The Week in Security: Okta says source code stolen. Also: SentinelSneak: PyPi moduel poses as security SDK

This week: Okta is hit with a supply chain attack incident involving its private GitHub repositories. Also: ReversingLabs researchers discover a malicious PyPI package posing as a SentinelOne SDK client.

This Week’s Top Story

Okta closes out tough 2022 with supply chain hack

Okta, an American identity and access management company, is the victim of a supply chain attack, capping a year that has seen the company struggle with multiple security incidents. BleepingComputer reports that Okta’s private GitHub repositories were hacked and the company's source code stolen this month.

A subsequent, unsigned blog post on Okta's website said that GitHub alerted Okta earlier in the month of suspicious access to Okta’s code repositories. Okta confirmed that this suspicious access was used to copy code from the company's private GitHub repositories for the Okta Workforce Identity Cloud (WIC) product. The company said that the malicious actors did not have access to customer data or Okta’s production services and didn't pose an immediate threat to customers, as the security of Okta's code is not based on it being secret. In the statement, Okta said that its “HIPAA, RedRAMP or DoD customers” were not impacted by the incident, and that Okta itself does not anticipate any disruption to their business as a result.

However, the company's statement also hints at the possible extent of the breach. Okta is placing temporary restrictions on access to its GitHub repositories and has suspended all GitHub integrations with third-party applications. The company is also reviewing "all recent access to Okta software repositories hosted by GitHub to understand the scope of the exposure," reviewing "all recent commits to Okta software repositories hosted with GitHub to validate the integrity of our code," and notified law enforcement.

It has been a tough year for the identity provider. The theft of the code is the second supply chain attack this year, following an incident in September involving a breach of Okta's subsidiary service Auth0’s code repositories. The hacking group Lapsus$ claimed in March that it hacked Okta’s administrative consoles and customer data. Okta later apologized for not properly disclosing the Lapsus$ hack.

Okta’s CSO said that the company is trying to commit to “transparency and partnership” with its customers by sharing the details of this incident in a timely manner.

News Roundup

Here are the stories we’re paying attention to this week…

Malicious PyPI package found posing as SentinelOne SDK (The Register)

ReversingLabs reverse engineer Karlo Zanki discovered a rapidly updated malicious Python package on PyPI masquerading as a legitimate software-development kit (SDK) from cybersecurity firm SentinelOne that actually contains malware designed to exfiltrate data from infected systems. Read more about the incident in Karlo's blog post.

Russian APT Gamaredon changes tactics in attacks targeting Ukraine (Security Week)

Russia-linked Gamaredon, a hacking group known for providing services to other advanced persistent threat (APT) actors, is one of the most intrusive, continuously active APTs targeting Ukraine, Palo Alto Networks’ Unit 42 warns.

Ransomware hackers using new way to bypass MS Exchange ProxyNotShell mitigations (The Hacker News)

Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution (RCE) through Outlook Web Access (OWA).

Shoemaker Ecco leaks over 60GB of sensitive data for 500+ days (Krebs on Security)

Ecco, a global shoe manufacturer and retailer, exposed millions of documents. Not only could anyone have modified the data, but the server misconfiguration’s severity likely left the company open to an attack that could have affected customers all over the world.

Why security teams shouldn't snooze on MFA fatigue (DarkReading)

Security professionals should pay attention to MFA fatigue, also known as an MFA bombing attack, which is a type of social engineering scheme where a cybercriminal sends multiple MFA requests — sometimes in the dead of night — in the hope of frustrating a legitimate user.