Data Breach – OneLogin Password Manager Hacked

OneLogin company announced on Thursday that it had “detected unauthorised access” in its systems located in the United States.

OneLogin is a leading identity and access management software vendor providing an identity-driven enterprise security solution.

OneLogin is a popular password manager used by many Internet users to allow management of complex passwords as requested by good practices.

Well, if you use OneLogin password manager then immediately change all your account passwords because the company has suffered a data breach.

OneLogin company announced on Thursday that it had “detected unauthorised access” in its systems located in the United States.

“we recently detected that a malicious actor had obtained access to our US operating region.” reads the data breach notification issued by the company.

At the time I was writing the software vendor provided a few details about the security breach that started on May 31, 2017 around 2 am PST.

“Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST.” states the notification breach. “Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance. OneLogin staff was alerted of unusual database activity around 9 am PST and within minutes shut down the affected instance as well as the AWS keys that were used to create it.”

There is no information about the vulnerabilities exploited by attackers to breach the company.

Which is the impact of the customers?

The hackers accessed database tables that contain information about users, apps, and various types of keys. OneLogin confirmed that data were encrypted, but also added that it cannot exclude the threat actors has the capability to decrypt it.

“While we encrypt certain sensitive data at rest, at this time we cannot rule out the possibility that the threat actor also obtained the ability to decrypt data. We are thus erring on the side of caution and recommending actions our customers should take, which we have already communicated to our customers.” states the company.

OneLogin is supporting the investigation of law enforcement and is verifying the extent of the impact.

“We have since blocked this unauthorised access, reported the matter to law enforcement, and are working with an independent security firm to determine how the unauthorised access happened and verify the extent of the impact of this incident,” OneLogin chief information security officer Alvaro Hoyos said.

“We are actively working to determine how best to prevent such an incident from occurring in the future.”

The company has published a list of recommendations to its customers:

Forcing a password reset for all of its customers.
Generating new security credentials, OAuth tokens, and certificates for apps and websites.
Recycling secrets stored in OneLogin’s secure notes.

This is the second data breach suffered the company, in August 2016, OneLogin suffered a security breach to a system used for “log storage and analytics”

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – OneLogin, data breach)

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.