David Bradbury

Tracking Unauthorized Access to Okta's Support System

Okta Security has identified adversarial activity that leveraged access to a stolen credential to access Okta's support case management system. The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases. It should be noted that the Okta support case management system is separate from the production Okta service, which is fully operational and has not been impacted. In addition, the Auth0/CIC case management system is not impacted by this...

Brett Winterford

Go “Secure by Default” With Custom Admin Roles for IT support staff

The Takeaway: Creating custom roles for your help desk staff supports a “least privilege” approach. In late August, Okta’s Defensive Cyber Operations team outlined a social engineering campaign in which a target’s IT support staff - that is, the team responsible for common help desk tasks, were tricked into resetting the authenticators of users with the most privileged roles in an organization.  One of the many recommendations made in response to this event was to constrain the permissions of...

Defensive Cyber Operations

Cross-Tenant Impersonation: Prevention and Detection

Summary Okta has observed attacks in which a threat actor used social engineering to attain a highly privileged role in an Okta customer Organization (tenant). When successful, the threat actor demonstrated novel methods of lateral movement and defense evasion. These methods are preventable and present several detection opportunities for defenders. In recent weeks, multiple US-based Okta customers have reported a consistent pattern of social engineering attacks against their IT service desk...

Ben King

BYO Telephony and the future of SMS at Okta

SMS has long played an important role as a universally applicable method of verifying a user’s identity via one-time passcodes. And over the last decade, SMS and voice-based Multi-factor Authentication has prevented untold attempts to compromise user accounts.  But it’s time to move on.  As of August 2023, any new Okta customer choosing to authenticate users via SMS or voice must configure their own Telephony provider, just as they would any other custom IdP or custom TOTP factor. Starting...

Laremy Legel

Saying “No Thanks” to nOAuth

You may have heard about a vulnerability called, “nOAuth”, where, per Microsoft, “use of the email claim from access tokens for authorization can lead to an escalation of privilege.” What is this vulnerability, how can Okta help, and what are the mitigation steps and strategies to keep your own environment nOAuth free? Let’s break it down! What is nOAuth? Discovered in April of 2023, by researchers at descope, the nOAuth vulnerability relies on user accounts being merged by an Microsoft Azure...

Defensive Cyber Operations

Telling More Okta Detection Stories with Google Chronicle

Robust protection comes from layers, and many of you are already familiar with the Swiss Cheese Model. Simply stated, even when you're confident in your primary controls, that confidence only grows with each additional layer added. Because who wants to have a defense that’s built around a single slice of sad cheese, wrapped in a pitiful film of plastic? No thanks, we’ll take that sturdy block of Swiss each and every time.  Of course, given how thin most security teams are spread, robust...

Defensive Cyber Operations and Brett Winterford

An Unexpected Endorsement for WebAuthn

Okta Security endorses phishing resistant authentication at every opportunity. We’ve long argued enrolling users in Okta FastPass, FIDO2 WebAuthn authenticators or Smart Cards, and enforcing phishing resistant authentication flows will: Protect users against real-time phishing proxies and other forms of session hijacking. Solve for far more attacks than simply adding Number Challenge to Push notifications to defeat MFA Fatigue. Offer detection opportunities via System Log and the automation...

Tim Peel and Laremy Legel

Social Engineering is Getting More Extreme, but the Fixes Can Be Simple

Social engineering is a hacking technique older than the internet itself, and it's tempting to think you've already seen it all. But recently, we've noted a trend among threat actors pursuing more sophisticated and aggressive techniques to trick, or even threaten, users into performing their desired actions. Their campaigns are convincing, brazen, and at times alarming. In this blog post, we want to talk about some of the techniques we've seen (or been made aware of) and provide some practical...

John Murphy and Laremy Legel

Study up on Okta Logs for Splunk’s Boss of the SOC!

Okta Security is pleased to announce another collaboration with our friends at Splunk - our security teams have joined forces to come up with a range of Okta-relevant scenarios for this year’s “Boss of the SOC'' competition at Splunk .conf23. Per Splunk, “Boss of the SOC (BOTS) is a blue-team capture the flag-esque competition. As a contestant, you will explore and investigate realistic event data in Splunk Enterprise and Splunk Enterprise Security. The questions in BOTS range from easy to...

Brett Winterford and Moussa Diallo

Keeping Phishing Adversaries Out of the Middle

Okta’s Identity Defense Operations frequently observes the use of Adversary-in-the-Middle (AiTM) phishing proxies in high-volume, non-targeted attacks against users of corporate email services. Real-time phishing proxies have been used in red team activity and targeted attacks since at least 2017. Microsoft Threat Intelligence Center (MSTIC) observed campaigns in July 2022 of far higher volume, with 10,000 Microsoft 365 customers targeted in one campaign alone. MSTIC also observed that...