www.helpnetsecurity.com Open in urlscan Pro
34.216.4.50  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1698155798"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Please turn on your JavaScript for this page to function normally.
Zeljka Zorz, Editor-in-Chief, Help Net Security
October 24, 2023
Share


1PASSWORD ALSO AFFECTED BY OKTA SUPPORT SYSTEM BREACH



Following in the footsteps of BeyondTrust and CloudFlare, 1Password has revealed
that it has been affected by the Okta Support System breach.



“On September 29, we detected suspicious activity on our Okta instance that we
use to manage our employee-facing apps,” said 1Password’s CTO Pedro Canahuati.

“We immediately terminated the activity, investigated, and found no compromise
of user data or other sensitive systems, either employee-facing or user-facing.”


THE OKTA SUPPORT SYSTEM BREACH

David Bradbury, Chief Security Officer at Okta, disclosed last Friday that an
attacker has “leveraged access to a stolen credential to access Okta’s support
case management system” and “view files uploaded by certain Okta customers as
part of recent support cases.”

The files in question are HTTP Archive (HAR) files, which are generated by web
browsers to log interactions with a website. Okta’s support team asks customers
to share these files so they can troubleshoot issues by replicating browser
activity.

“HAR files can also contain sensitive data, including cookies and session
tokens, that malicious actors can use to impersonate valid users,” he explained.

Bradbury says that the production Okta service and the company’s Auth0/CIC case
management system have not been impacted, and that the company notified all
customers that were impacted by this.


BEYONDTRUST AND CLOUDFLARE

Soon after Okta’s announcement, BeyondTrust and Cloudflare confirmed that they
were among the customers affected by the breach. Both companies revealed that
they detected attacker activity before getting notified by Okta.

“On October 2nd, 2023, the BeyondTrust security teams detected an
identity-centric attack on an in-house Okta administrator account,” said Marc
Maiffret, CTO at BeyondTrust.

“The initial incident response indicated a possible compromise at Okta of either
someone on their support team or someone in position to access customer
support-related data.”

They raised their concerns of a breach to Okta on the same day, but it took 17
days for Okta security leadership to notify them of the breach and the fact that
they were one of their affected customers.

The attacker used the session cookie from this support ticket to attempt to:

 * Access the BeyondTrust Okta admin console (and was blocked)
 * Generate a password health report using the API of the Okta admin console
 * Gain access to main Okta dashboard (denied)

The threat actor succeeded in using Okta’s official API to create a fake service
account, but the company’s security team immediately disabled it and revoked the
attacker’s access before the account could be used and preventing any further
actions.

“We saw no evidence of other irregular activity across all other privileged Okta
users in Identity Security Insights, no evidence of other suspicious Okta
accounts being created, and no evidence of any unusual activity in the targeted
user’s account before this incident,” Maiffret added.

Cloudflare’s engineers and CSO Grant Bourzikas said that they discovered attacks
on their system on Wednesday, October 18, 2023.

“The attacker used an open session from Okta, with Administrative privileges,
and accessed our Okta instance,” they explained.

The threat actor compromised two separate Cloudflare employee accounts within
the Okta platform, but the company’s security team cut their access before they
were able to establish persistence.

They also pointed out that this is the second time Cloudflare has been impacted
by a breach of Okta’s systems.

The first one happened in early 2022, but threat actors couldn’t access
Cloudflare systems or data because the company uses of hardware keys for
multi-factor authentication (MFA). (The use of phishing-resistant MFA also
helped Cloudflare avoid getting breached by phishers later that same year.)

“The key to mitigating this week’s incident was our team’s early detection and
immediate response,” the Cloudflare team said.


1PASSWORD

In the run-up to the attack, a member of the 1Password IT team shared a HAR file
with Okta support, the company explained in an internal incident report they
shared with the public.

In the early morning hours of September 29, 2023, the threat actor used the same
Okta session that was used to create the HAR file to access the Okta
administrative portal.

The attacker then tried to access the IT team member’s user dashboard (and was
blocked by Okta), updated an existing IDP (identity provider) tied to
1Password’s production Google environment and activated it, and requested a
report of administrative users.

“The final action in that list resulted in an email being sent to the member of
the IT team and alerted them to this event. At this point it is known that the
unknown actor performed other less sensitive actions (such as viewing groups)
that did not result in log entries; Okta is working to pull log entries for
these actions for us to review,” they added.

1Password’s security team removed the Google IDP that the attacker enabled, so
they couldn’t use it when they returned on October 2.

“In both cases, the actor accessed Okta via a server hosted by LeaseWeb in the
US, and used a very similar and older version of Chrome (though different
operating systems). It is unknown if the actor possesses valid Google account
credentials that would have allowed them to complete a login via this IDP.”

They noted that they found no compromise of user data or other sensitive systems
in their follow-up investigation.

1Password’s incident report reveals how the company traced the attempted breach
back to a compromise of Okta’s Support System.


ADVICE FOR OKTA CUSTOMERS

Okta, BeyondTrust and CloudFlare have shared indicators of compromise and
detections that can help other companies check for evidence of these specific
attacks. They’ve also shared helpful insights and recommended security posture
improvements.

Okta says that all customers who were impacted have been notified and urged all
customers to sanitize credentials and cookies/session tokens within HAR files
before sharing it with Okta’s support team.

“Modern identity-based attacks can be complex, and as this attack shows, can
originate from environments outside your own.

BeyondTrust’s CTO Maiffret noted that while good specific policies and internal
controls to limit things like how HAR files are shared are necessary, defense in
depth is important to spot and block modern identity-based attacks.

“The failure of a single control or process should not result in breach. Here,
multiple layers of controls — e.g. Okta sign on controls, identity security
monitoring, and so on, prevented a breach,” he pointed out.





More about
 * 1Password
 * authentication
 * BeyondTrust
 * CISO
 * Cloudflare
 * cybersecurity
 * identity protection
 * Okta
 * privileged identity

Share


FEATURED NEWS

 * Bracing for AI-enabled ransomware and cyber extortion attacks
 * Microsoft announces wider availability of AI-powered Security Copilot
 * “Disappearing” implants, followed by first fixes for exploited Cisco IOS XE
   zero-day

Webinar: Tackle compiler-born vulnerabilities



SPONSORED

 * eBook: Cybersecurity career hacks for newcomers
 * Guide: SaaS Offboarding Checklist
 * Webinar: The external attack surface & AI’s role in proactive security




DON'T MISS

 * Bracing for AI-enabled ransomware and cyber extortion attacks
 * Microsoft announces wider availability of AI-powered Security Copilot
 * “Disappearing” implants, followed by first fixes for exploited Cisco IOS XE
   zero-day
 * How passkeys are changing the face of authentication
 * Navigating OT/IT convergence and securing ICS environments




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2023 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×