Okta says attacker accessed engineer’s laptop for five days

Okta chief security officer David Bradbury reported in a publish Tuesday that “the Okta provider has not been breached and stays entirely operational.”

“There are no corrective steps that require to be taken by our buyers,” Bradbury reported.

Nevertheless, an attacker did accessibility the account of a shopper assist engineer, who labored for a third-celebration service provider, for five days in January, according to Bradbury. The third-bash provider was not recognized.

“There was a five-working day window of time between January 16-21, 2022, wherever an attacker experienced accessibility to a support engineer’s notebook. This is regular with the screenshots that we became conscious of yesterday,” Bradbury mentioned.

Bradbury referred to screenshots posted on Telegram by hacker team Lapsus$, demonstrating what the group stated was “access to Okta.com Superuser/Admin and different other units.”

The possible breach of a customer of the big identification and obtain administration seller elevated queries about the extent and severity of the prospective breach.

Protection researcher Runa Sandvik explained on Twitter that some may possibly be “confused about Okta indicating the ‘service has not been breached.’”

“The assertion is purely a legal term soup,” Sandvik reported. “Fact is that a 3rd-social gathering was breached that breach impacted Okta failure to disclose it influenced Okta’s clients.”

VentureBeat has reached out to Okta for comment.

‘Limited’ affect

In the publish Tuesday, Bradbury mentioned that the “potential effects to Okta shoppers is confined to the accessibility that guidance engineers have.”

These engineers “are unable to create or delete end users, or obtain customer databases. Help engineers do have accessibility to constrained knowledge – for example, Jira tickets and lists of users – that ended up seen in the screenshots,” he mentioned. “Support engineers are also ready to facilitate the resetting of passwords and MFA aspects for buyers, but are unable to attain those passwords.”

Okta is “actively continuing our investigation, such as identifying and making contact with those shoppers that may well have been impacted,” Bradbury claimed.

From the article:

In January 2022, Okta detected an unsuccessful attempt to compromise the account of a consumer assistance engineer doing work for a third-celebration service provider. As aspect of our normal methods, we alerted the supplier to the condition, although at the same time terminating the user’s energetic Okta periods and suspending the individual’s account. Adhering to these actions, we shared pertinent information and facts (together with suspicious IP addresses) to complement their investigation, which was supported by a third-occasion forensics agency.

Next the completion of the support provider’s investigation, we been given a report from the forensics firm this 7 days. The report highlighted that there was a five-working day window of time amongst January 16-21, 2022, exactly where an attacker had access to a assist engineer’s notebook. 

Okta’s inventory price was down $5.49, or about 3.2%, as of mid-afternoon ET on Tuesday. An analyst at Truist, Joel Fishbein, reportedly referred to as the claimed breach “concerning” amid reducing his score on Okta.

Lapsus$ specified that it did not obtain Okta itself. “Our concentrate was ONLY on okta shoppers,” the team stated in its Telegram put up.

Lapsus$ is thought to run in South The usa. More than the previous month, vendors which include Nvidia and Samsung Electronics confirmed the theft of info by the danger actor. On March 1, for occasion, Nvidia explained that “we are conscious that the risk actor took employee qualifications and some Nvidia proprietary data from our systems and has started leaking it on the net.”

Stolen Nvidia info reportedly involved designs of graphics cards and supply code for DLSS, an AI rendering technique. Meanwhile, on Monday, Lapsus$ claimed to have posted Microsoft supply code for Bing, Bing Maps and Cortana. Microsoft said it is mindful of the promises and is investigating them.

Experts have reported that Lapsus$’ motives remain unclear, specified the lack of economical needs in the past.