Category: Data Theft

Storm-0501: Unveiling the Tactics Behind Multi-Stage Hybrid Cloud Attacks

Posted on by Srishti Chaubey

Introduction

The global cloud services market, valued at $551.8 billion in 2021, is projected to reach $2.5 trillion by 2031. This explosive growth makes cloud environments a prime target for cyber criminals. One such group is Storm-0501, an extortion-orientated cyber crime group that’s been conducting multi-stage attacks against hybrid cloud environments in government, manufacturing, transportation, and law enforcement. Since its inception in 2021, Storm-0501 has changed its operations, shifting from targeting U.S. school districts to running RaaS operations. This blog post explains the tactics, techniques and procedures (TTPs) of the group to help improve organizational defenses with mitigation strategies.

Storm-0501 TTPs: Steal Technique

Initial Compromise and Discovery

Storm-0501 has traditionally obtained initial access using compromised credentials or exploitation of known vulnerabilities in systems with widespread use. In a recent campaign, Storm-0501 exploited known vulnerabilities in Zoho, ManageEngine (CVE-2022-47966), Citrix, NetScaler (CVE-2023-4966), and ColdFusion (possibly CVE-2023-29300 or CVE-2023-38203). After gaining entry into the target network, it conducts extensive exploration using several tools to find high-value assets, obtain credentials, and increase privileges.

Lateral Movement and Credential Theft

Storm-0501 uses Impacket’s SecretsDump and Cobalt Strike to move laterally across the network grabbing credentials to compromise additional devices. They target the administrative accounts, mostly utilizing password reuse or weak credentials, accessing both their on-premises and cloud environments. Using cloud session hijacking, especially in Microsoft Entra, they establish persistent backdoor access into the target systems.

From Ground to Cloud: Storm-0501’s Cross-Environment Exploits

One of the most significant tactics Storm-0501 uses is the exploitation of the Microsoft Entra Connect Sync service by doing synchronization of credentials between the on-premises AD and cloud. The attackers escalate the privileges in both environments after compromising the sync accounts to have control over the cloud environment and for a persistent backdoor for the next attack.

Storm 0501 Exploit
Credit: Microsoft

Aftermath of the Storm-0501 Attack

The aftermath of a Storm-0501 attack can be devastating, with the group often gaining control over both on-prem and cloud environments, exfiltrating sensitive data, deploying ransomware, and tampering with security products to avoid detection. The threat will only increase with the new deployment of Embargo ransomware, where victim data is encrypted and sensitive information leaked unless a ransom is paid.

Such attacks would lead to the stealing of credentials, data breaches, service disruptions, and heavy financial losses. Storm-0501 pays extra attention to sensitive sectors such as hospitals, which raises stakes not only on data security but also public safety.

Mitigation

Hybrid Cloud Security Enhancement

While Microsoft has implemented restricted permissions on DSA roles in Entra Connect Sync and Entra Cloud Sync, defending Storm-0501 needs a robust, multi-layered approach. Conditional Access policy can further harden access to cloud services from non-verified devices and locations as a risk mitigation approach.

Harden Cloud Security Measures

Even solutions proposed by today’s market leaders such as Microsoft are still often based on passwords in most cases and, hence, would probably fail to deliver proper authentication in a much-enlarged, cloud-to-on-premises environment. Therefore, organizations should embrace solutions such as PureAUTH IAM Firewall that come with the strongest security and reliability against attacks exploiting credentials and even zero-day vulnerabilities. Built on a zero-trust architecture, it provides reliable, passwordless protection, further enhancing resilience against sophisticated threats.

Conclusion

Organizations need to move away from convenient and conventional IAM solutions and start interacting with leading edge defenses, such as passwordless authentication. Enhancing cloud security policies and infrastructure defenses will enable enterprises to withstand new cyber threats.

Solutions like PureAUTH will help organizations build a far more robust infrastructure that is not only adaptable but will also neutralize the most sophisticated cyber threats in existence.

