Beware Phishing and Social Engineering Attacks Targeting Passwords, Vendor Warns
Okta said the attacker behind its September data breach stole more information than it first discovered, including details for all users of its primary customer support system.
See Also: Live Webinar | Generative AI: Myths, Realities and Practical Use Cases
The San Francisco-based identity and authentication giant first publicly confirmed the breach on Nov. 3, warning that attackers gained access to its customer support management system and stole sensitive information uploaded by 134 customers.
In an updated data breach notification released Wednesday, Okta CSO David Bradbury said Okta recently discovered the attacker stole much more data, including a complete list of many customer support system users’ usernames and contact details.
Investigators don’t believe the attacker stole any “user credentials or sensitive personal data,” but still might attempt to use the stolen information to obtain these credentials by targeting users – and especially administrators – via phishing or social engineering attacks, he said.
In light of the data theft, Okta recommends organizations ensure that their Okta administrator accounts get protected using multifactor authentication, since the attacker could use the stolen information to trick admins into divulging their passwords, thus giving hackers access to their accounts.
“Okta customers sign-in to Okta’s customer support system with the same accounts they use in their own Okta org,” Bradbury said. “Many users of the customer support system are Okta administrators.”
Okta said 6% its customers still don’t require MFA for their administrators to access their Okta admin account. “We recommend all Okta customers employ MFA and consider the use of phishing-resistant authenticators to further enhance their security,” such as Okta Verify FastPass, FIDO2 WebAuthn, or PIV or CAC smart cards, Bradbury said.
“While we do not have direct knowledge or evidence that this information is being actively exploited, we have notified all our customers that this file is an increased security risk of phishing and social engineering,” a spokesperson told Information Security Media Group.
Okta hasn’t connected this data breach with a handful of attacks this past summer that compromised the likes of hotel and casino giants Caesar’s and MGM Resorts. In those attacks, anecdotal evidence suggests an attacker successfully tricked a help desk employee into giving them access to an employee account, allowing them to bypass Okta multifactor authentication controls.
in September, Okta reported seeing a surge in such attacks over the past year, noting many of them traced to Scattered Spider – aka UNC3944 or Muddled Libra – which is a security industry codename for a group suspected of being an affiliate of the Alphv ransomware-as-a-service group, which develops and supplies its affiliates with BlackCat ransomware.
Report Discrepancies
During its customer support system breach, Okta said the attacker ran multiple reports, including one on Sept. 28 that gave them information on every Okta customer support system user, potentially including their full name, username, email, company name, address, role in their organization, phone numbers and SAML Federation ID, among other information.
Not every user shared information for every field, Okta said. “The majority of the fields in the report are blank and the report does not include user credentials or sensitive personal data,” Bradbury said. “For 99.6% of users in the report, the only contact information recorded is full name and email address.”
The report generated information for all users of Okta Workforce Identity Cloud and Customer Identity Solution customers, the company said. The report didn’t include information for “customers in our FedRamp High and DoD IL4 environments – these environments use a separate support system not accessed by the threat actor,” or the Auth0/CIC support case management system, Bradbury said.
Breach Timeline
Multiple Okta customers said they reported to Okta suspicious activity in late September or early October that they traced to the vendor. Okta belatedly confirmed that the information was stolen from its own customer support system. The company later found an attacker appeared to have stolen valid access credentials from an employee’s personal Google account. Investigators found the employee used the account to log into the Chrome browser of an Okta-managed laptop, and saved the username and password for the Okta service to their personal account.
Companies reporting the suspicious activity included access management vendor BeyondTrust, widely used password management software maker 1Password, and content delivery network giant Cloudflare. Each said the attacker’s attempted use of their stolen Okta customer support data against them failed.
What accounts for Okta’s four-week delay – following the initial breach notification – in understanding the full extent of what the attacker stole?
Bradbury said investigators initially missed the full scope of the data theft because the templated report run by the attacker included multiple enabled-by-default filters. Belatedly, investigators found a discrepancy in the size of the file the filtered version of the report generated, compared to the much larger file downloaded by the attacker. “Our November review identified that if the filters were removed from the templated report, the downloaded file was considerably larger – and more closely matched the size of the file download logged in our security telemetry,” he said.
Investigators also “identified additional reports and support cases that the threat actor accessed, which contain contact information of all Okta certified users and some Okta Customer Identity Cloud customer contacts, and other information,” Bradbury said. “Some Okta employee information was also included in these reports.”
The company said external investigators are continuing to probe and confirm the latest breach findings. “We are working with a digital forensics firm to support our investigation and we will be sharing the report with customers upon completion,” Okta’s spokesperson said. “In addition, we will also notify individuals that have had their information downloaded.”
Okta said it’s also adding new security defenses to its support portal, including customizable admin console timeouts – the default will be logouts after 12-hour session or 15 minutes of idle time – as well a session binding, meaning administrators will have to reauthenticate if their session moves to a new IP address.