Hacker News Reader

Comment by gzer0 | Hacker News Reader

And this explains how the LAPSUS hacker group was able to breach Microsoft, NVIDIA, and countless others. Apparently, they have been inside of OKTA systems for nearly 2 months now.

[1] https://www.theregister.com/2022/03/21/microsoft_lapsus_brea...

[2] https://www.wired.com/story/lapsus-hacking-group-extortion-n...

[3] https://analyticsindiamag.com/lapsus-hack-leaves-nvidia-in-a...

View on HN

Pretty sure Microsoft uses Azure Active Directory for SSO, not a direct competitor (source: used to work there).

That's generally true but the thing about Microsoft is that it's so huge I wouldn't be surprised at them being customers of a lot of SaaS offerings. Could be via an acquired company that is partially integrated? Or some kind of federated login for partners.

Euh, nope.

This is a reasonable take in my view. When you acquire a company, you don't get to replace their entire tech stack on day 1.

And sometimes there are chains of dependencies that need to be swapped out in sequence.

So from acquisitions alone it would seem reasonable to expect that Microsoft at any point in time has at least a handful of usages of certain SaaS offerings, even if MS themselves offer their own versions of those services.

That said, the surface area of these "unofficial" 3rd party systems is likely to be quite small in comparison to whatever their official tech stack looks like (which does -- I would assume -- centre around Azure AD). I'm not expressing an opinion on whether the GP is correct to make this link...

I've worked with some very large companies where internally they (surprisingly to me) make use of competitors' products even when that company makes their own version of that product. There are all sorts of legitimate reasons why this happens.

It would be confusing to me if Microsoft were utilising Okta themselves. Their own Azure offerings provide everything Okta does (and usually bundled into something you're already buying).

Over the weekend, LAPSUS$ posted a screenshot to its Telegram channel of what appeared to be information taken from an internal developer account for Azure, its cloud computing division.

https://gizmodo.com/microsoft-investigating-potential-lapsus...

Yes I've seen that, but I don't see how people are making the leap to assume that this Azure leak came through Okta.

I'd be kinda shocked to find that Okta isn't anywhere in Microsoft, just given acquisitions. But yeah, no evidence that it's directly related.

Azure B2C is a direct competitor to Okta... If MS isnt dogfooding this, when what would they dogfood?

Azure B2C is awful though

Azure is awful in general. Microsoft can't even copy other clouds efficiently.

In my admittedly limited experience it is “alright”, and their sales people don’t pretend that it’s magic like the AWS sales people do.

Honestly I’m so unimpressed with AWS that I find it hard to say Azure is terrible, because the bar for terrible is set much lower.

Do yourself a favor and stay away from it.

I haven't had direct experience with Azure B2C, why is it awful?

Laborious, confusing, error-prone and extremely extensively but poorly documented.

Acquisitions get authentication replaced fast (well, fast-ish, we got a year to change over). It might be around somewhere, but, AAD is used nearly universally and I've never seen Okta.

GitHub used Okta, it’s been a while so possibly replaced, but one example.

Seems a bit premature to assume this was the vector used for those other breaches.

One possible route: a Microsoft employee using an Okta protected product/service.

That other product/service was compromised, which let hackers hack into MS employee’s computer, which gave them access to Azure infrastructure.

That seems like an attack vector unrelated to the Okta breach -- if it was possible to attack the MS employee's computer from a compromised app, then whether or not that app was protected by Okta seems immaterial.

Perhaps the app was not compromised, to begin with. Hackers might’ve gotten into the build infrastructure of the app, rewrote it to make it compromised, and then all the users of that app are now compromised.

Lesson: ask your (in this case Microsoft) employees to not use work computers for any personal use.

/me goes to check if my password manager company uses Okta.

Again, this is not related to an Okta hack, employees could be using an app that has nothing to do with Okta and be compromised through this same attack vector.

This is just wild speculation to make up a scenario where Microsoft could be affected by the Okta hack with no evidence to back it up.

Agreed. It’s all speculation at this point. I hope I did not make it sound like I have any evidence to backup my speculation.

I was just trying to come up with a threat vector to explain how it might be possible.

What about the build infra of an app would provide creds to log into ADO?

The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords

[1] https://twitter.com/BillDemirkapi/status/1506109956298317830...

It's not particularly worrisome as shown in the screenshot. It appears the attacker could only send a password reset link or temporary password to the e-mail address of the user account. There is nothing in the screenshot indicating that the attacker could have changed the e-mail address to one controlled by the attacker, thus being able to reset the user's account.

Is it reasonable that they been inside Okta for 2 months and Okta hasn't noticed?

The well hidden secret among large tech companies is that persistent threats are quite often discovered after ~6 months active presence going unnoticed. Some persist for years.

much longer than that sadly. now guess what most companies set log retention to?

2 weeks?

"the quieter you are, the more you will hear"

Yes, this is very common especially when you're living off the land. You take over the one unmonitored host and then you use the internal tools as if you were a normal employee.

Reply on news.ycombinator.com