Okta was breached via their support infrastructure yet again. This time, they only found out because of a customer escalation, which they failed to act on for at least 16 days 🤯. A 🧵 of my takeaways... 1/n sec.okta.com/harfiles
𝗕𝗮𝗰𝗸𝗴𝗿𝗼𝘂𝗻𝗱: In March 2022, Okta experienced a breach of a third-party "customer support engineer", granting attacker's privileged access to customer environments. See the thread below for more details. 2/n

https://twitter.com/BillDemirkapi/status/1506107157124722690

Excited that with today's Patch Tuesday, the results of an effort I've been leading to address frequently abused Mark-of-the-Web problems are finally starting to rollout to millions of our customers worldwide! Here are some deets 👇 1/7 Background: Mark-of-the-Web (MotW) is a security feature designed to tag files downloaded from the Internet and treat them with an extra layer of caution. This can include security warnings when the file is opened or applications disabling certain features for the file. 2/7

The Uber hack is quite severe and wide ranging. Wishing their blue teams the best of luck and love during this understandably difficult period. Some thoughts & observations based on what we've seen so far 👉 1/N Let's talk about how they were compromised. The attacker has been quite upfront about how they compromised Uber's corporate infrastructure. Uber appears to use push notification MFA (Duo) for their employees. How can an attacker get around MFA? 2/N

New documents for the Okta breach: I have obtained copies of the Mandiant report detailing the embarrassing Sitel/SYKES breach timeline and the methodology of the LAPSUS$ group. 1/N

https://twitter.com/BillDemirkapi/status/1506107157124722690

We can see how LAPSUS$ originally began investigating their compromised host on January 19th, 2022. With little regard for OPSEC, LAPSUS$ searched for a CVE-2021-34484 bypass on their compromised host and downloaded the pre-built version from GitHub. 2/N

https://twitter.com/KLINIX5/status/1451558296872173577

The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems. The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords:

Rant about how @Bugcrowd and @Hacker0x01 setup their platforms to let vendors who host private programs abuse researchers. Entirely based on a true story with @Bugcrowd in my case. This is for my #bugbounty friends out there. 1/n Let's say you are a researcher invited to a private program. You spend 10-20 hours looking for vulnerabilities and you finally find one! You report it to the vendor and... they say it's not applicable. 2/n