Read Also

Microsoft Entra ID Vulnerabilities: Pass-Through Authentication Risks

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

The achilles’ heel of cloud security: Why two-factor authentication isn’t enough

Disney Leaves Slack: A Strategic Retreat

Posted on by Srishti Chaubey

Walt Disney Co. is transitioning away from Slack after a serious data breach. The breach, which occurred in July 2024, compromised more than 1.1 terabytes of confidential data. This incident included 44 million messages and inside information about various projects at Slack. According to a news article in The Wall Street Journal, Disney has decided to shift to new corporate-wide communication software before the end of its fiscal year.

Credit: Bleeping Computer

Why Disney Is Getting Off Slack

The NullBulge hack led Disney to move away from Slack. Hackers accessed thousands of internal channels, exposing unreleased projects, login credentials, and sensitive corporate data. This breach highlighted Slack’s vulnerability, especially due to weak employee security practices like not using robust authentication.

Disney’s decision isn’t just a reaction to the breach but a preventive step to reduce reliance on a platform that became a weak link in its cybersecurity. By switching to streamlined collaboration tools, Disney aims for platforms that offer tighter security and better integration with its IT systems.

History of Breaches at Disney

This is not the first time that the House of Mouse has faced a breach. In July 2024, Disney suffered a breach that exposed over 1.1TB of sensitive data, including 44 million messages, 18,800 spreadsheets, and internal project details. Several months ago in early June 2024, hackers targeted the Club Penguin Confluence server and led to leaking of 2.5 GB of data and information related to the company’s legacy operations.

Credit: Bleeping Computer

Mitigation and Prevention: Enhancing Your Security Position

To prevent future incidents, companies like Disney harden up their security approach. One of these approaches involves using zero-trust products, where all actions are considered to be malicious unless proved otherwise and authenticated. The shift away from Slack for Disney should be used as an opportunity to have stronger encryption and more secure, decentralised methods of communication in a place.

Despite the risks, companies often prioritise familiar tools like Slack for their ease of use. Employees enjoy the convenience of SSO and real-time communication. However, this same ease of use can make these platforms vulnerable to attacks, as Disney’s breach demonstrated. Companies often avoid stricter security measures, such as multi-factor authentication (MFA), due to perceived inconvenience. This balance between convenience and security is where many organizations falter.


PureAUTH on the other hand, offers one-click access through passwordless authentication, which is friendly and secure.

Conclusion : One Move Toward Collaboration Over A Secure Platform

As Disney steps away from Slack, this highlights an emerging trend: companies must prioritise security in their collaboration tools. Convenience is awesome, but so is the robust security against emerging threats. PureAUTH balances convenience with the protection required to secure company data. If Disney had solutions like PureAUTH, then the breach might have been far less effective. As companies rethink their internal platforms for communication, the lesson is stark: security and usability are not mutually exclusive with PureAUTH. #gopasswordless

Read Also

Disney to ditch slack following July Data Breach

Fortinet Data Breach: Insights and Implications for Cloud Security

Posted on by Srishti Chaubey

Introduction

Fortinet recently experienced a data breach with 440GB of stolen files. This incident underscores the critical importance of securing data in third-party cloud environments. In this blog, we dive into the details of the Fortinet breach, its implications, and why moving towards passwordless authentication is an essential step for enhancing security.

The Fortinet Breach: A Detailed Overview

Fortinet, renowned for its comprehensive cybersecurity solutions, has confirmed a significant data breach. The hacker, using the name “Fortibitch,” claimed to have exploited an Azure SharePoint vulnerability to steal 440GB of data in this breach, dubbed “Fortileak“.

Fortinet data breach: Fortibitch
Credit: Hackread.com

How the Breach Happened

According to reports, the breach involved unauthorised access to Fortinet’s Azure SharePoint instance. The hacker provided credentials to an Amazon S3 bucket where the stolen data was allegedly stored. The leaked data included customer information and various corporate documents.

