Cloudflare sheds more light on Thanksgiving security breach in which tokens, source code accessed by suspected spies Cloudflare has just detailed how suspected government spies gained access to its internal Atlassian installation using credentials stolen via a security breach at Okta in October. In a write-up on Thursday, CEO Matthew Prince, CTO John Graham-Cumming, and CISO Grant Bourzikas said the Atlassian intrusion was detected all the …
Key management can be a complex issue. Imagine an SSH client key gets compromised, or retired, or otherwise invalidated: are you sufficiently on top of your machine inventory to be able to go through every authorized_keys file to be sure that key has been scrubbed from all of them?
Remember, it’s not just real machines, but virtual ones and containers as well.
《Key management can be a complex issue. Imagine an SSH client key gets compromised, or retired, or otherwise invalidated: are you sufficiently on top of your machine inventory to be able to go through every authorized_keys file to be sure that key has been scrubbed from all of them?
Remember, it’s not just real machines, but virtual ones and containers as well.》
I think this is one reason ssh certificate based authentication is recommended. Just a lot of work to set up a SSH CA and issue/renew certs for a smallish site.
That number could be accurate, more so in today's age with micro-services.
Also, that might be a total figure. For example, instead of creating a branch on a repository, a developer forks it into their own account to work on it before filing a PR to merge it back to the core repository increasing the overall repository count.
Despite being hacked as a result of Okta's lapse in 2022, Cloudflare got hacked again as a result of an Okta lapse, and apparently this time because Okta let it be known that nothing important had been compromised?
Why are companies still using Okta for access management, or any aspect of security?
Probably because if we cancel every place that get's hacked we would have no options left. The fact you get hacked isn't a problem. It's a about how fast you can detect and respond and shut it down. It's super naive to think places won't be hacked. Best to assume everywhere will get their turn. It's the amount of turns that should inform your decision to move on. I won't touch LastPass as far as I can chuck them at this point for example.
Precisely this. Every major nation state with outside interests is doing something in regards to cyberwarfare, it's just the norm now. And even if it isn't the big hitters like that, there are plenty of smaller criminal organizations that want a piece of the pie. Breaching and selling access, mercenary work, or directly exploiting victims—there are hundreds of them. Even single script kiddies or disgruntled employees in the right place at the right time can mean data being exfiltrated.
LastPass in particular is why I self-host Bitwarden.
I actually do recommend Bitwarden. I didn't care for it at first for self hosting because the project is huge, but Vaultwarden changed my mind. Much less by way of dependencies and works with all Bitwarden clients. The Vaultwarden + official clients ecosystem does everything I need.
Okta also appears to be economical with the truth in the number of customers affected. It turns out it was all customers...
A security organisation that follows a legal/marketing FUD campaign disclosure method is not to be trusted.
https://techcrunch.com/2023/11/29/okta-admits-hackers-accessed-data-on-all-customers-during-recent-breach/?guccounter=1
I really like the people there, but I do not like how much centralized power they have. One wrong move and 80% of the modern Internet could be MITMed without the end user knowing.
Of course, the same goes for Akamai and other major CDNs, as well as cloud providers, but the threat is not as big for them because the attack complexity is suitably larger with all the disparity in hosting solutions. Meanwhile Cloudflare is the epitome of "hold my certs, bro".
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
