Re:Okta’s Investigation of the January 2022 Compromise
by sascha_sl on Wednesday March 23, 2022 @06:21AM
(#30776924)
From circulating screenshots, and the omission in the listing here, it looks like they used this account to reset user passwords and MFA on a bunch of tenants. Not being able to create or delete users is meaningless.
Re:Okta’s Investigation of the January 2022 Compromise
by kasey_junk on Wednesday March 23, 2022 @08:17AM
(#30777648)
Why is it a meaningless distinction to prevent account creation but allow password reset?
Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all.
Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?
Re:Okta’s Investigation of the January 2022 Compromise
by sascha_sl on Wednesday March 23, 2022 @09:59AM
(#30778523)
Apparently the "password reset" is more of a "password set" feature.
Re:Okta’s Investigation of the January 2022 Compromise
by kasey_junk on Wednesday March 23, 2022 @10:02AM
(#30778540)
Where was that outlined? All of the screen dumps I saw showed what looked like a reset.
Re:Okta’s Investigation of the January 2022 Compromise
by yibg on Wednesday March 23, 2022 @10:30AM
(#30778804)
Why is password reset considered a big issue? If I know your email / login I can go reset your password for a bunch of stuff now without any breach.
Re:Okta’s Investigation of the January 2022 Compromise
by h0l0cube on Wednesday March 23, 2022 @07:21AM
(#30777286)
Fair call. That's an important clarification.
Re:Okta’s Investigation of the January 2022 Compromise
by ecf on Wednesday March 23, 2022 @12:07PM
(#30779929)
Kinda unrelated, but how did job title inflation get this bad?
Support _Engineer_ that is using a prebuilt application to do stuff like reset MFA. In what world does this have anything to do with engineering?
From the article:
> The majority of support engineering tasks are performed using an internally-built application called SuperUser or SU for short, which is used to perform basic management functions of Okta customer tenants. This does not provide “god-like access” to all its users. This is an application built with least privilege in mind to ensure that support engineers are granted only the specific access they require to perform their roles. They are unable to create or delete users. They cannot download customer databases. They cannot access our source code repositories.