1 00:00:00,050 --> 00:00:01,550 Snorkel42: can I make an admission real quick? 2 00:00:02,449 --> 00:00:04,069 I had no idea what that karma meant. 3 00:00:05,739 --> 00:00:06,039 W. Curtis Preston: Yeah. 4 00:00:06,129 --> 00:00:09,370 Snorkel42: I did not know what that number translated. 5 00:00:28,878 --> 00:00:31,938 W. Curtis Preston: Hi, and welcome to Backup Central's Restore it All podcast. 6 00:00:31,938 --> 00:00:32,598 I'm your host, W. 7 00:00:32,598 --> 00:00:33,348 Curtis Preston. 8 00:00:33,408 --> 00:00:34,398 AKA Mr. 9 00:00:34,398 --> 00:00:34,908 Backup. 10 00:00:35,268 --> 00:00:39,418 And I have with me, my fellow photo-shoot model, Prasanna Malaiyandi. 11 00:00:39,788 --> 00:00:40,478 going, Prasanna? 12 00:00:41,108 --> 00:00:41,948 Prasanna Malaiyandi: I'm good. 13 00:00:41,998 --> 00:00:45,438 That was a very interesting experience, but I had fun and 14 00:00:45,438 --> 00:00:46,578 it was good to see you too. 15 00:00:47,558 --> 00:00:51,248 What's funny is that's the first time I've been to an office in the last two years. 16 00:00:51,248 --> 00:00:53,168 It just wasn't my office. 17 00:00:54,378 --> 00:00:55,328 W. Curtis Preston: Right, Yeah. 18 00:00:55,368 --> 00:00:58,158 yeah, w it is actually, Druva's new office. 19 00:00:58,158 --> 00:01:02,838 We moved from, we were over on California avenue in Sunnyvale, 20 00:01:02,838 --> 00:01:03,888 and now we're over on. 21 00:01:04,908 --> 00:01:05,298 What is it? 22 00:01:05,738 --> 00:01:06,668 Prasanna Malaiyandi: mission college 23 00:01:06,858 --> 00:01:11,808 W. Curtis Preston: college in Santa Clara across from the Intel museum? 24 00:01:11,928 --> 00:01:12,528 I believe, 25 00:01:13,313 --> 00:01:14,953 Prasanna Malaiyandi: yeah, it's one of Intel's campuses 26 00:01:14,953 --> 00:01:15,043 W. Curtis Preston: Yeah. 27 00:01:15,218 --> 00:01:19,558 and, so I wanted to do some photos podcast. 28 00:01:19,948 --> 00:01:24,628 Prasanna Malaiyandi: Curtis tired of his face being on the homepage 29 00:01:24,628 --> 00:01:26,788 or the title art for the podcast. 30 00:01:27,658 --> 00:01:29,218 But I liked your photo. 31 00:01:29,593 --> 00:01:30,163 W. Curtis Preston: what's that. 32 00:01:30,478 --> 00:01:32,788 Prasanna Malaiyandi: I liked the picture of you on the podcast. 33 00:01:33,433 --> 00:01:35,693 W. Curtis Preston: have you seen the new, the the bearded contemplated one? 34 00:01:35,708 --> 00:01:36,668 Prasanna Malaiyandi: Yes, I have. 35 00:01:36,728 --> 00:01:37,838 That one's also good too. 36 00:01:38,248 --> 00:01:38,388 Yeah. 37 00:01:38,388 --> 00:01:39,783 W. Curtis Preston: I got lots of compliments on that photo, 38 00:01:39,783 --> 00:01:40,863 but I wanted your picture. 39 00:01:41,803 --> 00:01:46,033 I wanted this giant mane of yours to be captured because I think one 40 00:01:46,033 --> 00:01:49,843 day you're going to come to your senses and maybe cut it all off and 41 00:01:50,023 --> 00:01:51,703 I want to capture It for posterity. 42 00:01:52,093 --> 00:01:57,933 And so we had a photo shoot and, we got to, we got some, it was. 43 00:01:57,933 --> 00:01:59,253 a lot of fun doing that, 44 00:01:59,303 --> 00:01:59,813 Prasanna Malaiyandi: It was. 45 00:02:00,263 --> 00:02:03,143 Thank you, Alex, if you're listening to this, but that was awesome. 46 00:02:03,593 --> 00:02:04,163 Thank you for the help. 47 00:02:04,188 --> 00:02:08,548 W. Curtis Preston: Alex did a great job and there were, just a couple 48 00:02:08,548 --> 00:02:11,758 of dudes taking photos in an office. 49 00:02:12,328 --> 00:02:14,308 It wasn't awkward at any time. 50 00:02:15,963 --> 00:02:18,093 Prasanna Malaiyandi: No, not at all. 51 00:02:18,428 --> 00:02:19,388 W. Curtis Preston: Not at all. 52 00:02:19,418 --> 00:02:19,988 Yeah. 53 00:02:20,048 --> 00:02:24,418 Look longingly into each other's eyes. 54 00:02:25,508 --> 00:02:28,908 Yeah, By the time you hear this, hopefully those photos or some 55 00:02:28,908 --> 00:02:32,818 of those photos will be up on the website, at backupcentral.com. 56 00:02:33,078 --> 00:02:36,598 And, before I bring on our guest, I'll go ahead and throw out our usual disclaimer. 57 00:02:36,908 --> 00:02:39,058 I mentioned, the Druva office I work for Druva. 58 00:02:39,138 --> 00:02:40,828 Prasanna happens to work for zoom. 59 00:02:41,158 --> 00:02:42,958 This is not a podcast of either company. 60 00:02:42,988 --> 00:02:46,108 And the opinions that you hear are all ours. 61 00:02:46,538 --> 00:02:50,048 Be sure to rate us at ratethispodcast.com/restore 62 00:02:50,528 --> 00:02:52,178 and subscribe to the podcast. 63 00:02:52,178 --> 00:02:54,818 You can either do it in your favorite pod catcher, or you can 64 00:02:54,818 --> 00:02:57,458 go over to backupcentral.com and subscribe to our mailing list. 65 00:02:57,458 --> 00:03:02,228 And we'll let you know, every time we come out with an episode and, we also are 66 00:03:02,228 --> 00:03:04,028 always looking for interesting guests. 67 00:03:04,028 --> 00:03:05,588 We have discovered a good one this week. 68 00:03:05,618 --> 00:03:07,058 I'm very excited to bring him on. 69 00:03:07,513 --> 00:03:11,133 And, if you're interested in the things we're interested, which is data 70 00:03:11,133 --> 00:03:18,013 protection, disaster recovery, backup and recovery security, beer, barbecue. 71 00:03:19,338 --> 00:03:19,878 Prasanna Malaiyandi: barbecue. 72 00:03:19,908 --> 00:03:20,298 Definitely. 73 00:03:20,298 --> 00:03:20,508 Yes. 74 00:03:20,508 --> 00:03:21,108 To barbecue. 75 00:03:22,693 --> 00:03:23,173 W. Curtis Preston: Definitely. 76 00:03:23,173 --> 00:03:23,443 Yes. 77 00:03:23,443 --> 00:03:24,283 To barbecue. 78 00:03:24,703 --> 00:03:31,233 And, then, just reach out to me @wcpreston on Twitter or wcurtispreston@gmail.com. 79 00:03:31,673 --> 00:03:35,863 Today I wanted to talk about a little something has 80 00:03:35,863 --> 00:03:37,723 happened in the InfoSec world. 81 00:03:37,723 --> 00:03:38,503 Isn't that right, Prasanna? 82 00:03:39,148 --> 00:03:39,478 Prasanna Malaiyandi: Yep. 83 00:03:39,595 --> 00:03:41,702 just a tiny little something, nothing big. 84 00:03:41,746 --> 00:03:43,156 W. Curtis Preston: I'm flashing back to the matrix. 85 00:03:43,951 --> 00:03:45,061 I don't remember which one. 86 00:03:45,121 --> 00:03:47,941 I think it was the third one, the key master. 87 00:03:48,121 --> 00:03:49,711 you got the guy with all the keys. 88 00:03:50,611 --> 00:03:58,741 So we're talking of course, about the Okta compromise that went wide this week. 89 00:03:59,931 --> 00:04:03,321 So this guest Prasanna, 90 00:04:03,676 --> 00:04:04,426 Prasanna Malaiyandi: You're excited. 91 00:04:04,426 --> 00:04:05,026 Aren't you Curtis? 92 00:04:05,026 --> 00:04:05,626 Aren't you? 93 00:04:05,871 --> 00:04:06,501 W. Curtis Preston: I, am. 94 00:04:06,781 --> 00:04:08,121 He's shrouded in mystery. 95 00:04:08,281 --> 00:04:12,601 we've had guests on before where we've used pseudonyms. 96 00:04:12,671 --> 00:04:14,561 but I knew those people. 97 00:04:14,831 --> 00:04:16,661 And so I knew their actual names. 98 00:04:16,661 --> 00:04:19,931 And then I had to pretend not to know their names and refer to them 99 00:04:20,291 --> 00:04:22,001 by Harry Potter and Ron Weasley. 