Hacker News Reader

Comment by stygiansonic | Hacker News Reader

See this blog post (linked in original article) from a security firm that was one of Okta's customers, and alerted them to the breech, when they detected suspicious activity on their network shortly after sharing the HAR file with Okta:

https://www.beyondtrust.com/blog/entry/okta-support-unit-bre...

View on HN

Amazon service just asked me to share a HAR file and I though for sure it was a security risk. Doesn’t that mean that agent has an authentication cookie to my account? Why can this be common with practice

Was the session still valid?

Yes, don’t share har files

Yes, modulo your session durations and, for services which implement it, IP fixation. You should treat HAR files as secrets for anything involving a login.

When I was talking to Amazon support they provided instructions on how to strip tokens together with the ask for a HAR file.

https://repost.aws/knowledge-center/support-case-browser-har... Oh you7re right. I didn't read till the end.

The post glossed over how exactly they detected session hijacking. They mentioned “This detection looks for suspicious sessions appearing without an authentication event that are consistent with session hijacking.”, but authentication obviously happened at some point, otherwise the session wouldn’t exist. I’m guessing this is a complicated way of saying the IP changed since login.

Of course the easiest solution is you shouldn’t voluntarily share HAR files for an active session.

How they detected it can be found at the bottom of the blogpost:

> *Indicators of Compromise*

> ...

> Okta activity for a user without any clear indication that the user authenticated (e.g. a user.session.start event for that user from a similar geographic area)

This post has at least some reasonable detail that one can follow to understand the issue. Okta's post requires a lots of context for understanding.

Reply on news.ycombinator.com