Fortinet confirmed the breach involved less than 0.3% of its customer base, affecting a limited number of files. The company assured stakeholders that there was no evidence of malicious activity affecting its operations or services. No ransomware was deployed, and Fortinet’s corporate network remained secure.

The Response from Fortinet

Fortinet acted swiftly to mitigate the impact of the breach. The company engaged in immediate containment measures, including terminating the unauthorised access and notifying affected customers. They also worked with law enforcement and cybersecurity agencies to address the situation.

In their update, Fortinet emphasised that the breach did not involve data encryption or ransomware. The company’s operations and financial performance remain unaffected, with no significant impact reported.

Key Takeaways and Security Lessons

This incident highlights several critical lessons for organisations:

1. Secure Cloud Environments

The Fortinet breach underscores the need for robust security measures around cloud-based environments. Companies must properly configure their cloud storage solutions and actively protect them against unauthorized access.

2. Implement Strong Access Controls

Using multi factor authentication (MFA) is minimum, but given the MFA are also getting bypassed, more secure authentication like PureAUTH is highly recommended

3. Continuous Monitoring and Response

Proactive monitoring of cloud assets and rapid response to security incidents are essential for minimising the impact of breaches. Organisations should have incident response plans in place to handle such situations effectively.

Embracing Passwordless Authentication for Enhanced Security

As demonstrated by the Fortinet breach, traditional security measures, including passwords and MFA, are increasingly inadequate. The shift towards passwordless authentication offers a more secure and resilient alternative.

Passwordless authentication solutions like PureAuth provide a breach-resilient architecture by leveraging advanced cryptography and just-in-time access. This approach significantly reduces the risk of third-party breaches and enhances overall security. Key benefits include:

  • Breach Resilience: PureAuth’s architecture is designed to withstand breaches by eliminating the reliance on passwords and minimising attack vectors.
  • Flexible Security Measures: We work with you to design fallback and recovery mechanisms, ensuring uninterrupted access to enterprise resources.
  • Ongoing Support: Comprehensive breach support is available to address any issues that arise.
Fortinet data breach: Embracing passwordless authentication

Transitioning to passwordless authentication is no longer just a best practice but a necessity for enterprises aiming to protect critical assets. Passwords and traditional 2FA/MFA methods are becoming increasingly inefficient and insecure. Adopting a passwordless approach enhances security, simplifies access management, and aligns perfectly with modern cybersecurity needs.

Conclusion

The Fortinet data breach serves as a stark reminder of the evolving threats in the cybersecurity landscape. While Fortinet’s response has been commendable, organisations must take proactive steps to safeguard their data, especially in cloud environments. Moving towards passwordless authentication solutions like PureAuth offers a forward-thinking approach to security, addressing the limitations of traditional methods and providing a more resilient defence against breaches.

For enterprises looking to enhance their security posture, embracing passwordless authentication is not an option—it is a necessity. Ensure your organisation is equipped to handle the future of cybersecurity with advanced, breach-resilient solutions. #gopasswordless

Critical Vulnerabilities in SolarWinds Web Help Desk and the Essential Hotfixes

Posted on by Srishti Chaubey

SolarWinds’ Web Help Desk, a widely used IT management software, recently faced severe security challenges. These vulnerabilities, if left unpatched, could expose organizations to significant risks. The latest updates have addressed these flaws, but understanding their impact and the necessary steps for mitigation is crucial.

The Gravity of the Situation

Two major vulnerabilities—CVE-2024-28986 and CVE-2024-28987—were discovered in SolarWinds’ Web Help Desk (WHD). These issues were severe enough to warrant critical CVSS scores of 9.8 and 9.1, respectively.

The first, CVE-2024-28986, is a remote code execution (RCE) vulnerability caused by a Java deserialization flaw. If exploited, it allows an attacker to execute arbitrary commands on the affected host. Despite initial reports suggesting the vulnerability could be exploited without authentication, SolarWinds could only reproduce it after authentication. Nonetheless, due to the severity, SolarWinds issued a hotfix and strongly urged all users to apply it immediately.