100 00:04:22,001 --> 00:04:23,651 And you may recall that during the. 101 00:04:24,671 --> 00:04:25,421 Recording. 102 00:04:25,421 --> 00:04:27,281 Occasionally I would slip up and call 103 00:04:27,436 --> 00:04:27,766 Prasanna Malaiyandi: Yes. 104 00:04:27,816 --> 00:04:28,866 I remember that. 105 00:04:28,956 --> 00:04:30,006 Lots of editing for you. 106 00:04:30,006 --> 00:04:31,116 Lots of listening to it. 107 00:04:32,041 --> 00:04:36,031 W. Curtis Preston: But in this case, I have no idea who this guy actually is. 108 00:04:36,271 --> 00:04:39,001 I just know that he knows his stuff. 109 00:04:39,081 --> 00:04:45,591 He has been in IT for 25 years in the InfoSec space for about 20. 110 00:04:45,921 --> 00:04:47,801 He has are you ready for this? 111 00:04:47,801 --> 00:04:54,176 He has a karma rating on Reddit of 33,000. 112 00:04:54,746 --> 00:04:56,906 I'm excited that I've got like 600. 113 00:04:56,906 --> 00:05:03,776 He's got 33,000, which means that at least 33,000 times someone has upvoted him. 114 00:05:04,166 --> 00:05:09,206 That's impressive in and of itself because Reddit is a crazy place 115 00:05:09,536 --> 00:05:12,686 where if you say things that people don't like, even if you're correct, 116 00:05:12,926 --> 00:05:14,456 they'll vote you down anyway. 117 00:05:14,756 --> 00:05:21,096 So he's managed to convince 33,000 people somewhere to click, on what he wrote. 118 00:05:21,426 --> 00:05:23,346 Welcome to the podcast. 119 00:05:23,466 --> 00:05:25,286 Snorkel42. 120 00:05:26,486 --> 00:05:28,946 Snorkel42: Hello, can I make an admission real quick? 121 00:05:29,846 --> 00:05:31,466 I had no idea what that karma meant. 122 00:05:33,136 --> 00:05:33,436 W. Curtis Preston: Yeah. 123 00:05:33,526 --> 00:05:36,766 Snorkel42: I did not know what that number translated. 124 00:05:36,766 --> 00:05:39,646 W. Curtis Preston: Every time you get an up vote, you get karma and 125 00:05:39,646 --> 00:05:43,526 every time someone downvotes you, your karma is subtracted from. 126 00:05:44,136 --> 00:05:45,556 Snorkel42: Okay, now I know 127 00:05:46,511 --> 00:05:46,931 W. Curtis Preston: Yeah. 128 00:05:47,426 --> 00:05:47,486 Snorkel42: me 129 00:05:47,536 --> 00:05:55,081 W. Curtis Preston: I post in a number of non it, subreddits where very 130 00:05:55,081 --> 00:05:59,551 much you can say the right thing, the correct thing, and they will 131 00:05:59,551 --> 00:06:03,901 get mad at you and downvote you, and then you just lost a bunch of karma. 132 00:06:04,261 --> 00:06:06,911 And since I'm, I'm a relatively, especially compared to you, 133 00:06:06,911 --> 00:06:10,421 I'm a relatively new Redditor, would that be the right word? 134 00:06:11,141 --> 00:06:13,091 And I'm trying to, 135 00:06:13,156 --> 00:06:14,176 Prasanna Malaiyandi: Reddit poster. 136 00:06:14,231 --> 00:06:16,751 W. Curtis Preston: It helps you bubble up into threads and things. 137 00:06:16,801 --> 00:06:18,511 it gives your posts more weight. 138 00:06:18,571 --> 00:06:19,831 So yeah. 139 00:06:19,861 --> 00:06:22,381 The fact that you have 33,000 is a BFD. 140 00:06:25,496 --> 00:06:26,766 Snorkel42: I'll get a t-shirt made. 141 00:06:27,441 --> 00:06:29,971 W. Curtis Preston: Why don't you describe what happened at Okta. 142 00:06:31,531 --> 00:06:35,273 Snorkel42: Yeah, I guess to start, I don't have any insider knowledge here. 143 00:06:36,413 --> 00:06:40,343 All I have is what's been announced and what little Okta has 144 00:06:40,493 --> 00:06:44,293 been able to slip through their marketing and legal teams, but 145 00:06:44,293 --> 00:06:45,163 W. Curtis Preston: We're going to get 146 00:06:45,163 --> 00:06:46,223 Snorkel42: to right. 147 00:06:46,273 --> 00:06:50,808 but basically they contract out their customer support to a third 148 00:06:50,808 --> 00:06:52,738 party located in Costa Rica. 149 00:06:52,753 --> 00:06:55,603 and sometime around the end of January. 150 00:06:56,458 --> 00:07:01,078 A attacker from the lapses group gained access to one of those support 151 00:07:01,078 --> 00:07:05,296 engineer's laptops, supposedly over RDP, which is something else to get into. 152 00:07:05,298 --> 00:07:10,548 and for about five days they had access to, that laptop and were able to 153 00:07:10,548 --> 00:07:14,788 monitor if not interact the privileged access that support engineer had. 154 00:07:14,808 --> 00:07:18,318 So Okta has a, an internal application that they call a super user, 155 00:07:18,318 --> 00:07:21,786 which by the way, what a terrible name doesn't mean that you have, 156 00:07:21,810 --> 00:07:24,120 super user God mode necessarily. 157 00:07:24,420 --> 00:07:26,875 It's just the administrative interface to. 158 00:07:26,893 --> 00:07:30,349 Um, but it doesn't necessarily mean that, Hey, I'm going to go in and reset 159 00:07:30,469 --> 00:07:33,649 everyone's password to something I know, but it did give them the ability 160 00:07:33,799 --> 00:07:38,228 to reset passwords, to send, links to customers, to go reset their passwords 161 00:07:38,528 --> 00:07:40,238 and to reset their multifactor. 162 00:07:40,321 --> 00:07:44,565 When Okta started off with, their CSO saying no customers impacted. 163 00:07:44,565 --> 00:07:49,295 We detected this back in January, or we detected an unsuccessful attempt. 164 00:07:49,615 --> 00:07:53,563 Which is the other thing to get into here, back in January and shut it down. 165 00:07:53,953 --> 00:07:56,173 And then the second blog post, they added a little bit more. 166 00:07:56,173 --> 00:07:59,494 And then the third blog posts like, 2.5% of our customers, 167 00:07:59,494 --> 00:08:01,564 about 366 people impacted, 168 00:08:01,789 --> 00:08:03,399 Prasanna Malaiyandi: Yeah, and it's interesting because it's 169 00:08:03,449 --> 00:08:09,299 366 people, but it's really 366 customers, which could be of any size. 170 00:08:09,329 --> 00:08:12,175 Snorkel42: and we certainly know from the screenshots that CloudFlare was one 171 00:08:12,175 --> 00:08:16,535 of those customers and CloudFlare CEO was fairly vocal on Twitter about his 172 00:08:16,535 --> 00:08:18,605 dissatisfaction with Okta right now. 173 00:08:19,390 --> 00:08:21,700 Prasanna Malaiyandi: And CloudFlare, I thought published a pretty 174 00:08:21,700 --> 00:08:25,450 good blog as well about sort of their analysis and what they did. 175 00:08:26,590 --> 00:08:31,750 W. Curtis Preston: fact, a lot of people felt that Cloudflare's analysis was 176 00:08:31,750 --> 00:08:34,270 better than what Octa provided themselves. 177 00:08:35,575 --> 00:08:36,235 Snorkel42: me included. 178 00:08:36,235 --> 00:08:36,355 Yeah. 179 00:08:36,565 --> 00:08:36,775 Prasanna Malaiyandi: Okay. 180 00:08:38,830 --> 00:08:39,280 W. Curtis Preston: Yeah. 181 00:08:39,413 --> 00:08:43,452 and by the way, there, there were a couple of people you put on a, another 182 00:08:43,452 --> 00:08:45,162 Reddit thread that was about this. 183 00:08:45,942 --> 00:08:46,872 Maybe more than one. 184 00:08:46,872 --> 00:08:49,112 I don't know, but I know I was reading one of them. 185 00:08:50,007 --> 00:08:55,224 And more than one former employee of Okta logged in and, and replied and 186 00:08:55,224 --> 00:09:01,854 explained basically what the super-user, which I agree it's a really bad name, 187 00:09:02,394 --> 00:09:06,930 but, I don't know where to start, but the thing about the resetting passwords 188 00:09:06,930 --> 00:09:13,590 and stuff, like they, it didn't appear that they had the ability to do anything, 189 00:09:13,590 --> 00:09:15,990 to be able to access an account. 