Identity and access management solutions provider Okta this week informed customers that some of the company's source code was stolen recently from its GitHub repositories.
Identity and access management solutions provider Okta this week informed customers that some of the company’s source code was stolen recently from its GitHub repositories.
Okta was informed about the breach in early December by GitHub. An investigation showed that hackers accessed Okta’s repositories and copied code associated with Workforce Identity Cloud (WIC).
The good news is that the source code should not contain any information that can pose a security risk for Okta products. In addition, the company says there is no evidence of unauthorized access to the Okta service or customer data, and Auth0 (Customer Identity Cloud) products are not impacted.
“As soon as Okta learned of the possible suspicious access, we promptly placed temporary restrictions on access to Okta GitHub repositories and suspended all GitHub integrations with third-party applications,” Okta said in a blog post.
The company has reviewed recent code changes to ensure that the attackers have not made any malicious modifications, and rotated GitHub credentials.
This is not the only security incident disclosed by Okta this year. The company was targeted by the notorious Lapsus$ hackers in early 2022. The group gained access to the account of a customer support engineer at a third-party service provider, which gave them access to some of the company’s resources. However, the company’s final report on the incident said the impact was smaller than initially believed.
Okta was also hit by the Twilio breach, which was part of a major cybercrime campaign targeting more than 130 organizations. Okta confirmed in August that customer data, including phone numbers and SMS messages containing OTPs, were compromised.
There have been several security incidents involving source code this year. In April, GitHub revealed that the private repositories of dozens of organizations were downloaded using stolen OAuth tokens issued to Heroku and Travis CI. GitHub said the attack was highly targeted.
By Eduard Kovacs on Thu, 22 Dec 2022 12:12:35 +0000
Original link