Search
Okta, a massively popular company which provides identity and access management (IAM) services to clients worldwide, was recently targeted by threat actor Lapsus$.
The compromise of Okta and other providers of IAM services is highly sensitive and potentially far-reaching as Okta’s IAM services alone allow approximately 15,000 companies to securely log into multiple services via Single Sign-On (SSO). This method allows users to securely authenticate multiple applications using one single set of credentials as opposed to unique ones for each individual service.
Lapsus$ does not appear to have a specific industry vertical it targets as public networks within European and South American organizations have also been compromised. The group has publicly boasted about obtaining stolen source code from Microsoft relating to Bing and Cortana as well.
The timeline of Okta’s breach events is under scrutiny as the threat actor disputes the official statements provided by Okta. However, it is understood that the breach occurred at some time within the last three to six months. This information is particularly concerning as a client of Okta, such as FedEx or Cloudflare, could invariably impact numerous users per compromised Okta client account.
Okta acknowledged the cyberattack after Lapsus$ used their Telegram channel to release screenshots of compromised credentials. According to Okta, the breach was conducted through the compromise of an individual workstation of a subcontractor who had access to the Okta network. This remote desktop was then leveraged to take the screenshots.
Within those screenshots, Lapsus$ shows the credentials it had gained access to, which rose to the level of administrator.
If true, that depth of compromise could be extremely devastating to end-users at companies using Okta as their SSO solution as the risk of having privileged access available through a third party creates a significant opportunity for exploitation.
To reduce the impact of this type of attack, users and network administrators are strongly urged to implement the following security measures immediately:
BinaryLab’s ethos of enumerating, evaluating, and understanding the threat surface of an individual network can be used for such large-scale enterprises.
If you have any questions about the information above, please contact your E. Cohen advisor. For a cybersecurity assessment or more information, contact our subsidiary, BinaryLab, at 301-337-3131.