The second vulnerability, CVE-2024-28987, is particularly concerning. It involves hardcoded credentials within the Web Help Desk software. This flaw enables unauthenticated attackers to log into vulnerable systems, access internal functionalities, and potentially modify sensitive data. Given the widespread use of Web Help Desk across various sectors, including government, healthcare, and education, the implications of such a flaw are far-reaching.

SolarWinds’ Response and Hotfixes

SolarWinds responded quickly to these vulnerabilities by releasing Web Help Desk 12.8.3 Hotfix 2. This hotfix addresses both the RCE vulnerability and the hardcoded credential issue. It also restores functionality compromised in earlier patches, ensuring the software operates securely and efficiently.

For those managing the Web Help Desk, applying this hotfix is not just recommended but essential. The installation process, though manual, is straightforward, involving the replacement of specific files within the Web Help Desk directory. SolarWinds provides detailed instructions to ensure administrators can apply the fix without disrupting their systems. Creating backups before modifying files is crucial, allowing for a quick rollback.

The Importance of Immediate Action

The recent history of SolarWinds, particularly the infamous breach involving its Orion software, underscores the need for prompt and decisive action in the face of security vulnerabilities. The company’s IT products are critical infrastructure components for many organizations. Leaving these vulnerabilities unpatched could lead to severe consequences, including unauthorized access, data breaches, and potentially devastating operational disruptions.

Given that these vulnerabilities are now known and patches are available, malicious actors are likely scanning for unpatched systems. Organisations must prioritise the application of these hotfixes to protect their IT environments and data.

The Need for Enhanced Security Measures

The recurring vulnerabilities in SolarWinds products serve as a stark reminder of the importance of proactive security measures. One crucial step is the adoption of passwordless authentication systems. Hardcoded credentials, as seen in CVE-2024-28987, pose a significant security risk. Credentials, in general, are a weak point in many systems, often becoming targets for exploitation.

By implementing passwordless solutions like PureAuth, organizations can significantly reduce the attack surface. Passwordless systems eliminate the need for traditional credentials, replacing them with more secure authentication methods such as biometrics or hardware tokens. This not only enhances security but also improves the user experience by streamlining the login process.

Conclusion

SolarWinds Web Help Desk has been a reliable tool for many organizations, but these recent vulnerabilities highlight the ongoing security challenges in software development. By staying vigilant and promptly applying security patches, organizations can mitigate risks and continue to benefit from the functionality provided by the Web Help Desk. The critical nature of the CVEs discussed cannot be overstated, and the onus is on system administrators to act swiftly and decisively.

For more detailed coverage of SolarWinds’ security challenges, visit BleepingComputer and PureID’s analysis. The journey to a more secure environment begins with proactive steps, and passwordless authentication is a crucial part of that journey.

RockYou2024: Nearly 10 Billion Passwords Leaked Online

Posted on by Srishti Chaubey

Introduction

On July 4, 2024, the cybersecurity community was rocked by the discovery of RockYou2024, the largest password compilation leak in history. This staggering breach, revealed by a Cybernews research team, includes nearly 10 billion unique plaintext passwords. The massive dataset, posted on a popular hacking forum, presents severe security risks, especially for users prone to reusing passwords.

The RockYou2024 Password Leak

The RockYou2024 password leak, tracked as the largest of its kind, was unveiled by Cybernews researchers. The file, named rockyou2024.txt, contains an astounding 9,948,575,739 unique plaintext passwords. The dataset was posted by a user named “ObamaCare,” who has a history of leaking sensitive information. This compilation is believed to be a mix of old and new data breaches, significantly increasing the risk of credential stuffing attacks.

Credit: Cybernews

A Brief History of RockYou

The RockYou series of password leaks dates back to 2009, when the original RockYou breach exposed over 32 million user account details. In 2021, the RockYou2021 compilation, containing 8.4 billion passwords, set a new record at the time. RockYou2024 expands on this legacy, adding another 1.5 billion new passwords, making it the largest password dump to date.

