Pierluigi Paganini March 24, 2022

The provider of access management systems Okta confirmed the data breach and revealed that 2.5% of its customers were impacted.

This week Lapsus$ extortion group claimed to have stolen sensitive data from the identity and access management giant Okta solutions.

The gang announced the alleged hack through its Telegram channel and shared a series of screenshots as proof of the hack. Some of the images published by the threat actors appear to be related to the company’s customer data.

The message published by the group claims that the gang had Superuser and Admin access to multiple systems of the company.

The company launched an investigation into the claims of a data breach, while Todd McKinnon, CEO at Okta, confirmed that in late January 2022, the company detected an attempt to compromise the account of a third-party customer support engineer working for one of its subprocessors.

Okta confirmed the security breach and revealed that it has impacted 2.5% of its customers (approximately 375), but pointed out that they have no action that should do.

Okta confirmed that the Lapsus$ extortion group compromised the laptop of one of its support engineers that allowed them to reset passwords for some of its customers.

Investigators discovered that the attackers had access to the laptop for five days starting from January 16, 2022.

“Following the completion of the service provider’s investigation, we received a report from the forensics firm this week. The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop. This is consistent with the screenshots that we became aware of yesterday.” reads the advisory published by the company. “The potential impact to Okta customers is limited to the access that support engineers have. These engineers are unable to create or delete users, or download customer databases. Support engineers do have access to limited data – for example, Jira tickets and lists of users – that were seen in the screenshots. Support engineers are also able to facilitate the resetting of passwords and multi-factor authentication factors for users, but are unable to obtain those passwords.”

Okta has identified impacted customers and notified the incident by email.

The Lapsus$ group responded to Okta’s announcement and revealed that they did not compromise an Okta employee’s laptop but their thin client.

Below is the Lapsus$’s gang reply published on their Telegram channel:

I do enjoy the lies given by Okta.

• 1. We didn’t compromise any laptop? It was a thin client.
• 2. “Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider.” – I’m STILL unsure how its a unsuccessful attempt? Logged in to superuser portal with the ability to reset the Password and MFA of ~95% of clients isn’t successful?
• 4. For a company that supports Zero-Trust. *Support Engineers* seem to have excessive access to Slack? 8.6k channels? (You may want to search AKIA* on your Slack, rather a bad security practice to store AWS keys in Slack channels)
• 5. Support engineers are also able to facilitate the resetting of passwords and MFA factors for users, but are unable to obtain those passwords. – Uhm? I hope no-one can read passwords? not just support engineers, LOL. – are you implying passwords are stored in plaintext?
• 6. You claim a laptop was compromised? In that case what *suspicious IP addresses* do you have available to report?
• 7. The potential impact to Okta customers is NOT limited, I’m pretty certain resetting passwords and MFA would result in complete compromise of many clients systems.
• 8. If you are committed to transparency how about you hire a firm such as Mandiant and PUBLISH their report? I’m sure it would be very different to your report 🙂 _________________________________________________________________________________________________________________________________________________________________________________________________________ https://www.okta.com/sites/default/files/2021-12/okta-security-privacy-documentation.pdf *21. Security Breach Management. a) Notification: In the event of a Security Breach, Okta notifies impacted customers of such Security Breach. Okta cooperates with an impacted customer’s reasonable request for information regarding such Security Breach, and Okta provides regular updates on any such Security Breach and the investigative action and corrective action(s) taken.* – But customers only found out today? Why wait this long?
• 9. Access Controls. Okta has in place policies, procedures, and logical controls that are designed: b. Controls to ensure that all Okta personnel who are granted access to any Customer Data are based on leastprivilege principles; kkkkkkkkkkkkkkk 1. Security Standards. Okta’s ISMP includes adherence to and regular testing of the key controls, systems and procedures of its ISMP to validate that they are properly implemented and effective in addressing the threats and risks identified. Such testing includes: a) Internal risk assessments; b) ISO 27001, 27002, 27017 and 27018 certifications; c) NIST guidance; and d) SOC2 Type II (or successor standard) audits annually performed by accredited third-party auditors (“Audit Report”). I don’t think storing AWS keys within Slack would comply to any of these standards?

Over the last months, the Lapsus$ gang compromised other prominent companies such as Microsoft, NVIDIA, Samsung, Ubisoft, Mercado Libre, and Vodafone.

The group has now announced a temporary pause until 30/3/2022.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Okta)

[adrotate banner=”5″]

[adrotate banner=”13″]