this post was submitted on 21 Oct 2023
166 points (98.8% liked)

Technology

59347 readers
6293 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Bet there was some good tokens in some of those customer HAR files.

all 5 comments
sorted by: hot top controversial new old
[–] [email protected] 10 points 1 year ago

From a comment in the article:

Nothing like an authentication provider announcing a major breach at end of day on Friday to get your IT nerves fraying.

Not like they specifically announced it on Friday so that the media response to this is minimal.

[–] [email protected] 7 points 1 year ago (1 children)

This is the best summary I could come up with:


“HAR files can also contain sensitive data, including cookies and session tokens, that malicious actors can use to impersonate valid users,” Bradbury wrote.

The CSO also didn't say whether access to the compromised support system was protected by two-factor authentication, which best practices call for.

BeyondTrust’s access policy controls stopped the attacker’s “initial activity, but limitations in Okta’s security model allowed them to perform a few confined actions,” the company said without elaborating.

The initial incident response indicated a possible compromise at Okta of either someone on their support team or someone in position to access customer support-related data.

In December 2022, hackers stole Okta source code stored in a company account on GitHub.

Friday’s post contains IP addresses and browser user agents used by the threat actors that others can use to indicate if they have also been affected.


The original article contains 431 words, the summary contains 140 words. Saved 68%. I'm a bot and I'm open source!

[–] [email protected] 2 points 1 year ago

Might need to work on the summarizing...

[–] [email protected] 7 points 1 year ago

Lol to clarify, "viewed" means they had to download them