Pierluigi Paganini November 29, 2023

Cloud identity and access management solutions provider Okta revealed additional threat actor activity linked to the October 2023 breach.

Okta provided additional details about the October 2023 breach and revealed additional threat actor malicious activities.

In October, the Cloud identity and access management solutions provider said that threat actors broke into its support case management system and stole authentication data, including cookies and session tokens, that can be abused in future attacks to impersonate valid users.

Okta asks customers to upload an HTTP Archive (HAR) file in order to support them in solving their problems and replicating browser activity. HAR files can also contain sensitive data, including authentication information.

According to the advisory published by the company, Okta Security has identified adversarial activity abusing access to a stolen credential to gain access Okta’s support case management system.

The attackers gained access to files uploaded by certain Okta customers as part of some recent support cases.

“On Thursday, October 19, Okta advised customers of a security incident. Having finalized our investigation, we can confirm that from September 28, 2023 to October 17, 2023, a threat actor gained unauthorized access to files inside Okta’s customer support system associated with 134 Okta customers, or less than 1% of Okta customers.” reads the post published by the company. “Some of these files were HAR files that contained session tokens which could in turn be used for session hijacking attacks. The threat actor was able to use these session tokens to hijack the legitimate Okta sessions of 5 customers, 3 of whom have shared their own response to this event.”

The three customers who shared their own responses to the event are Cloudflare, 1Password, and BeyondTrust.

The attackers gained access to Okta’s customer support system by leveraging a service account stored in the system itself. The service account was granted permissions to view and update customer support cases. The security team at the company identified that an employee had signed-in to their personal Google profile on the Chrome browser of their Okta-managed laptop.

This week Okta shared new information about the attack, the intruders gained access to the names and email addresses of all Okta customer support system users.

“We have determined that the threat actor ran and downloaded a report that contained the names and email addresses of all Okta customer support system users. All Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers are impacted except customers in our FedRamp High and DoD IL4 environments (these environments use a separate support system NOT accessed by the threat actor). The Auth0/CIC support case management system was also not impacted by this incident.” reads the update provided by the company. “The threat actor ran a report on September 28, 2023 at 15:06 UTC”

Data included in the report are in the following table:

The company pointed out that most of the fields are blank and the report does not include user credentials or sensitive personal data. For 99.6% of users in the report, the only contact information recorded is full name and email address. 

Cloud identity and access management firm has no evidence that this information is being actively exploited. The company warns impacted customers of phishing or social engineering attacks that rely on the compromised data.

“Okta customers sign-in to Okta’s customer support system with the same accounts they use in their own Okta org. Many users of the customer support system are Okta administrators. It is critical that these users have multi-factor authentication (MFA) enrolled to protect not only the customer support system, but also to secure access to their Okta admin console(s).” continues the update.

The company is still working with a third-party digital forensics firm to validate its findings. 

In early September, Okta warned customers of social engineering attacks carried out in recent weeks by threat actors to obtain elevated administrator permissions. The attacks targeted IT service desk staff to trick them into resetting all multi-factor authentication (MFA) factors enrolled by highly privileged users. The company did not attribute the attack to a specific threat actor.

In December 2022, the American identity and access management giant revealed that its private GitHub repositories were hacked.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Okta)