1Password Breached: Examining the Wider Implications of Okta’s Customer Service Data Breach

Cyberattacks Target Password Manager 1Password via Okta Customer Support Breach

The Incident:

Password manager 1Password has recently become the second publicly disclosed victim of a breach involving Okta‘s customer support. Okta, a popular cloud-based identity and access management service used by over 17,000 customers worldwide, faced a threat actor who utilized stolen credentials to gain access to its customer support case management system. The attacker then used this access to breach some of the thousands of customers who had engaged with Okta‘s support services, including 1Password. The password-management company swiftly observed suspicious activity within its Okta instance on September 29 but was able to terminate the activity promptly. The company has clarified that no user or employee data or other sensitive systems were compromised. Okta has informed other potentially affected customers, hinting that more victims may emerge in the coming days.

Okta‘s Attractive Target:

Okta has long been a lucrative target for cybercriminals due to the significant amount of sensitive information it offers access to. Previous attacks on Okta have included campaigns that relied on social engineering to convince IT desk personnel to reset multifactor authentication for highly privileged Okta enterprise accounts. More recent incidents involving ransomware at MGM and Caesar’s Palace also resulted from subverting Okta Agent via social engineering. The breach currently under discussion highlights the susceptibility of Okta‘s customer support infrastructure.

Profile of the Okta Customer Service Breach:

Although Okta did not initially disclose the breach, BeyondTrust, an independent identity and access management security vendor, revealed on October 2 that an attacker had attempted to use a valid session cookie stolen from Okta‘s support system to access BeyondTrust’s Okta administrator account. The attacker requested a HAR (HTTP Archive) file containing a session token, which was then used within 30 minutes to authenticate and attempt malicious actions. The rapid response time suggests that the attacker was closely monitoring for the upload of such files. Logs revealed that the attacker’s IP address was in Malaysia, routed through a VPN service. BeyondTrust successfully terminated the attack without any damage to infrastructure or customer data.

Implications and Recommendations:

Affected customers with less comprehensive detection and response capabilities may face more severe repercussions than Okta‘s first two publicly reported victims. The main concern lies in the potential compromise of an Okta environment, which could go unnoticed if the attacker can use the session token to authenticate with high privileges, create accounts, and control privileged user groups. This would provide a backdoor into an Okta environment, allowing the attacker to add an identity provider and impersonate other users within the organization to gain access to apps and technologies facilitated by Okta‘s single sign-on (SSO) feature.

Companies must exercise caution when sharing data with customer service agents, even if they are trusted. To prepare for worst-case scenarios, organizations should proactively protect their most sensitive accounts. Monitoring of Okta authentication events involving admin users should be intensified to identify and respond to potential threats promptly.

Conclusion:

The breach of Okta‘s customer support system, affecting password manager 1Password and potentially other customers, underscores the ongoing cybersecurity challenges faced by companies that handle sensitive data. It serves as a reminder of the importance of comprehensive security measures, such as effective detection and response capabilities, and the need for continuous monitoring and protection of user accounts. As the threat landscape evolves, organizations should remain vigilant and proactive in their efforts to safeguard their systems and data from malicious actors.

**Keywords**: Data breach, security, customer service, Okta, 1Password, implications