Impact and Exploitation Risks

The RockYou2024 leak poses significant dangers due to the vast number of real-world passwords it contains. Cyber-criminals can leverage this data to execute brute-force attacks, attempting to gain unauthorised access to various online accounts. Combined with other leaked databases containing usernames and email addresses, RockYou2024 could lead to widespread data breaches, financial fraud, and identity theft.

How to Protect Against RockYou2024

Reset Compromised Passwords

Immediately reset passwords for any accounts associated with the leaked data. Ensure new passwords are strong, unique, and not reused across multiple platforms.

Enable Multi-Factor Authentication (MFA)

Enable MFA wherever possible. This adds an extra layer of security by requiring additional verification beyond just a password.

Implement Passwordless Solutions

Adopting passwordless solutions can further enhance security. SAML-based passwordless solutions, such as Single Sign-On (SSO) systems, eliminate the need for passwords by using secure tokens for authentication. These solutions reduce the risk of password-related attacks and improve user convenience.

Monitor Accounts and Stay Informed

Regularly monitor accounts for suspicious activity and stay informed about the latest cybersecurity threats and best practices.

Conclusion

This recent breach highlights how fragile and unsafe passwords are, underscoring the need for more secure authentication methods. The RockYou2024 leak demonstrates that even with strong, unique passwords, the risks remain significant. Multi-factor authentication (MFA), while an added layer of security, is not foolproof. For example, MFA breaches such as the 2022 Uber hack and the attack on Microsoft’s Office 365 users in 2021 show its vulnerabilities.

Additionally, password managers are not entirely reliable. The Okta breach in 2022 and the OneLogin breach in 2017 exposed millions of user accounts, demonstrating that even these tools can be compromised.

In light of these risks, passwordless systems are emerging as the next hot trend in cybersecurity. SAML-based passwordless solutions, like PureAuth, provide enhanced security by eliminating the need for passwords and reducing the attack surface for cybercriminals.

Embracing passwordless systems, combined with continuous monitoring and updated security practices, is essential for protecting against the evolving threat landscape. Stay ahead of cyber threats by adopting innovative authentication methods and ensuring your digital assets are well-protected.

New York Times Source Code Leak

Posted on by Srishti Chaubey

Introduction

The New York Times recently experienced a significant security breach, leading to the leak of their source code. This breach was initiated through an exposed GitHub token, allowing unauthorised access to their repositories

How It Happened

An anonymous hacker posted the New York Times’ source code on 4chan. The breach occurred due to an exposed GitHub token, which provided access to over 5,000 repositories, totalling 270 GB of data. The stolen data included sensitive and proprietary information.

Response from The New York Times

The New York Times confirmed the breach and revealed that a credential was inadvertently exposed in January 2024. They quickly addressed the issue, emphasising that their systems remained non-compromised and their operations unaffected. However, this incident highlights the critical need for stringent security measures.

Implications of the Leak

The breach exposed vast amounts of data, including source code for various projects. This poses significant risks for the New York Times, including potential security vulnerabilities and intellectual property theft. The leaked data also included uncompressed tar files, with the hacker urging users to seed due to potentially insufficient seed-boxes. Reactions ranged from disbelief at the volume of repositories to jokes about the newspaper’s digital complexity.

Connection to Disney Leak

Just days before, another breach occurred involving Disney’s internal servers. A hacker associated with the defunct game Club Penguin leaked 2.5 GB of sensitive data, including corporate strategies and internal emails. This shows a disturbing trend of high-profile data breaches. The Disney breach exploited Confluence servers via exposed credentials, further emphasising the need for robust security practices.

Conclusion

This incident underscores the critical importance of securing access tokens and implementing robust security measures to prevent unauthorised access to sensitive information. As cyber threats evolve, organizations must remain vigilant and proactive in safeguarding their digital assets. Securing the CI/CD Pipeline should be a priority for every organization and PureID’s CASPR can be a game-changer.