190 00:09:16,110 --> 00:09:17,850 They could reset a password. 191 00:09:17,880 --> 00:09:24,450 They could reset or even remove MFA, but that, but anything towards 192 00:09:24,450 --> 00:09:26,370 that would be sent to the customer. 193 00:09:27,180 --> 00:09:31,740 So at best, they would only be able to do that if they had access to 194 00:09:31,740 --> 00:09:33,060 that customer in the first place. 195 00:09:33,060 --> 00:09:39,510 So it didn't look like they would have been able to use this to 196 00:09:39,540 --> 00:09:41,940 actually access any customers. 197 00:09:41,940 --> 00:09:43,163 does that sound about right? 198 00:09:43,163 --> 00:09:43,223 Yeah. 199 00:09:44,258 --> 00:09:46,634 Snorkel42: It sounds about right to me for a few reasons. 200 00:09:46,844 --> 00:09:52,664 Look to me, the biggest issue here has been the way Octa has been communicating 201 00:09:52,664 --> 00:09:54,644 to customers and the lack of transparency. 202 00:09:54,644 --> 00:09:59,594 And the reason why it's important is I find myself in my own back of 203 00:09:59,594 --> 00:10:02,156 my mind saying, if we believe Okta. 204 00:10:02,956 --> 00:10:04,341 Every time I think about this. 205 00:10:04,409 --> 00:10:06,539 If we believe them, and the only reason I have that question for a 206 00:10:06,539 --> 00:10:11,954 company that their entire existence hinges on, if we believe Okta. 207 00:10:11,974 --> 00:10:15,274 Like they provide, maybe we should start that off of what does Okta do. 208 00:10:15,366 --> 00:10:19,386 So Okta provides authentication services and identity management to corporations, 209 00:10:19,386 --> 00:10:22,846 particularly around single sign-on And, multi-factor, and the way, you can place 210 00:10:22,846 --> 00:10:27,901 them in your infrastructure can get as far as deep as: through the Okta portal, 211 00:10:27,931 --> 00:10:31,421 I can reset your active directory, your on-prem active directory password. 212 00:10:31,450 --> 00:10:35,350 so you know, it's a company that holds a lot of keys and if you 213 00:10:35,350 --> 00:10:39,640 can't trust them, my God, how do you keep them in your enterprise? 214 00:10:40,120 --> 00:10:44,050 And so since to your point of, yeah, it doesn't look like they had that 215 00:10:44,050 --> 00:10:49,045 kind of access to really take over the accounts of Okta customers. 216 00:10:49,045 --> 00:10:53,725 And I believe that to be true, not so much because of what Okta said, but mainly 217 00:10:53,725 --> 00:10:55,805 because lapses didn't appear to use it. 218 00:10:55,805 --> 00:10:57,880 I think if they would have had that access, we would have seen a 219 00:10:57,880 --> 00:11:00,800 much bigger impact, but I don't. 220 00:11:00,803 --> 00:11:02,933 W. Curtis Preston: I'm a hundred percent on board with everything that 221 00:11:02,933 --> 00:11:06,670 you're saying about, that the biggest issue here has been Okta's response. 222 00:11:07,250 --> 00:11:10,097 I just wanted to for anyone who's listening to this for the 223 00:11:10,097 --> 00:11:12,977 first time, it sounds horrible. 224 00:11:13,612 --> 00:11:18,099 And screenshots of customer data sounds horrible, but it, I do want 225 00:11:18,099 --> 00:11:21,790 to at least say it does look based on the information that we have most of 226 00:11:21,790 --> 00:11:26,054 which did not come from Okta, that they wouldn't have been able to actually 227 00:11:26,054 --> 00:11:27,854 access any customer's environment. 228 00:11:27,863 --> 00:11:31,112 They might have been able to annoy some customers, Change your 229 00:11:31,112 --> 00:11:32,852 passwords and things like that. 230 00:11:32,869 --> 00:11:33,242 but they. 231 00:11:34,642 --> 00:11:40,672 I completely agree with you that from the get-go, like from the very beginning from 232 00:11:40,672 --> 00:11:46,822 message one and all the way up to message three their verbiage is really weird, 233 00:11:47,582 --> 00:11:47,702 Snorkel42: Yeah. 234 00:11:49,322 --> 00:11:54,122 Prasanna Malaiyandi: I wondering if this has to do with any of, the new laws going 235 00:11:54,122 --> 00:11:59,222 through Congress, around data breaches, or just public perception with everything 236 00:11:59,222 --> 00:12:05,162 going on in the world right now that they just did a PR blunder, if you will. 237 00:12:06,057 --> 00:12:07,287 Snorkel42: It could be that. 238 00:12:08,337 --> 00:12:08,877 Yeah. 239 00:12:08,989 --> 00:12:12,519 and certainly they are a publicly traded company and that has certainly been 240 00:12:12,519 --> 00:12:17,145 called out a number of forums of, they, they may be tied as to what they can say. 241 00:12:17,565 --> 00:12:22,474 That one of the things that really sticks out to me is from Cloudflare's response, 242 00:12:22,474 --> 00:12:25,564 it was very clear that they learned about this along with everyone else. 243 00:12:25,564 --> 00:12:30,154 So one day they woke up and saw screenshots on Twitter from an 244 00:12:30,154 --> 00:12:32,074 attack group of their information. 245 00:12:32,854 --> 00:12:39,871 And Okta has a publicly disclosed, privacy and security policy that - i can even name 246 00:12:39,871 --> 00:12:44,189 the sections 20 and 21- talk about when they will alert customers of a breach. 247 00:12:44,879 --> 00:12:49,439 And I think you would have to do some pretty fancy legal footwork 248 00:12:50,099 --> 00:12:53,279 to explain why CloudFlare did not know about this in January 20. 249 00:12:53,361 --> 00:12:57,632 To me that is the real big takeaway from, do I trust this company anymore? 250 00:12:57,962 --> 00:13:00,902 The fact that the customers that we do know were impacted clearly 251 00:13:00,902 --> 00:13:03,002 didn't find out until the rest of the world found out as well. 252 00:13:03,089 --> 00:13:06,063 Um, and that's an example of Okta not following their own policies 253 00:13:06,063 --> 00:13:07,429 and that's troubling to me. 254 00:13:07,639 --> 00:13:07,849 Prasanna Malaiyandi: Yeah. 255 00:13:08,179 --> 00:13:11,204 And especially because these are in legal contracts, You could be held 256 00:13:11,204 --> 00:13:14,534 liable for it and you're losing the trust of your customers, right? 257 00:13:14,574 --> 00:13:16,764 Who would trust Okta the next time something happens? 258 00:13:17,444 --> 00:13:17,624 Snorkel42: yeah. 259 00:13:17,624 --> 00:13:21,549 And then of course the timing, all of it is very interesting in that Okta is 260 00:13:21,549 --> 00:13:26,049 saying that we couldn't respond until we got the security incident report 261 00:13:26,049 --> 00:13:30,109 from the company that this third party hired, and we just got that conveniently. 262 00:13:30,130 --> 00:13:31,900 As the screenshots got posted. 