Crooks copy source code from Okta’s GitHub repository Intruders copied source code belonging to Okta after breaching the identity management company's GitHub repositories. Okta was alerted by Microsoft-owned GitHub earlier this month of "suspicious access" to its code repositories and determined that miscreants copied code associated with the company's Workforce Identity Cloud ( …
A large swath of the US gov't uses Okta for identify management. And the contracts must be huge.
Tying a breach like this to a loss of government assets and assigning monetary damages to the VC owners would be very difficult. There is no top-to-bottom accountability.
In the end the taxpayer is screwed by the perps via loss of identity and services, and then screwed by the gov't to try to remedy the situation. Win-win for some, lose-lose for us.
If the app is used to protect USA Defense systems, believe me, the source code is worth a few million bucks.
I would happily pay to analyze it, later exploit it.
Remember the hacked RSA SecurID seeds? Lockheed Martin, L3 and others later?
Yeap... Can all happen again :-)
And yet this major vendor of mission critical security software thought it was just fine to trust their source code to somebody else's cloud service. OK, so the service wasn't hacked, but your code is instantly available once someone else can log in, from anywhere in the world.
We're spending 2 years and god knows how many $$$ moving off Atlassian because they no longer support on-prem, and we just make industrial displays. How in the unHoly Name of Balmer does a govt security system provider get away with having their source in github ?
I see so much happy commenting about Github these days but it looks like the original views and discussions of its' features, resulting in the name Github being used, have all vanished. But now we're seeing things happening that were thought to be potentials when the name Github first appeared. Originally today's levels of hacking, malware, and data thefts were not happening back then, so the name was just a joke.
A previous employer was compromised as a result of an earlier Okta breach. They continued with plans to go full-Okta anyways. Even DevOps. One more Okta breach would mean racing against hackers to regain control of all company assets. Believe me, the hackers would be far faster and better coordinated.
I don't believe a word Okta says when they claim the source code isn't important for security. There will be names of people, insecure hacks, and likely old development access tokens in historical revisions. It's an excellent starting point.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
