New Post-Exploitation Attack Method Found Affecting Okta Passwords

A new put up-exploitation attack system has been found that enables potential attackers to read through users’ passwords and qualifications in the audit logs of program by organization id alternative supplier Okta.

The system was uncovered by forensic experts Mitiga and talked about in an advisory published by the group earlier now.

“Adversaries with accessibility to Okta audit logs, whether or not attained specifically through the admin console or by means of other methods where by logs are transported, could read Okta users’ passwords if they experienced been input improperly in the username subject all through login,” wrote Okta security researchers Doron Karmi and Or Aspir.

From a specialized standpoint, the flaw derives from the way the Okta process information unsuccessful login attempts to circumstances.

“While it might appear to be like an edge case, this sort of password error is a common one particular for buyers. As a end result, it poses a risk to numerous Okta consumers,” reads the report.

Karmi and Aspir warned that info obtained in this sort of a way could let risk actors to compromise Okta user accounts and accessibility methods or applications that they could have accessibility to, effectively increasing the attack’s possible effects.

“By figuring out the credentials of end users, an attacker can consider to log in as all those users to any of the organization’s unique platforms that use Okta single indicator-on (SSO). Also, this information could be applied to escalate privileges in the situation of uncovered administrator passwords,” the scientists extra.

Read a lot more on SSO security below: Original Obtain Broker Exercise Doubles in a 12 months

The advisory also advised that potentially afflicted corporations assessment the use of their log analytics system or SIEM (security data and function administration) where the Okta logs are saved.

“This variety of security risk can occur in any firm that takes advantage of Okta for identification and access administration,” Karmi and Aspir wrote. “We have established a SQL question that can help businesses recognize these potential password exposures.”

More, the security scientists advisable that corporations use multi-element authentication (MFA), carry out obtain controls and checking choices in SIEM, and teach conclusion-end users.

In response to Mitiga’s disclosure, Otka confirmed the validity of the exploitation method and provided further suggestions for mitigating opportunity assaults based on it.

The Mitiga advisory comes months just after Group-IB security researchers unveiled data about a phishing marketing campaign focusing on Okta identification qualifications and connected 2FA codes.

Editorial image credit history: T. Schneider / Shutterstock.com

Some parts of this article are sourced from:
www.infosecurity-journal.com