Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Updated Okta Statement on Lapsus$

okta.com

Post reply on HN
Print view View original

71–80 of 239 posts

Re: Updated Okta Statement on Lapsus$

#71

Post by chippiewill »

evan_ wrote: post #27
paxys wrote: post #12

There were a lot of doomsday predictions in yesterday's thread before any real info had been shared, but it was always the more likely scenario that a support agent contracted through a vendor would have limited read access to their internal systems and wouldn't be able to cause any real damage.

you can do a lot of damage with read access depending on what you're able to read

Especially with how much access they had on the company Slack org.

Everyone's terrible with secops, but Okta employees were apparently dumping AWS keys into public channels.

Re: Updated Okta Statement on Lapsus$

#72

Post by j4yav »

evan_ wrote: post #27
paxys wrote: post #12

There were a lot of doomsday predictions in yesterday's thread before any real info had been shared, but it was always the more likely scenario that a support agent contracted through a vendor would have limited read access to their internal systems and wouldn't be able to cause any real damage.

you can do a lot of damage with read access depending on what you're able to read

They are at least saying that Okta engineers were posting AWS keys in Slack, which they had full access to and found by searching for AKIA.

Re: Updated Okta Statement on Lapsus$

#74

Post by chippiewill »

swiftcoder wrote: post #21
eyeareque wrote: post #3

It feels like a lawyer heavily tweaked this to sound better than it really is.

That's just a reality of corporate disclosures, I'm afraid. No one is going to let something like this go to press without a full round of legal and PR editing.

I think there's two ways about it though. Most "good" companies (e.g. Cloudflare) will try to be transparent and proactive without taking on liability.

In this case it reads as though Okta are obfuscating the truth, and that's not good.

Re: Updated Okta Statement on Lapsus$

#76

Post by thorin1 »

> there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop.

> Support engineers are also able to facilitate the resetting of passwords and multi-factor authentication factors for users

No breach at all here.

Re: Updated Okta Statement on Lapsus$

#77

Post by Bombthecat »

nimbius wrote: post #59

>The Okta service has not been breached and remains fully operational. There are no corrective actions that need to be taken by our customers. despite an overwhelming preponderance of damning evidence from twitter (as well as the hacker themselves) you've somehow managed to find yourselves secure instead? Christs whiskers thats some impressive doublethink. Its also an excellent opportunity to fall on a sword that giv…

According to gdpr, this post could be illegal (because.. Lie)

Re: Updated Okta Statement on Lapsus$

#78

Post by flatiron »

paxys wrote: post #15
koolba wrote: post #4

> Support engineers do have access to limited data - for example, Jira tickets and lists of users - that were seen in the screenshots. Support engineers are also able to facilitate the resetting of passwords and MFA factors for users, but are unable to obtain those passwords. This means they could have reset anybody’s credentials and logged in. There would a record of it if the audit logs are valid, but saying no act…

Password reset requests still go to your registered email.

besides the whole "we dug through slack and got your AWS keys" i think the worst case scenario would have been removing MFA from an a compromised account and having access to the e-mail to self-serve the password reset.

that and maybe going through JIRA and seeing if anything was of any interest?

Re: Updated Okta Statement on Lapsus$

#79

Post by politelemon »

templapsusread wrote: post #31
templapsusread wrote: post #23

Lapsus has responded https://img.guildedcdn.com/ContentMedia/e4149dc99f447074cb2c...

they edited and added more content https://img.guildedcdn.com/ContentMedia/372280f522049aa0b0eb...

8600 channels? Wouldn't that overwhelm you? I'm trying to think up scenarios where an org would need so many, but I can't. Is this normal?

Re: Updated Okta Statement on Lapsus$

#80

Post by radicaldreamer »

politelemon wrote: post #79
templapsusread wrote: post #31

Earlier quoted context omitted.

they edited and added more content https://img.guildedcdn.com/ContentMedia/372280f522049aa0b0eb...

8600 channels? Wouldn't that overwhelm you? I'm trying to think up scenarios where an org would need so many, but I can't. Is this normal?

There's probably a support channel for each customer and agents tasked with floating amongst them.
Post reply on HN