Pierluigi Paganini
June 02, 2017
OneLogin is a leading identity and access management software vendor providing an identity-driven enterprise security solution.
OneLogin is a popular password manager used by many Internet users to allow management of complex passwords as requested by good practices.
Well, if you use OneLogin password manager then immediately change all your account passwords because the company has suffered a data breach.
OneLogin company announced on Thursday that it had “detected unauthorised access” in its systems located in the United States.
“we recently detected that a malicious actor had obtained access to our US operating region.” reads the data breach notification issued by the company.
At the time I was writing the software vendor provided a few details about the security breach that started on May 31, 2017 around 2 am PST.
“Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST.” states the notification breach. “Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance. OneLogin staff was alerted of unusual database activity around 9 am PST and within minutes shut down the affected instance as well as the AWS keys that were used to create it.”
There is no information about the vulnerabilities exploited by attackers to breach the company.
Which is the impact of the customers?
The hackers accessed database tables that contain information about users, apps, and various types of keys. OneLogin confirmed that data were encrypted, but also added that it cannot exclude the threat actors has the capability to decrypt it.
“While we encrypt certain sensitive data at rest, at this time we cannot rule out the possibility that the threat actor also obtained the ability to decrypt data. We are thus erring on the side of caution and recommending actions our customers should take, which we have already communicated to our customers.” states the company.
OneLogin is supporting the investigation of law enforcement and is verifying the extent of the impact.
“We have since blocked this unauthorised access, reported the matter to law enforcement, and are working with an independent security firm to determine how the unauthorised access happened and verify the extent of the impact of this incident,” OneLogin chief information security officer Alvaro Hoyos said.
“We are actively working to determine how best to prevent such an incident from occurring in the future.”
The company has published a list of recommendations to its customers:
This is the second data breach suffered the company, in August 2016, OneLogin suffered a security breach to a system used for “log storage and analytics”
[adrotate banner=”9″]
(Security Affairs – OneLogin, data breach)
[adrotate banner=”13″]