263 00:13:31,967 --> 00:13:35,667 but even then it's so you had a third party contractor to get compromised 264 00:13:35,667 --> 00:13:37,057 and what kind of access they had. 265 00:13:37,622 --> 00:13:39,152 You just sat on it for three months. 266 00:13:39,208 --> 00:13:41,888 are you telling me that Okta did not actually get involved in 267 00:13:41,908 --> 00:13:44,038 that incident response at all? 268 00:13:44,086 --> 00:13:47,236 so just a lot of things not adding up and it certainly doesn't 269 00:13:47,236 --> 00:13:48,676 paint a pretty picture for Okta. 270 00:13:50,076 --> 00:13:50,496 W. Curtis Preston: yeah. 271 00:13:52,336 --> 00:13:53,026 I forgot. 272 00:13:53,026 --> 00:13:58,533 I w I was scrolling through the post right now, the verbiage where it says, 273 00:13:58,590 --> 00:14:03,939 you made a comment that, that it seemed that, marketing was involved in these, 274 00:14:03,939 --> 00:14:08,518 the statements that went out because like it did start out with even in the third 275 00:14:08,518 --> 00:14:15,158 one, even in the third message, they referred to it as, an attempt to access. 276 00:14:15,418 --> 00:14:16,038 Snorkel42: and unsuccessful. 277 00:14:16,038 --> 00:14:17,068 W. Curtis Preston: This was not an attempt. 278 00:14:17,088 --> 00:14:18,348 This was a hack. 279 00:14:18,678 --> 00:14:19,818 I don't know what the proper term is. 280 00:14:20,458 --> 00:14:23,221 Snorkel42: no, I think a hack is absolutely the right term And 281 00:14:23,741 --> 00:14:25,621 so they also have a timeline. 282 00:14:25,651 --> 00:14:29,011 And I think if you marry those blog posts, where they talk about 283 00:14:29,011 --> 00:14:30,521 unsuccessful attempts and the timeline. 284 00:14:30,524 --> 00:14:34,923 You, you see where they're getting to the unsuccessful attempt that I derive is. 285 00:14:35,183 --> 00:14:36,233 where Okta caught em. 286 00:14:36,253 --> 00:14:40,858 which honestly, we need to take a step back and really give Okta security, some 287 00:14:40,858 --> 00:14:42,868 kudos in the detection to begin with. 288 00:14:42,868 --> 00:14:47,188 So where Okta caught them was the attacker apparently attempted to add 289 00:14:47,188 --> 00:14:51,731 a second MFA token to the support engineer's account, so that they could 290 00:14:51,731 --> 00:14:53,831 start approving from what I've been told. 291 00:14:53,971 --> 00:14:56,601 Okta internally uses MFA a lot. 292 00:14:56,651 --> 00:15:01,391 So apparently Okta is huge on every step you take within their networks MFA. 293 00:15:01,391 --> 00:15:04,271 So it looks like the attacker tried to add their own MFA token. 294 00:15:04,271 --> 00:15:08,391 So while they had RDP access and the support engineer was 295 00:15:08,391 --> 00:15:11,291 away, they could start moving around and start respond to MFA. 296 00:15:11,821 --> 00:15:12,901 And Okta caught that. 297 00:15:13,291 --> 00:15:16,061 The addition of an MFA token from a weird location. 298 00:15:16,841 --> 00:15:20,798 Which is fantastic, like really great job and darn it. 299 00:15:20,848 --> 00:15:25,405 So I think what, Okta is referring to when they say, there was an unsuccessful 300 00:15:25,405 --> 00:15:28,145 attempt, was the unsuccessful attempt to add that MFA token. 301 00:15:28,885 --> 00:15:32,215 But boy is that some marketing wordplay there that say, oh Yeah. 302 00:15:32,215 --> 00:15:35,237 it's an unsuccessful attempt to take over an engineer laptop. 303 00:15:35,237 --> 00:15:37,081 no, they took it over. 304 00:15:37,571 --> 00:15:38,081 Prasanna Malaiyandi: They took it over. 305 00:15:38,081 --> 00:15:39,641 They had access to your network. 306 00:15:40,241 --> 00:15:41,891 They got in, they just weren't able to. 307 00:15:44,071 --> 00:15:44,451 Snorkel42: Yeah. 308 00:15:44,786 --> 00:15:47,396 W. Curtis Preston: And for five days they could do, because they were 309 00:15:47,396 --> 00:15:52,166 controlling that laptop via RDP, which is the remote desktop protocol, which 310 00:15:52,166 --> 00:15:54,806 should not be exposed to the internet. 311 00:15:55,326 --> 00:15:56,964 Prasanna Malaiyandi: Curtis' second favorite topic, I think. 312 00:15:56,984 --> 00:16:00,117 Snorkel42: and so it is a really good point. 313 00:16:00,327 --> 00:16:03,387 And I think this is what's way more interesting about this. 314 00:16:03,477 --> 00:16:05,727 Is w was it exposed to the internet? 315 00:16:05,877 --> 00:16:13,544 We don't know if it wasn't then it would sure seem, the lapses actually have access 316 00:16:13,544 --> 00:16:18,134 to this third party's network first, and then managed to get RDP access to this 317 00:16:18,134 --> 00:16:22,574 contractors laptop, the screenshots show Global Protect of which Global Protect 318 00:16:22,574 --> 00:16:25,034 is a VPN product from Palo Alto Networks. 319 00:16:25,364 --> 00:16:26,624 So it was, this person worked from home. 320 00:16:26,650 --> 00:16:29,614 possibly and was their home network breached. 321 00:16:29,974 --> 00:16:32,855 So it does, from an InfoSec standpoint, certainly this screams to me. 322 00:16:32,904 --> 00:16:36,813 you should have RDP locked down on your workstations, does your laptop need 323 00:16:36,813 --> 00:16:38,463 to be able to accept RDP connections? 324 00:16:38,703 --> 00:16:39,463 Absolutely not. 325 00:16:39,518 --> 00:16:39,938 But, yeah. 326 00:16:39,938 --> 00:16:48,040 So I think that RDP side though is really a big topic because it has a lot of, fine 327 00:16:48,070 --> 00:16:51,788 read between the lines there of, what does it mean that they had RDP access? 328 00:16:51,788 --> 00:16:53,628 How did they even reach it over RDP? 329 00:16:54,858 --> 00:16:57,138 Prasanna Malaiyandi: And it's something we may never really find out. 330 00:16:57,169 --> 00:16:57,639 Unless. 331 00:16:59,409 --> 00:16:59,499 Snorkel42: Yeah. 332 00:16:59,564 --> 00:17:01,384 Prasanna Malaiyandi: because noone's really going to bring that up. 333 00:17:01,384 --> 00:17:02,614 Noone's going to talk about that. 334 00:17:02,614 --> 00:17:04,504 They're just going to say, yeah, we stopped the attack 335 00:17:04,774 --> 00:17:05,854 or whatever the breach was. 336 00:17:05,854 --> 00:17:07,114 They'll focus on the Okta side. 337 00:17:07,181 --> 00:17:11,153 Everyone talks about okay, we found the issue or we saw what they were 338 00:17:11,153 --> 00:17:12,503 trying to do and we stopped it. 339 00:17:12,593 --> 00:17:13,283 End of story. 340 00:17:13,333 --> 00:17:14,173 Not necessarily. 341 00:17:14,173 --> 00:17:16,170 How do they really get in the first place? 342 00:17:16,170 --> 00:17:19,350 And what does that look like and how do we prevent that from happening. 343 00:17:20,130 --> 00:17:21,669 Snorkel42: Yeah, and the thing to keep in mind too. 344 00:17:22,594 --> 00:17:26,983 When we think about this is a third-party contractor that specializes in 24/7 345 00:17:27,003 --> 00:17:28,953 customer support for larger enterprises. 346 00:17:29,673 --> 00:17:33,483 If lapses, which is a attack group, that's setting the world on fire Right. 347 00:17:33,483 --> 00:17:35,943 now had access to their network. 