SolarWinds New 0-Day: Serv-U Update

Posted on by Srishti Chaubey

SolarWinds Serv-U, one of the leading multi-protocol file servers, reported a critical exploit marked as CVE-2024-28995. It allows unauthorised access to sensitive files. This path traversal flaw poses a significant security risk.

Credit: CyberInsider

What is CVE-2024-28995?

CVE-2024-28995 is a path traversal vulnerability in SolarWinds Serv-U. Attackers can exploit it remotely and without authentication. It allows an attacker to send specially crafted requests to the server, potentially accessing sensitive files and data from the underlying operating system. This could include user data, server logs, and other critical files​

Historical Context

SolarWinds Serv-U has been targeted before. In 2021, a zero-day vulnerability (CVE-2021-35211) was exploited by a group called Circle Typhoon. This historical precedent underscores the importance of patching vulnerabilities in managed file transfer solutions, which are prime targets for cyber criminals​.

Exploitation Details

Researchers have observed both automated and manual exploitation attempts. These began after the release of proof-of-concept (PoC) exploit details on June 18, 2024. GreyNoise reported seeing active exploitation in the wild. The PoC scripts made it relatively straightforward for attackers to leverage this vulnerability, prompting urgent calls for patching​

Implications for Organisations

Managed file transfer solutions are prime targets for ransomware groups. Examples include attacks on Accellion’s FTA, Fortra’s GoAnywhere MFT, and Progress Software’s MOVEit Transfer. These attacks often result in data breaches and extortion attempt.

Mitigation and Recommendations

SolarWinds released a patch to address CVE-2024-28995. Users of Serv-U FTP and MFT solutions should upgrade to version 15.4.2 HF 2 or later. Immediate patching is crucial due to the active exploitation and sensitivity of the data at risk.

Identifying Affected Systems

Tenable has developed plugins to identify vulnerable systems. These plugins are available on the CVE page for CVE-2024-28995. Organisations should use these tools to detect and remediate this vulnerability.

Enhancing Security with Passwordless Systems

To bolster security and protect against vulnerabilities like CVE-2024-28995, consider implementing passwordless authentication systems. Traditional passwords are often a weak link in cybersecurity, prone to phishing, brute force attacks, and credential stuffing. By moving to a passwordless system, you can significantly enhance the security posture of your SolarWinds Serv-U environment.

Benefits of Passwordless Authentication:

  1. Reduced Attack Surface
  2. Improved User Experience
  3. Enhanced Security
  4. Compliance and Standards

Implementing Passwordless Systems with PureAuth:

PureAuth offers a robust passwordless authentication solution that can be integrated into your existing infrastructure. By using PureAuth, you can secure your SolarWinds Serv-U environment against unauthorised access and potential vulnerabilities.

Conclusion:

CVE-2024-28995 is a serious vulnerability actively exploited in the wild. Organisations using SolarWinds Serv-U must prioritise patching to protect their systems. Enhancing security with passwordless systems is a proactive step in safeguarding your SolarWinds Serv-U environment. By implementing solutions like PureAuth, you can reduce the risk of exploitation from vulnerabilities like CVE-2024-28995 and ensure a more secure and user-friendly authentication process.

SnowBall effect of Snowflake Breach

Posted on by Srishti Chaubey

Executive Summary

Snowflake an American cloud computing–based data cloud company, identified a breach in June 2024, which had far-reaching implications for various organisations. Attackers exploited stolen credentials from a Snowflake employee, enabling unauthorised access to sensitive customer data, including credentials and access tokens. This breach was exacerbated by bypassing Okta’s security measures, allowing the attackers to generate new session tokens and access extensive customer data without detection.

