The Okta breach, alleged Lapsus$ members get arrested, and Kaspersky gets the boot!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for March 29 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
I’ve got lots of updates on the Lapsus hacker group this week, so, onto the first story.
If you saw last week’s episode, you’re probably wondering why I didn’t mention
Okta.
That is because my recording schedule is always on Mondays, and that news broke late Monday
night and early Tuesday morning.
So that’s why I’m discussing it today.
Okta, which is a large cybersecurity company that focuses on authentication services for
a slew of companies and organizations, also called Identity and Access Management or IAM,
was targeted in an attack by Lapsus back in January, though we’re just now hearing about
it due to screenshots posted and spread online by the hacking group.
Okta is a solution for single sign on or SSO.
So employees don’t have to remember passwords for all of their work related apps - instead
they could just have one single sign on credential used for all of the above.
Last Monday, the Lapsus group posted screenshots purported to be an attacker logging into Okta
systems, including a Slack account and a variety of apps.
One screenshot looked to be someone changing the password of a Cloudflare employee.
The CEO of Cloudflare tweeted on Tuesday last week that any employees who had changed their
passwords in the last four months would have their Okta credentials reset out of an abundance
of caution but Cloudflare had not seen any indicators of compromise.
Since Okta clients are big industry names, that could mean Lapsus was using Okta to try
to gain access and attack other companies.
Lapsus claims this hack happened because they had an interest in hacking Okta customers,
they didn’t access or steal any databases from Okta.
At that time, Okta responded to requests for more information about an attack in late January
of 2022, saying they “detected an attempt to compromise the account of a third party
customer support engineer working for one of the subprocessors.”
It was investigated and contained by the subprocessor.
The subprocessor was named as Sitel, a company that offers outsourced sales, support, and
customer service.
The attackers used RDP to access a support engineer’s laptop.
The engineer’s account was flagged because a new MFA addition was “attempted” and
Okta sessions were terminated within minutes.
Even though Okta confirmed this attack happened in January, they don’t believe it’s contributed
to any other ongoing attacks.
Okta explained in a statement that a third party forensics firm was investigating the
issue and once the investigation was completed the firm turned over a report on the attack
to Sitel, and Sitel gave Okta the full report last week, showing that the event took place
over a five day timeframe from January 16-21, at which time the attackers had access to
the laptop.
Okta says this affected about 2.5% or 375 of their customers.
So far we know that Lapsus has claimed to be behind several major intrusions including
Nvidia, Samsung, Okta, Ubisoft and more.
The newest of these is Microsoft and LG Electronics.
Lapsus posted a screenshot on Telegram, similar to how they posted about Okta, which showed
a Microsoft developer account they had access to.
At the time, Microsoft said they were investigating the claims.
Shortly after this Microsoft confirmed that they were targeted by Lapsus and the hacking
group did indeed gain limited access, though no customer code or data was breached.
According to the company, they were already investigating due to the observed actions
on this account, so when Lapsus publicly posted that they had access to a Microsoft account,
this just escalated Microsoft’s investigation.
Lapsus posted a torrent linking to what they claim to be source code for Bing, Bing Maps,
and Cortana.
They leaked a total of 37 GB of data from Microsoft’s Azure DevOps server.
Just hours after Bloomberg published a story about a 17 year old living at his moms house
in Oxford, England who was suspected of being the leader of the Lapsus group, seven people
who are suspected of being involved with the Lapsus hacking group were arrested, according
to the City of London Police.
It’s unknown whether or not the 17 year old was included in this roundup but since
he’s a minor, he cannot be named.
All of the arrested people are between 16 to 21 years of age according to the police,
who have been conducting an investigation.
All were also released under the investigation.
No names were released, though some identities have been known for quite some time by authorities
due to rival groups doxxing each other.
The authorities also believe another Lapsus member resides in Brazil and there could be
others.
It’s currently unknown exactly how many members are in the group, but their Telegram
account has 47,000 subscribers and members speak several languages including English,
Russian, Turkish, German, and Portuguese.
Lapsus appears to be quick on their feet in terms of attacks, using social engineering
or paying employers of companies to gain access, but their own operational security appears
to be lacking, so rival hacking groups have been able to obtain identifying information
about some of the members.
So it’s no surprise law enforcement has been able to start arresting people allegedly
connected to Lapsus.
We’ll likely see more arrests happen this year.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support.
THANK YOU to everyone who supports the show via Patreon.com/threatwire.
Let’s finish out today’s episode with my last top story, about Kaspersky.
The US’s Federal Communications Commission or FCC just added several companies to their
Covered entity List including China Mobile International USA, China Telecom Americas,
and Kaspersky.
Yes, Kaspersky.
That means the Russian cybersecurity company is now stated to pose an unacceptable risk
to US national security.
That includes any kind of security products and solutions the company supplies, or anything
linked to the company through subsidiaries or affiliates.
Any company included on the FCC’s covered list cannot receive support through the FCC’s
Universal Service Fund.
The US agency took this action as required by the Secure and Trusted Communications Networks
Act of 2019, and in pursuant to the Binding Operational Directive set by the DHS in 2017
that banned federal agencies from using Kaspersky products on systems.
Any company on this list not only can’t receive support, but they are also barred
from buying parts or components from US companies unless the government approves of the transaction.
Kaspersky had much to say about the entity list inclusion.
The company stated they’re disappointed by the FCC decision and claimed it was not
based on any technical assessment but only based on political grounds.
But this does follow in the footsteps of Germany’s own alert on Kaspersky about a week prior.
Germany’s Federal Office for Information Security told companies to not use Kaspersky
products.
Kaspersky also responded to this alert by saying it was politically motivated, not based
on technical grounds.
Unfortunately for Kaspersky, this isn’t the only hit to the company.
HackerOne, a bug bounty platform, disabled the Russian company's bug bounty program on
Friday.
HackerOne also suspended the programs of companies in Russia, Belarus, and sanctioned areas of
Ukraine.
HackerOne blocked Kaspersky from accessing the program and froze any existing funds they’d
received in their account from previously reported security vulnerabilities.
Kaspersky is still accepting vulnerability reports by security researchers through its
own self hosted bug bounty program.
Want to see more tech videos from me?
Check out my youtube channel - youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
And with that, don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!