348 00:17:36,363 --> 00:17:37,983 What else was going on? 349 00:17:38,011 --> 00:17:39,851 Okta may be the tip the iceberg for them. 350 00:17:40,886 --> 00:17:41,246 W. Curtis Preston: Yeah. 351 00:17:41,262 --> 00:17:45,393 somebody, one of the commenters, they felt that the whole like throwing out the. 352 00:17:46,208 --> 00:17:50,698 Screenshots from Okta was actually an attempt at subterfuge on the part 353 00:17:50,698 --> 00:17:54,503 of lapses to throw away attention from the fact that the real problem 354 00:17:54,503 --> 00:17:56,303 is the access you just mentioned. 355 00:17:56,363 --> 00:17:59,250 Somebody said, maybe that's why they threw out all the Okta information because. 356 00:17:59,292 --> 00:18:00,582 we're not talking about Sykes. 357 00:18:00,582 --> 00:18:01,512 We're talking about Okta. 358 00:18:01,872 --> 00:18:04,662 The technically the hack was actually a Sykes. 359 00:18:05,002 --> 00:18:07,452 Okta was just the customer in this case. 360 00:18:07,470 --> 00:18:10,228 Snorkel42: And Octa is very quick to call that out. 361 00:18:10,258 --> 00:18:14,428 They say third party, as often as they possibly can as if that's, 362 00:18:14,668 --> 00:18:15,824 oh, wash our hands of that. 363 00:18:15,824 --> 00:18:18,854 Sure, we gave that third-party access to go reset your passwords 364 00:18:18,854 --> 00:18:20,634 and MFAs, but that's their problem. 365 00:18:22,074 --> 00:18:27,454 W. Curtis Preston: There were people, a handful of people in the comments 366 00:18:27,484 --> 00:18:32,584 and there, as there always is on the internet, there were a handful of people 367 00:18:32,584 --> 00:18:37,470 that came to Octa's defense regarding that they get thousands of attacks a day. 368 00:18:37,560 --> 00:18:42,090 And that they're saying no customer systems were accessed. 369 00:18:42,156 --> 00:18:47,226 and so was there really a duty to report back in January? 370 00:18:48,182 --> 00:18:49,194 What do you think about that? 371 00:18:50,124 --> 00:18:53,617 Snorkel42: The title of the post I had made was am I overreacting? 372 00:18:53,617 --> 00:18:55,967 cause I is probably coming through in this podcast. 373 00:18:55,967 --> 00:18:57,216 I'm still quite upset with them. 374 00:18:57,216 --> 00:19:00,202 and I agree with a lot of what the, what those folks were saying. 375 00:19:00,269 --> 00:19:03,633 yes, I'm sure Okta is attacked repeatedly. 376 00:19:04,773 --> 00:19:09,933 Now the question is what does that look like if they are attacked so often to the 377 00:19:09,933 --> 00:19:13,593 point that people have access to the super user program that it's such a non-event 378 00:19:13,593 --> 00:19:15,113 for them, like that's an everyday event 379 00:19:15,543 --> 00:19:16,608 then holy cow, right? 380 00:19:16,638 --> 00:19:19,579 Like seriously, if that's every day for Okta, then we had something 381 00:19:19,579 --> 00:19:20,929 way bigger to talk about here. 382 00:19:20,991 --> 00:19:22,355 I'm guessing that's not the case. 383 00:19:22,410 --> 00:19:23,110 I'm guessing this. 384 00:19:23,110 --> 00:19:27,744 This was a significant event for, um, and downplaying that I don't buy. 385 00:19:28,074 --> 00:19:32,454 I think this was a significant event and Okta was very happy to. 386 00:19:32,466 --> 00:19:35,504 keep it under wraps and hope that it never came out. 387 00:19:35,504 --> 00:19:39,933 and I think I, as we said at the start, yeah, I don't think anyone 388 00:19:39,933 --> 00:19:43,293 really, I don't think there was any actual breach of a customer's account. 389 00:19:43,424 --> 00:19:46,574 I think what we saw on the screenshots was pretty much all that happened, 390 00:19:47,234 --> 00:19:51,584 but I think if you were to get CloudFlare CEO on those podcasts, he 391 00:19:51,584 --> 00:19:52,872 would tell you that was significant. 392 00:19:52,899 --> 00:19:56,259 and the fact that he didn't know about it until a couple of days 393 00:19:56,259 --> 00:19:59,694 ago, when it was posted on Twitter, Was not acceptable for him. 394 00:19:59,814 --> 00:20:03,744 And I'll be really surprised if CloudFlare isn't looking at moving 395 00:20:03,744 --> 00:20:05,724 to another provider right now. 396 00:20:07,299 --> 00:20:08,409 Prasanna Malaiyandi: It reminds me. 397 00:20:08,409 --> 00:20:10,614 W. Curtis Preston: If the Cloudflare CEO wants to come on this podcast. 398 00:20:10,696 --> 00:20:12,597 he's he or she is more than welcome. 399 00:20:13,927 --> 00:20:16,662 Prasanna Malaiyandi: This kind of reminds me like how bad it could be 400 00:20:16,722 --> 00:20:21,192 of, I don't know if you both recalled the RSA hack that happened many years 401 00:20:21,192 --> 00:20:24,582 ago where the root key was compromised. 402 00:20:24,582 --> 00:20:27,057 Because that's almost what could have happened to Okta, except in the case of 403 00:20:27,057 --> 00:20:29,847 Okta, there is no hardware fobs, right? 404 00:20:29,909 --> 00:20:34,352 Snorkel42: so again, I think Okta does absolutely deserve some praise here. 405 00:20:34,381 --> 00:20:38,745 despite giving the super user application a really stupid name, 406 00:20:38,985 --> 00:20:42,615 this tier two support engineer, didn't have the ability to reset the password 407 00:20:42,615 --> 00:20:43,585 to something that he would know. 408 00:20:43,585 --> 00:20:46,759 if that were a scenario, if the attacker could have gone in and made 409 00:20:46,759 --> 00:20:51,530 the password password, then this would have been a much bigger deal. 410 00:20:51,599 --> 00:20:54,169 W. Curtis Preston: subsequently deactivating MFA. 411 00:20:54,749 --> 00:20:55,659 Snorkel42: yeah, absolutely. 412 00:20:55,659 --> 00:20:57,304 W. Curtis Preston: Change the password to what you want and 413 00:20:57,304 --> 00:20:59,524 subsequently deactivating MFA. 414 00:20:59,524 --> 00:21:00,184 You're in. 415 00:21:00,254 --> 00:21:00,478 Snorkel42: Yeah. 416 00:21:00,478 --> 00:21:03,882 and if you start thinking about how many customers Okta has and what Octa 417 00:21:03,882 --> 00:21:06,042 actually does and where I'm walking into. 418 00:21:08,387 --> 00:21:10,907 If they had access to the fed ramp, if they were able to get 419 00:21:10,907 --> 00:21:12,437 into government systems that way. 420 00:21:12,437 --> 00:21:14,799 But, Zoom, for example, if they were able to get into the zoom 421 00:21:14,799 --> 00:21:17,531 Okta page, what applications would they be able to get into? 422 00:21:17,547 --> 00:21:21,447 I can tell you from my company, it's pretty much domain admin. 423 00:21:21,483 --> 00:21:22,996 you have access to everything, right? 424 00:21:23,018 --> 00:21:26,798 definitely kudos to Okta for having those controls. 425 00:21:26,798 --> 00:21:29,011 And again, I really do praise their security team for 426 00:21:29,011 --> 00:21:30,031 catching it that quickly. 427 00:21:30,050 --> 00:21:32,833 that was an excellent detection on their part, especially for 428 00:21:32,833 --> 00:21:34,273 a third party in Costa Rica. 429 00:21:34,273 --> 00:21:35,626 Having that kind of logging. 430 00:21:35,776 --> 00:21:36,536 Fantastic. 431 00:21:36,536 --> 00:21:36,969 but Yeah. 432 00:21:36,999 --> 00:21:38,529 to your point, it could have been massive. 