Key Affected Customers:

Attack Method

  • Credentials Theft: Initial access through compromised employee credentials
  • Bypass Mechanism: Circumvention of Okta Security Protocols
  • Exploitation: Generation of new session tokens to access databases and steal data
Attack Path Diagram
Credit: The Hacker News

The Domino Effect

The Snowflake breach has created a domino effect, where the initial compromise has led to multiple subsequent breaches. This incident mirrors the earlier Okta breach,, where attackers leveraged stolen credentials to infiltrate various organizations.

Domino Effect of Snowflake Breach

Companies affected include:

  • Ticketmaster: Reported unauthorised access to sensitive data.
  • Advance Auto Parts: Experienced data theft, with stolen information now for sale on dark web marketplaces.
  • Santander Bank: Compromised customer data led to financial and reputational damage.
  • Hugging Face, Quote Wizard, Lending Tree: Also reported breaches, with more organizations likely to follow .

Inherent Weaknesses in Traditional IAM Solutions

Password + MFA Based Authentication:

  • Reliance on passwords makes systems vulnerable to phishing and credential theft.
  • Multi-Factor Authentication (MFA) is often ineffective as attackers can bypass Password + MFA protection mainly by phishing or using a compromised device.
  • Social Engineering attacks have shown that phishing resistant MFA like FIDO keys, & passkeys can prove to be ineffective & can be easily disabled or reset.

IAM Blind Spots:

Apart from reliance on vulnerable passwords for identifying user. The existing IAM solutions are blind to following risks

  • Connection Risk – Traditional IAM solutions lack visibility of user connections. They cannot know whether an authentication request is coming from an authorised actor or an attacker in the middle.
  • User’s Device Risk – They also do not account for the type & security posture of user’s devices, leaving systems exposed to malware and remote monitoring, as seen in the Uber incident.

Impact Assessment

The Snowflake breach is termed as the biggest data breach so far and it’s cascading effect has led to numerous organisations reporting security incidents & data breach. 

The amplification effect could potentially lead to a vast number of downstream breaches, escalating the overall impact.

Impact of Snowflake Breach
Credit: XQ

Towards a Secure Future

Challenges with Current Solutions:

  • Time and again Password + MFA based systems are proven to be ineffective against simple attacks like phishing & social engineering.
  • There is a pressing need for more robust authentication mechanisms.

Protect your Enterprise, #GoPasswordless with PureAUTH

FIDO Solutions like Passkeys and hardware tokens focus on giving users a passwordless experience keeping the passwords on the server as the primary way to identify and authenticate users.

PureAUTH Platform on the other hand provides a comprehensive passwordless approach, eliminating the passwords from server side & not just from user side. PureAUTH is the only solution that protects an organisation against phishing, social engineering, frauds & all types of credential-based attack.

To learn more about PureAUTH & how it protects your existing IAM systems like Okta, OneLogin, CISCO Duo, or Azure AD in just 60 minutes at Zero Cost – get in touch with us

Related Blogs

Okta Warns Customers of Credential Stuffing Attacks

Unpacking Okta’s Recent Security Breach

Okta Warns Customers of Credential Stuffing Attacks

Posted on by Srishti Chaubey

In a recent advisory, Okta, a leading identity and access management services provider, sounded the alarm over a rise in credential stuffing attacks targeting online services. Let’s delve into the details of this warning and understand the implications.

Overview of the Threat

Okta reported a significant increase in the frequency and scale of credential stuffing attacks against online services in recent weeks. These attacks have been fuelled by the widespread availability of residential proxy services, lists of previously stolen credentials, and automation tools. The surge in attacks poses a severe threat to the security of user accounts and sensitive data.

Observations by Security Experts

Duo Security and Cisco Talos also observed large-scale brute-force attacks against various targets, including VPN services, web application authentication interfaces, and SSH services. The attacks, originating from TOR exit nodes and other anonymizing tunnels and proxies, targeted VPN appliances and routers from multiple vendors.

Modus Operandi of Credential Stuffing Attacks

Credential stuffing attacks involve the automated trial of username and password combinations obtained from previous data breaches or phishing campaigns. Threat actors exploit the reuse of login credentials across multiple accounts, attempting to gain unauthorised access to compromised accounts.

