the very least until eventually October 18, 2023.

The identification management expert services firm reported its Okta administrator had uploaded a HAR file to the technique on Oct 2 to solve a support issue, and that it detected suspicious exercise involving the session cookie inside 30 minutes of sharing the file. The attempted attacks against BeyondTrust were eventually unsuccessful.

“BeyondTrust immediately detected and remediated the attack as a result of its possess identity applications, Id Security Insights, resulting in no effects or publicity to BeyondTrust’s infrastructure or to its clients,” a spokesperson for the company instructed The Hacker Information.

The progress is the most current in a prolonged checklist of security mishaps that have singled out Okta around the past few decades. The firm has come to be a large-price focus on for hacking crews for the fact that its one signal-on (SSO) expert services are made use of by some of the most significant businesses in the globe.

Located this write-up exciting? Adhere to us on Twitter  and LinkedIn to examine extra distinctive material we put up.

Some components of this short article are sourced from:
thehackernews.com