Okta’s Recent Customer Support Data Breach Impacted 134 Customers

Identity and authentication management provider Okta on Friday disclosed that the current support situation management procedure breach affected 134 of its 18,400 clients.

It additional mentioned that the unauthorized intruder obtained obtain to its programs from September 28 to Oct 17, 2023, and finally accessed HAR documents that contains session tokens that could be applied for session hijacking attacks.

“The risk actor was ready to use these session tokens to hijack the authentic Okta periods of 5 customers,” Okta’s Main Security Officer, David Bradbury, stated.

Three of all those influenced consist of 1Password, BeyondTrust, and Cloudflare. 1Password was the first business to report suspicious exercise on September 29. Two other unnamed customers were identified on Oct 12 and Oct 18.

Okta formally unveiled the security party on Oct 20, stating that the menace actor leveraged obtain to a stolen credential to access Okta’s aid circumstance management procedure.

Now, the company has shared some far more aspects of how this happened.

It said the obtain to Okta’s customer assist process abused a service account stored in the technique alone, which experienced privileges to look at and update shopper assist instances.

More investigation unveiled that the username and password of the company account experienced been saved to an employee’s personalized Google account and that the particular person experienced signed-in to their individual account on the Chrome web browser of their Okta-managed laptop computer.

“The most most likely avenue for publicity of this credential is the compromise of the employee’s private Google account or personalized product,” Bradbury said.

Okta has considering the fact that revoked the session tokens embedded in the HAR files shared by the afflicted shoppers and disabled the compromised assistance account.

It has also blocked the use of private Google profiles within business versions of Google Chrome, blocking its personnel from signing in to their particular accounts on Okta-managed laptops.

“Okta has launched session token binding centered on network place as a products enhancement to overcome the risk of session token theft towards Okta directors,” Bradbury said.

“Okta directors are now pressured to re-authenticate if we detect a network modify. This aspect can be enabled by buyers in the early accessibility portion of the Okta admin portal.”

The progress will come times soon after Okta discovered that individual facts belonging to 4,961 present and previous workers was exposed after its health care coverage seller, Rightway Healthcare, was breached on September 23, 2023. Compromised facts integrated names, Social Security figures, and well being or health care insurance plans.

Observed this posting intriguing? Follow us on Twitter  and LinkedIn to examine far more exclusive material we put up.

Some parts of this article are sourced from:
thehackernews.com