Recommendations for Organisations

  • Enable ThreatInsight in Log and Enforce Mode for proactive IP address blocking.
  • Deny access from anonymizing proxies to prevent attacks from dubious sources.
  • Switch to Okta Identity Engine for enhanced security features.
  • Utilize CAPTCHA challenges and passwordless authentication with Okta FastPass.
  • Implement Dynamic Zones to manage access based on geo-location and other criteria.
Okta's Warning on Credential Stuffing Attacks
Blocking anonymized requests from Admin Console > Settings > Features
Okta

Implementing these recommendations can fortify an organisation’s defence against credential stuffing attacks, ensuring a safer online environment for users and stakeholders.

Conclusion

Credential stuffing attacks pose a significant threat to the security of online services and user accounts. By heeding Okta’s warning and implementing robust security measures, Okta customers can better protect themselves against these malicious activities and safeguard their sensitive data.

Another approach to create a safer cyber world is to not use the typical password based authentication. By eliminating passwords, organizations can improve their defences, increase security and reduce the risk of future incidents. Typical cyber attacks such as Credential Stuffing are not applicable to Passwordless authentication, so the best way to move forward is to #gopasswordless

Read Also

Unpacking Okta’s Recent Security Breach

Okta Breach Part 2: Unveiling the Full Scope and Impact

Passwords Leaked : Microsoft in Trouble

Posted on by Srishti Chaubey

Introduction

Recent reports unveil a significant data breach at Microsoft, exposing employee passwords and confidential corporate data to the internet. This breach underscores the pressing need for robust cybersecurity protocols and heightened vigilance to safeguard sensitive information.

Microsoft: Passwords Exposed Online
Credit: Business Today

About the Breach

Security researchers from SOCRadar (Can Yoleri, Murat Özfidan and Egemen Koçhisarlı )discovered an open and public storage server on Microsoft’s Azure cloud service. This server was housing internal data related to the Bing search engine. Left unprotected, it exposed code, scripts, and configuration files containing credentials used by Microsoft employees to access internal systems.

Data Exposure

The exposed data poses severe risks, potentially granting malicious actors access to other confidential files within Microsoft’s network. The lack of password protection on the server facilitated easy access to sensitive information, raising concerns about cybersecurity vulnerabilities.

Response and Resolution

The researchers promptly notified Microsoft of the vulnerability in February, prompting the company to secure the exposed server by March. However, the duration of the data exposure and the extent of unauthorised access remain unclear.

In a statement shared after publication on 10th April, Microsoft’s Jeff Jones said: “Though the credentials should not have been exposed, they were temporary, accessible only from internal networks, and disabled after testing. We thank our partners for responsibly reporting this issue.” But Microsoft has yet to issue an official statement addressing the breach.

Breach History: The latest addition to a series of “Mishaps”


Microsoft has faced numerous security breaches, like the ‘Summer 2023 Exchange Intrusion,’ where hackers accessed mailboxes of 22 organizations and 500 individuals, including senior US government officials. The company’s lax corporate culture and failure to prioritise security investments were criticised by the US Cyber Safety Review Board. Recent oversights, like mislabelling CVEs in Patch Tuesday releases, exposed gaps in Microsoft’s security protocols. Last year, researchers found that Microsoft employees were exposing their own corporate network logins in code published to GitHub.

Conclusion

As Microsoft grapples with the aftermath of this data breach, it highlights the ongoing battle against evolving cybersecurity threats. Human error is inevitable, and we require systems that are error-proof to avoid such breaches occurring in the future. By embracing secure identity and access management technologies, such as passwordless authentication, organizations can significantly reduce the risk of security lapses and enhance overall cybersecurity posture.

Read Also

Microsoft Reveals Russian Hack: Executive’s Emails Compromised

Securing Cloud Environments: Lessons from the Microsoft Azure Breach

© 2024 | PureID. All Rights Reserved

Privacy & Terms | Licenses