OneLogin: Breach Exposed Ability to Decrypt Data
krebsonsecurity.com
OneLogin: Breach Exposed Ability to Decrypt Data
1–10 of 50 posts
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#2The recent update from Krebs gives some interesting details into how the attack took place, something we don't get to hear very often:
“Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance. OneLogin staff was alerted of unusual database activity around 9 am PST and within minutes shut down the affected instance as well as the AWS keys that were used to create it.”
Credit where credit is due, that's a pretty quick response time for data breaches, which are normally quoted as being discovered in an average of 30 or so days.
However the fact people's information can be decrypted from this breach is awful. Sounds a lot like the private key to decrypt this information was stored alongside the data in the database... whoops! That's like storing the clear text password. Let's hope the decrypted information contains strongly hashed passwords, but I'm not holding my breath.
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#3The recent update from Krebs gives some interesting details into how the attack took place, something we don't get to hear very often: “Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the ac…
> Sounds a lot like the private key to decrypt this information was stored alongside the data in the database... whoops!
Not necessarily, even if this was done "properly" there is no guarantee that from the internal network there wasnt a separate exploit that the attacker could use to gain access to a different node which had the key in memory. With breakages like these you generally have to assume that anything that is theoretically possible has happened.
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#4> After OneLogin customers sign into their account, the service takes care of remembering and supplying the customer’s usernames and passwords for all of their other applications.
Isn't that at least somewhat analogous to using the same username and password on every site?
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#5> After OneLogin customers sign into their account, the service takes care of remembering and supplying the customer’s usernames and passwords for all of their other applications. Isn't that at least somewhat analogous to using the same username and password on every site?
It's a bit of a double-edged sword, but mostly a positive. If this account is compromised, you're fucked. However, if any of your other accounts are compromised, all of the rest are safe. If you used the same password for all sites, that is not true. So basically, you're putting all your eggs in one basket, which you then hope is super safe. That makes this breach pretty scary.
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#6> After OneLogin customers sign into their account, the service takes care of remembering and supplying the customer’s usernames and passwords for all of their other applications. Isn't that at least somewhat analogous to using the same username and password on every site?
Kinda-sorta, in the same way a password manager is. It allows one strong password/2fa vs many likely weaker passwords.
In reality OneLogin is typically using a federated login protocol like SAML or OIDC to grant access to third-party services. This means it can also be used to immediately revoke access, without having to reach out to and reconfigure various services.
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#7The recent update from Krebs gives some interesting details into how the attack took place, something we don't get to hear very often: “Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the ac…
Think about a single-sign-on service: by definition, the service would have the ability to generate/access tokens that would grant a user access to other applications. Therefore, a breach in any kind of SSO service would result in granting access to people's information -- no decryption needed!
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#8The recent update from Krebs gives some interesting details into how the attack took place, something we don't get to hear very often: “Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the ac…
Think about a single-sign-on service: by definition, the service would have the ability to generate/access tokens that would grant a user access to other applications. Therefore, a breach in any kind of SSO service would result in granting access to people's information -- no decryption needed!
That's true, but the SSO service itself can run on the users computer, so there is no need for the service to be able to decrypt the users data, only for it to be able to persist encrypted data.
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#9I'm not a user of OneLogin, but if they store encrypted passwords and encryption keys, their security model is fundamentally broken imho and I'd never give them my passwords.
Better services (1password for example) are specifically designed to never know your master password/key to avoid this very situation.
Re: OneLogin: Breach Exposed Ability to Decrypt Data
#10I'm not a user of OneLogin, but if they store encrypted passwords and encryption keys, their security model is fundamentally broken imho and I'd never give them my passwords. Better services (1password for example) are specifically designed to never know your master password/key to avoid this very situation.
Does any of those better designed services support Linux?