Forest Global Training Partners

Cyber Risks · Krebs on Security

One Login: Breach Exposed Ability to Decrypt Data

Summary: OneLogin, a single sign-on and identity management provider serving some 2,000 companies in 44 countries, detected unauthorized access to data in its US region and blocked it, reporting the matter to law enforcement and hiring an independent security firm. A message OneLogin sent to customers said customer data was compromised including the ability to decrypt encrypted data, and the company later said a threat actor used a set of AWS keys to access its AWS API starting around 2 am PST on May 31, 2017, creating instances for reconnaissance until staff shut down the affected instance and keys within minutes of an alert around 9 am.

Bottom line: OneLogin's service remembers and supplies customers' usernames and passwords for their other applications, so a breach reaching the ability to decrypt data forces victim customers to regenerate API keys, OAuth tokens, security certificates and credentials and have end users reset passwords - rebuilding the inner workings of their authentication systems.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related