433 00:21:39,820 --> 00:21:45,062 W. Curtis Preston: Yeah, this, I do think I, I liked that even though, we 434 00:21:45,062 --> 00:21:46,869 agree it was a weird, it's a weird name. 435 00:21:47,469 --> 00:21:49,869 It does appear that. 436 00:21:52,029 --> 00:21:55,989 That th that there, what they did employ the concept of least privilege, right? 437 00:21:56,929 --> 00:22:00,189 There's a reason that they have that, that they have the ability for 438 00:22:00,189 --> 00:22:05,619 a support person to do the password reset because sometimes customers get 439 00:22:05,619 --> 00:22:10,753 locked out of their accounts there's no other way to do that, but they at 440 00:22:10,883 --> 00:22:12,553 Snorkel42: I need to interrupt because I disagree. 441 00:22:12,563 --> 00:22:13,313 W. Curtis Preston: you disagree? 442 00:22:14,418 --> 00:22:15,078 Snorkel42: I do. 443 00:22:15,133 --> 00:22:16,303 so here's the thing, right? 444 00:22:16,333 --> 00:22:19,513 So they had the, these Okta support engineers, or honestly, 445 00:22:19,513 --> 00:22:20,533 these, what did we say? 446 00:22:20,533 --> 00:22:21,113 A Sykes? 447 00:22:21,133 --> 00:22:25,513 I can't remember which company came first, but they, these contractors 448 00:22:25,783 --> 00:22:30,283 have the ability to reset the passwords of their customers, of 449 00:22:30,343 --> 00:22:31,873 every user within their customers. 450 00:22:32,173 --> 00:22:35,877 And if Octa is your identity provider, that is where your accounts live. 451 00:22:35,907 --> 00:22:36,957 They are the source of truth. 452 00:22:37,467 --> 00:22:38,307 Then may. 453 00:22:40,477 --> 00:22:43,920 But if Okta is just your single sign on solution, your SAML solution or 454 00:22:43,920 --> 00:22:48,180 something along those lines for active directory, do you, if you signed up for 455 00:22:48,180 --> 00:22:51,540 Okta as a customer, do you expect that there's some third-party company and 456 00:22:51,540 --> 00:22:54,810 Costa Rica that can reset your active directory passwords of your CEO right now? 457 00:22:56,040 --> 00:22:56,730 I wouldn't. 458 00:22:56,760 --> 00:23:01,590 And I would expect them to give me access my admin access back to my dashboard if I 459 00:23:01,590 --> 00:23:03,480 happen to walk myself out at that point. 460 00:23:03,930 --> 00:23:04,080 Yeah. 461 00:23:04,840 --> 00:23:08,470 But down to the individual user level, that certainly caught me off guard. 462 00:23:08,470 --> 00:23:09,790 I did not expect that. 463 00:23:10,185 --> 00:23:12,225 Prasanna Malaiyandi: Because that should go through your normal it process, 464 00:23:12,225 --> 00:23:15,855 which is owned by your company and driving it through active directory. 465 00:23:15,855 --> 00:23:16,135 That way. 466 00:23:16,135 --> 00:23:16,245 way 467 00:23:16,315 --> 00:23:20,930 Snorkel42: And it calls out another thing that Okta publishes a document 468 00:23:20,930 --> 00:23:23,270 of their subcontractors, who they use. 469 00:23:23,299 --> 00:23:26,979 and this company is on that list and our 24/7 customer support. 470 00:23:27,609 --> 00:23:33,199 And in the notes, it says something along the lines of, they have no data centers. 471 00:23:34,079 --> 00:23:38,514 They simply have access to our Salesforce and AWS, that's it. 472 00:23:38,934 --> 00:23:42,574 So if you are doing your due diligence as a customer and doing your vendor reviews 473 00:23:42,574 --> 00:23:43,914 you're gonna look at their subcontractors. 474 00:23:43,914 --> 00:23:46,824 You see this and like, all right, I don't care if they have access to Salesforce 475 00:23:46,824 --> 00:23:48,894 and how AWS that can mean anything. 476 00:23:49,854 --> 00:23:53,064 I don't think any reasonable human can read that and go, oh, this third-party 477 00:23:53,064 --> 00:23:55,914 contractor has the ability to reset my active directory passwords. 478 00:23:57,164 --> 00:23:58,244 W. Curtis Preston: Yeah, good point. 479 00:23:58,364 --> 00:23:59,923 And so I'll take back my comment. 480 00:24:00,013 --> 00:24:01,193 I forgot about that part. 481 00:24:01,193 --> 00:24:05,401 and there was a comment again from the former Okta employees or people 482 00:24:05,401 --> 00:24:07,081 claiming to be former Okta employees. 483 00:24:07,501 --> 00:24:12,121 And what they said was the practice and the policy is that you do 484 00:24:12,121 --> 00:24:17,386 not use this power to do that, but that power is still there. 485 00:24:17,476 --> 00:24:18,696 Prasanna Malaiyandi: that's probably the mistake, right? 486 00:24:18,756 --> 00:24:22,816 That you can't trust people to have the power and not use it. 487 00:24:22,845 --> 00:24:26,224 W. Curtis Preston: you, what you would do, I could see edge 488 00:24:26,234 --> 00:24:27,994 cases where maybe that's needed. 489 00:24:28,024 --> 00:24:32,261 I don't, I can't imagine it right now, but let's just say those edge cases 490 00:24:32,501 --> 00:24:36,371 to me, those would be edge cases and they would require additional MFA. 491 00:24:36,731 --> 00:24:40,943 For example, if you're going to do the thing that, we don't think 492 00:24:40,943 --> 00:24:45,366 should normally be done, then that should require a MFA or MPA. 493 00:24:45,383 --> 00:24:49,231 If you're going to reset, a password that deep, then it should have 494 00:24:49,231 --> 00:24:50,701 to come from multiple people. 495 00:24:50,782 --> 00:24:51,082 Snorkel42: Yeah. 496 00:24:51,412 --> 00:24:54,412 I just going to say, if it's an edge case, it would be an escalation. 497 00:24:54,412 --> 00:24:54,832 right? 498 00:24:55,252 --> 00:24:57,022 There's one person on a floor. 499 00:24:57,060 --> 00:24:58,792 W. Curtis Preston: But, and so yeah, you're right. 500 00:24:58,942 --> 00:25:03,174 So in one sense, they did separate, but they didn't, it sounds like you're saying 501 00:25:03,208 --> 00:25:06,628 they could do, they could have done the least privilege concept a little better. 502 00:25:07,193 --> 00:25:07,433 Snorkel42: Yeah. 503 00:25:07,479 --> 00:25:11,786 I think more it's and it goes back to exactly what I was railing 504 00:25:11,786 --> 00:25:13,076 against at the very beginning. 505 00:25:13,256 --> 00:25:16,348 It's a communication issue that I'm struggling with Okta right 506 00:25:16,348 --> 00:25:20,280 now, as an Okta customer, I did not know they had that capability. 507 00:25:21,305 --> 00:25:24,965 And after doing due diligence and I happen to know, but sub-process 508 00:25:24,965 --> 00:25:27,155 or document, cause I happened to have it on my computer. 509 00:25:27,155 --> 00:25:29,045 When this happened, I went, wait a minute. 510 00:25:29,045 --> 00:25:30,125 Was that even disclosed? 511 00:25:30,125 --> 00:25:33,339 And I went and looked he's huh, no, not at all. 512 00:25:33,429 --> 00:25:39,249 And the word that really stuck out to me was the simply they simply have the 513 00:25:39,249 --> 00:25:41,992 ability to access Salesforce and AWS wow. 514 00:25:42,092 --> 00:25:43,020 so how does a company. 515 00:25:43,935 --> 00:25:45,225 Who's trying to do the right thing. 516 00:25:45,225 --> 00:25:47,475 He's trying to do their due diligence, trying to make sure that they're 517 00:25:47,475 --> 00:25:52,245 onboarding vendors, that aren't going to open them up for security woes. 518 00:25:52,785 --> 00:25:54,405 What do you do in that situation? 