<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
  <title>Okta support system breach: HAR files with session tokens stolen · updates</title>
  <link>https://pwn.watch/i/okta-support-system-breach-2023</link>
  <description>An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.</description>
  <language>en</language>
  <lastBuildDate>Wed, 29 Nov 2023 00:00:00 GMT</lastBuildDate>
  <atom:link href="https://pwn.watch/i/okta-support-system-breach-2023/feed.xml" rel="self" type="application/rss+xml" />
  <item>
    <title>Okta support system breach: HAR files with session tokens stolen: Okta: the attacker downloaded the names and email addresses of all customer support system users</title>
    <link>https://pwn.watch/i/okta-support-system-breach-2023</link>
    <guid isPermaLink="false">https://pwn.watch/i/okta-support-system-breach-2023#2023-11-29-20c41983</guid>
    <pubDate>Wed, 29 Nov 2023 00:00:00 GMT</pubDate>
    <category>high</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://sec.okta.com/articles/october-security-incident-recommended-actions/&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
  <item>
    <title>Okta support system breach: HAR files with session tokens stolen: Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked</title>
    <link>https://pwn.watch/i/okta-support-system-breach-2023</link>
    <guid isPermaLink="false">https://pwn.watch/i/okta-support-system-breach-2023#2023-11-03-60d23de7</guid>
    <pubDate>Fri, 03 Nov 2023 00:00:00 GMT</pubDate>
    <category>high</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
  <item>
    <title>Okta support system breach: HAR files with session tokens stolen: Okta notifies customers of the security incident</title>
    <link>https://pwn.watch/i/okta-support-system-breach-2023</link>
    <guid isPermaLink="false">https://pwn.watch/i/okta-support-system-breach-2023#2023-10-19-6d520cd0</guid>
    <pubDate>Thu, 19 Oct 2023 00:00:00 GMT</pubDate>
    <category>high</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://sec.okta.com/harfiles&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
  <item>
    <title>Okta support system breach: HAR files with session tokens stolen: Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta</title>
    <link>https://pwn.watch/i/okta-support-system-breach-2023</link>
    <guid isPermaLink="false">https://pwn.watch/i/okta-support-system-breach-2023#2023-10-18-3c57c23d</guid>
    <pubDate>Wed, 18 Oct 2023 00:00:00 GMT</pubDate>
    <category>high</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
  <item>
    <title>Okta support system breach: HAR files with session tokens stolen: BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta</title>
    <link>https://pwn.watch/i/okta-support-system-breach-2023</link>
    <guid isPermaLink="false">https://pwn.watch/i/okta-support-system-breach-2023#2023-10-02-06d5cd8c</guid>
    <pubDate>Mon, 02 Oct 2023 00:00:00 GMT</pubDate>
    <category>high</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://www.beyondtrust.com/blog/entry/okta-support-unit-breach&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
  <item>
    <title>Okta support system breach: HAR files with session tokens stolen: Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC</title>
    <link>https://pwn.watch/i/okta-support-system-breach-2023</link>
    <guid isPermaLink="false">https://pwn.watch/i/okta-support-system-breach-2023#2023-09-28-288ab2d9</guid>
    <pubDate>Thu, 28 Sep 2023 00:00:00 GMT</pubDate>
    <category>high</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://sec.okta.com/articles/october-security-incident-recommended-actions/&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
</channel>
</rss>
