In recent days, it has become clear how a hack on Okta has major implications for the company's customers. This is because the data captured allows cybercriminals to log into customers' systems. In addition, it shows once again how vulnerable our digital identities are.
Earlier this week, Okta reported that data was stolen from its customer service ticket system. However, the data that was captured contains highly sensitive data, which cybercriminals can now also easily access systems of Okta's customers.
Okta is a so-called identity and access management (IAM) solution, a competitor to Microsoft (Azure) Active Directory, for example. Okta manages the address book of companies that includes all employees and their login credentials. As soon as an employee tries to log in somewhere, that session is checked by Okta. So it is a crucial component in a corporate network.
Smart hack on customer service (help desk)
As with all software solutions, sometimes things go wrong and as an organization you need support. For example, to find out why something is not working properly with a certain group of users or in a browser session. This also applies to Okta's customers, and they can turn to the company's customer service department for that.
With problems such as those described earlier, it is often easiest when the customer service representative at Okta can replicate the problem, or in other words, experience for themselves where things may be going wrong. Okta asks then often to upload a so-called HTTP Archive (HAR) file. These files contain browser history, sessions and cookies. This allows the customer service agent to then recreate what the user is trying to do and where things go wrong.
Access to sessions and cookies
However, hackers have now succeeded in using phishing to gain access to Okta's customer service system and were able to download customer-supplied HAR files as a result. Then the cybercriminals searched all those HAR files for sessions and cookies and are now trying to use them to access customers' systems.
The likes of 1Password and Cloudflare have already disclosed that they have detected malicious activity traceable to HAR files at Okta. However, chances are that this is just the tip of the iceberg.
Okta states that it normally recommends deleting all cookies and session tokens in HAR files before sharing them. In practice, this probably doesn't happen often, as customers seek a solution to their problem and Okta is a trusted vendor.
Vulnerability of online authentication
It eventually took several weeks for Okta to realize exactly what happened. Okta customers saw much earlier how malicious tried to get in or got in and tried to modify their permissions, which still caught them. Okta has since contacted customers who provided HAR files that may have been captured.
More important about this story is that it shows how vulnerable online authentication really is. Once cybercriminals manage to gain access to sessions and cookies, they can mimic the customer's browser session and gain themselves access to all sorts of online systems. Some SaaS providers have some additional safeguards for this, but many do not.
We share this article from techzine, to bring attention to such hacks. After all, the consequences for those affected are super big.