519 00:25:54,405 --> 00:26:01,185 When a company, as big as Okta is frankly, at least being awfully 520 00:26:01,185 --> 00:26:03,105 liberal with their definitions. 521 00:26:05,110 --> 00:26:10,000 W. Curtis Preston: Yeah, that's that is, I would feel much better if they 522 00:26:10,000 --> 00:26:13,810 notified of what happened in January. 523 00:26:14,700 --> 00:26:18,190 And they said, listen, there was this thing happen. 524 00:26:18,220 --> 00:26:22,767 I can understand why they might not want to, but I can see, this 525 00:26:22,767 --> 00:26:24,170 is what, this is what happened. 526 00:26:24,410 --> 00:26:28,790 We're not sure of the extent we're studying it, et cetera, whatever, 527 00:26:28,833 --> 00:26:31,353 but just a simple notification. 528 00:26:31,713 --> 00:26:33,993 And that would allow people to go, just do a quick. 529 00:26:33,999 --> 00:26:35,611 did anybody change their passwords? 530 00:26:35,611 --> 00:26:37,201 Did anybody lose her MFA? 531 00:26:37,681 --> 00:26:38,371 W whatever. 532 00:26:38,446 --> 00:26:41,502 just let me go as a user go. 533 00:26:41,502 --> 00:26:45,222 Just do a quick check that, that everything seems fine, but if you're not 534 00:26:45,222 --> 00:26:48,492 even told that you're not going to go do it, you're not going to go do a check. 535 00:26:48,536 --> 00:26:51,033 Snorkel42: and honestly, it could have been a great success story for 536 00:26:51,033 --> 00:26:54,303 them, as I've said several times now I have nothing but praise for 537 00:26:54,303 --> 00:26:55,603 the security team that caught it. 538 00:26:56,043 --> 00:26:59,343 And if they would've came out in a reasonable time and said, Hey, 539 00:26:59,420 --> 00:27:01,360 heads up, here's what happened. 540 00:27:01,360 --> 00:27:03,670 Here's where we detected and stopped and the controls that 541 00:27:03,670 --> 00:27:05,080 we had in place to realize it. 542 00:27:05,410 --> 00:27:08,710 And here's what we're going to do to make sure that RDP is an accessible on, 543 00:27:08,746 --> 00:27:12,107 there's, third-party support, contractors, laptops and things along those lines. 544 00:27:12,677 --> 00:27:14,387 I think people would have been, wow. 545 00:27:14,987 --> 00:27:18,610 Yeah, that could have been real bad, but kudos to Okta, they got their fingers 546 00:27:18,610 --> 00:27:23,010 on the pulse and they know what's up instead this is a PR nightmare for them. 547 00:27:23,160 --> 00:27:23,890 To what end? 548 00:27:23,890 --> 00:27:24,400 I don't know. 549 00:27:24,400 --> 00:27:28,480 I don't know what they were gaining from trying to keep this quiet and then 550 00:27:28,480 --> 00:27:33,053 doing this frankly, pathetic attempt at wordsmithing, their official message. 551 00:27:33,053 --> 00:27:35,530 Prasanna Malaiyandi: and I think that's the danger because a lot of 552 00:27:35,530 --> 00:27:37,570 people in the InfoSec community, right? 553 00:27:38,350 --> 00:27:39,760 You guys know the difference. 554 00:27:39,790 --> 00:27:42,913 Like you can smell, The lack of transparency, That something is 555 00:27:42,913 --> 00:27:44,593 fishy, something doesn't sound right. 556 00:27:45,118 --> 00:27:45,508 Snorkel42: right. 557 00:27:46,833 --> 00:27:48,035 Prasanna Malaiyandi: And you lose trust in them. 558 00:27:48,525 --> 00:27:48,975 Snorkel42: Yeah. 559 00:27:49,005 --> 00:27:51,656 And again, for a company like Okta, that's not a company you can lose 560 00:27:51,656 --> 00:27:53,437 trust in and it's a shame too. 561 00:27:53,877 --> 00:27:56,827 It's a shame to see because it would've been such an easy message 562 00:27:56,827 --> 00:27:58,027 for them to deal with properly. 563 00:27:59,227 --> 00:27:59,407 W. Curtis Preston: Yeah. 564 00:27:59,421 --> 00:28:06,425 their stock price went from 166 to 145 in the last two days. 565 00:28:06,466 --> 00:28:11,204 it could have been it's a 10% loss could have been, could have been better. 566 00:28:11,238 --> 00:28:12,267 and I agree with you. 567 00:28:12,337 --> 00:28:16,047 I think that companies that are Okta customers. 568 00:28:16,157 --> 00:28:19,714 are going to reevaluate their, their trust that they have 569 00:28:19,714 --> 00:28:21,004 placed in this huge company. 570 00:28:21,214 --> 00:28:25,313 And Okta's, and the thing that really is the Octa's the default, right? 571 00:28:25,341 --> 00:28:26,691 Okta's everywhere 572 00:28:27,096 --> 00:28:27,366 Snorkel42: yeah. 573 00:28:27,381 --> 00:28:29,624 W. Curtis Preston: and, yeah, that's just. 574 00:28:31,724 --> 00:28:33,854 Prasanna Malaiyandi: you have to have a good reason not to pick Okta. 575 00:28:33,854 --> 00:28:37,350 Like you won't lose your job for recommending Okta and your company. 576 00:28:37,400 --> 00:28:40,460 gotten to that stage for Okta, or it was that way for Okta. 577 00:28:41,570 --> 00:28:44,560 Snorkel42: It's to the point where if you are implementing a new product 578 00:28:44,560 --> 00:28:47,409 and you look up their documentation of how do I implement SAML chances 579 00:28:47,409 --> 00:28:49,779 are, it's going to say, oh, if you're an Okta customer, just click here 580 00:28:49,839 --> 00:28:51,039 and they'll have those screenshots. 581 00:28:51,069 --> 00:28:52,749 And then there's the everyone else. 582 00:28:52,879 --> 00:28:53,119 Prasanna Malaiyandi: Yeah. 583 00:28:54,649 --> 00:28:57,194 W. Curtis Preston: Okta screenshots means something very different now. 584 00:28:57,309 --> 00:28:57,729 Snorkel42: Right? 585 00:29:01,454 --> 00:29:02,424 W. Curtis Preston: Oh, that's tough. 586 00:29:02,442 --> 00:29:07,910 so w I can, I assume now that the 2.5% of customers have been notified. 587 00:29:11,630 --> 00:29:15,920 Snorkel42: this again goes back to if we take Okta's word for it. 588 00:29:16,040 --> 00:29:16,620 Yes. 589 00:29:16,650 --> 00:29:19,370 that, that was the other side of this, of the blog post, right? 590 00:29:19,370 --> 00:29:20,760 The comment of. 591 00:29:20,770 --> 00:29:25,450 after we, after doing a thorough analysis over the last 24 hours and scanning, I 592 00:29:25,450 --> 00:29:27,340 think it was like 125,000 log entries. 593 00:29:27,368 --> 00:29:29,702 that's a significant number as logs go. 594 00:29:29,770 --> 00:29:33,890 we now know that 2.5% of our customers were impacted, which again, you take 595 00:29:33,890 --> 00:29:37,935 just half a step back and you think about that, so for three months you did nothing. 596 00:29:38,805 --> 00:29:42,459 Then these screenshots came out and in 24 hours you looked at what do 597 00:29:42,459 --> 00:29:45,529 you think 125,000 logs are to Okta. 598 00:29:46,039 --> 00:29:47,169 An eighth of their log. 599 00:29:47,589 --> 00:29:47,889 Yeah. 600 00:29:48,129 --> 00:29:48,549 It's nothing. 601 00:29:48,549 --> 00:29:51,390 And it's such a disingenuous comment, too., you look at it like, oh, 602 00:29:51,450 --> 00:29:55,050 so you had like skilled security engineers looking at those logs. 603 00:29:55,270 --> 00:29:57,258 No, you ran some greps on them. 604 00:29:57,288 --> 00:29:58,818 you didn't actually look at them. 605 00:29:58,886 --> 00:30:00,067 W. Curtis Preston: I was going to throw a grep. 606 00:30:00,087 --> 00:30:02,177 I was going to say they, grepped some stuff. 