Single (sign-on) point of failure? —

OneLogin suffers breach—customer data said to be exposed, decrypted

Customer account-only support page warns of "ability to decrypt encrypted data."

OneLogin suffers breach—customer data said to be exposed, decrypted

Updated, June 2: OneLogin has revealed more about the attack on its systems, confirming that a "threat actor" had accessed database tables including "information about users, apps, and various types of keys."

It warned once again that the malefactor, who was able to rifle through OneLogin's infrastructure for seven hours, may have been able to decrypt customer data. The company said:

Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance.

OneLogin staff was alerted of unusual database activity around 9 am PST and within minutes shut down the affected instance as well as the AWS keys that were used to create it.

One customer affected by the OneLogin attack told Ars that he was having to "rebuild the whole authentication security system... OUCH!"

OneLogin told fretful customers in an internal notification that they would need to work through a number of steps to secure their accounts, including generation of new API credentials and OAuth tokens. Any users served by the firm's US data centre have been hit by the breach, OneLogin said.

"While we encrypt certain sensitive data at rest, at this time we cannot rule out the possibility that the threat actor also obtained the ability to decrypt data," OneLogin said. "We are thus erring on the side of caution and recommending actions our customers should take, which we have already communicated to our customers."

Original story (June 1)

OneLogin has admitted that the single sign-on (SSO) and identity management firm has suffered a data breach. However its public statement is vague about the nature of the attack.

An e-mail to customers provides a bit of detail—warning them that their data may have been exposed. And a support page that is only accessible to OneLogin account holders is even more worrying for customers. It apparently says that "customer data was compromised, including the ability to decrypt encrypted data."

OneLogin—which claims to offer a service that "secures connections across all users, all devices, and every application"—said on Thursday that it had "detected unauthorised access" in the company's US data region. It added in the post penned by OneLogin CISO Alvaro Hoyos:

We have since blocked this unauthorised access, reported the matter to law enforcement, and are working with an independent security firm to determine how the unauthorised access happened and verify the extent of the impact of this incident. We want our customers to know that the trust they have placed in us is paramount.

While our investigation is still ongoing, we have already reached out to impacted customers with specific recommended remediation steps and are actively working to determine how best to prevent such an incident from occurring in the future and will update our customers as these improvements are implemented.

It has given customers a long list of actions to protect their accounts following the attack.

It's unclear why it is that OneLogin has provided three different sets of information to its customers. It's possible the company was hoping to only disclose more detail to those directly affected by the attack to avoid revealing potential weaknesses that may have exposed the data in the first place. But that attempt to keep the information under wraps has clearly backfired as customers scramble to secure their accounts.

This is the second data breach that OneLogin has suffered within the past year. Last August it warned customers of a cleartext login bug on its Secure Notes service, after "an unauthorised user gained access to one of our standalone systems, which we use for log storage and analytics." Hoyos apologised for that particular breach. "We are making every effort to prevent any similar occurrence in the future," he said at the time.

Channel Ars Technica