607 00:30:02,177 --> 00:30:06,281 Snorkel42: like I tell you this, I'm sure the, their CTO isn't the guy 608 00:30:06,291 --> 00:30:09,781 actually or CSO, I forget what his title is, is actually writing these things. 609 00:30:09,781 --> 00:30:13,051 I'm sure it's going through all kinds of legal marketing, but man, every 610 00:30:13,051 --> 00:30:14,891 time he posts it's get the popcorn out. 611 00:30:14,891 --> 00:30:16,421 Cause he's just keeps making it worse. 612 00:30:16,510 --> 00:30:18,578 W. Curtis Preston: I don't know any advice for Okta customers? 613 00:30:18,578 --> 00:30:18,788 What is it? 614 00:30:18,892 --> 00:30:22,432 Snorkel42: with regards to this breach, I truly don't think it's 615 00:30:22,432 --> 00:30:24,412 significant in terms of customer impact. 616 00:30:24,470 --> 00:30:25,430 always do your IR. 617 00:30:25,430 --> 00:30:26,360 Always do your due diligence. 618 00:30:26,360 --> 00:30:28,820 Go look at your logs from that timeframe. 619 00:30:28,820 --> 00:30:31,190 See if there were any strange resets. 620 00:30:31,190 --> 00:30:34,872 but I, that breach is not keeping me up at night. 621 00:30:35,962 --> 00:30:37,312 What my advice is. 622 00:30:37,312 --> 00:30:40,822 And certainly what I've been doing is contact your Okta reps and make 623 00:30:40,822 --> 00:30:45,472 a stink and try to drive the message that I'm not concerned about. 624 00:30:45,502 --> 00:30:46,312 This breach. 625 00:30:46,462 --> 00:30:51,022 I am concerned about how you handled it and the fact that you waited 626 00:30:51,022 --> 00:30:54,832 three months and for the attackers to give up the evidence for you to say 627 00:30:54,832 --> 00:30:56,242 something makes me have to question. 628 00:30:57,157 --> 00:30:58,657 What else are you sitting on? 629 00:30:58,687 --> 00:31:01,597 What other security incidents have occurred that you have 630 00:31:01,657 --> 00:31:04,117 conveniently not reported? 631 00:31:04,447 --> 00:31:08,767 And I'm not saying there aren't any, I don't know, but that's the problem that I 632 00:31:08,767 --> 00:31:11,377 don't, I no longer trust them to tell me. 633 00:31:11,456 --> 00:31:15,689 and I think that's what Okta needs to hear and, be nice to your rep, right? 634 00:31:16,019 --> 00:31:18,556 Like they're caught up in those too, but make sure you're saying, Hey, 635 00:31:18,556 --> 00:31:20,476 escalate this to your executive level. 636 00:31:20,506 --> 00:31:23,566 Cause this is just not an acceptable way for a company like Okta to be off. 637 00:31:23,662 --> 00:31:23,782 Yeah. 638 00:31:23,842 --> 00:31:28,542 that's my main comment to all Okta customers is now's the time to take 639 00:31:28,552 --> 00:31:29,992 off the gloves and raise some stink. 640 00:31:30,927 --> 00:31:32,157 W. Curtis Preston: send a WTF. 641 00:31:32,762 --> 00:31:33,112 Snorkel42: Yeah. 642 00:31:33,382 --> 00:31:35,022 W. Curtis Preston: Your Octa rep for the record. 643 00:31:35,052 --> 00:31:37,572 It's two months, not three months just throwing that out there. 644 00:31:39,352 --> 00:31:40,312 Snorkel42: End of January. 645 00:31:40,312 --> 00:31:41,152 It's end of March. 646 00:31:41,272 --> 00:31:41,722 Okay. 647 00:31:42,142 --> 00:31:42,682 Fair enough. 648 00:31:45,002 --> 00:31:46,519 W. Curtis Preston: Once I got the math, right. 649 00:31:46,585 --> 00:31:47,905 Prasanna Malaiyandi: I know for once Curtis. 650 00:31:47,965 --> 00:31:48,265 Yeah. 651 00:31:48,295 --> 00:31:49,165 Curtis math, they're not 652 00:31:49,470 --> 00:31:52,470 W. Curtis Preston: always off by an order of magnitude usually or something I'm 653 00:31:52,470 --> 00:31:55,680 like, I think that was 10% and was like, 654 00:31:55,915 --> 00:31:56,665 Snorkel42: There's 1%. 655 00:31:56,665 --> 00:31:57,805 2, 3. 656 00:31:57,805 --> 00:31:59,605 That's how it works. 657 00:32:00,990 --> 00:32:01,710 W. Curtis Preston: Exactly. 658 00:32:02,335 --> 00:32:02,725 Snorkel42: Fair enough. 659 00:32:02,725 --> 00:32:03,025 Yeah, 660 00:32:04,140 --> 00:32:04,590 W. Curtis Preston: yeah. 661 00:32:04,600 --> 00:32:07,741 thanks for coming on to talk about the, the Okta situation. 662 00:32:09,926 --> 00:32:11,306 Snorkel42: it was a pleasure. 663 00:32:11,396 --> 00:32:12,776 I don't know if that's the right word. 664 00:32:14,791 --> 00:32:16,111 W. Curtis Preston: is never fun is it Prasanna?, 665 00:32:16,396 --> 00:32:17,296 Prasanna Malaiyandi: No, it's not. 666 00:32:17,386 --> 00:32:17,716 Yeah. 667 00:32:17,731 --> 00:32:20,637 I hope at least you had a chance to vent snorkel. 668 00:32:21,122 --> 00:32:22,682 Snorkel42: Yeah, it was cathartic. 669 00:32:22,682 --> 00:32:22,982 Yes. 670 00:32:23,012 --> 00:32:23,372 Thank you. 671 00:32:24,592 --> 00:32:25,072 W. Curtis Preston: Yeah. 672 00:32:25,102 --> 00:32:29,321 Yeah, this is not a, one of my favorite words is the German word 673 00:32:29,321 --> 00:32:33,431 schaudenfreude, which means taking joy in the misfortunes of others. 674 00:32:33,466 --> 00:32:36,146 this is not that, this is anger, right? 675 00:32:36,146 --> 00:32:36,746 This is. 676 00:32:38,931 --> 00:32:39,861 I agree with you. 677 00:32:39,861 --> 00:32:42,999 Like how is this, it's the whole like, oh, now you're telling us 678 00:32:42,999 --> 00:32:47,319 after the screenshots came out and would we ever even heard of anything? 679 00:32:47,419 --> 00:32:49,252 Snorkel42: They should have saw it coming, This is what this group does. 680 00:32:49,252 --> 00:32:50,242 They're an extortion group. 681 00:32:50,932 --> 00:32:55,072 They stole the screenshots and I would be, I'd be willing to bet money that 682 00:32:55,072 --> 00:32:58,522 they were holding that up to Okta, send us money, or we're going to disclose. 683 00:32:59,547 --> 00:33:02,897 I could not have been surprised when those screenshots finally appeared 684 00:33:02,932 --> 00:33:03,425 the whole thing. 685 00:33:03,425 --> 00:33:06,215 Just You have to wonder what they were thinking. 686 00:33:06,530 --> 00:33:09,020 Prasanna Malaiyandi: It's, it sounds a little staged if you will, or 687 00:33:09,170 --> 00:33:10,620 planned, They knew it was coming. 688 00:33:10,710 --> 00:33:12,240 They weren't paying up or whatever, and 689 00:33:13,695 --> 00:33:17,111 Snorkel42: Which you would think that they would take the other approach and 690 00:33:17,111 --> 00:33:18,605 let's be the ones to control that message. 691 00:33:18,635 --> 00:33:20,975 Then let's be the ones to disclose that this happened. 692 00:33:20,975 --> 00:33:25,055 Cause it really, if we take them at their word, it wasn't that big of a deal. 693 00:33:27,095 --> 00:33:28,745 They could have controlled that message instead. 694 00:33:28,800 --> 00:33:29,660 it's a big deal. 695 00:33:31,000 --> 00:33:31,960 W. Curtis Preston: it's not the crime. 696 00:33:31,960 --> 00:33:32,950 It's the cover up. 697 00:33:33,035 --> 00:33:33,185 Prasanna Malaiyandi: Yeah. 698 00:33:33,490 --> 00:33:33,880 Snorkel42: No. 699 00:33:33,909 --> 00:33:34,479 W. Curtis Preston: same old. 700 00:33:34,719 --> 00:33:35,109 All right. 701 00:33:35,117 --> 00:33:40,369 thanks to our listeners and, be sure to subscribe so that you can restore it all.