http://www.zdnet.com/article/o...itive-customer-data/

Password manager OneLogin hacked, exposing sensitive customer data
UPDATED: The company said that hackers have 'the ability to decrypt encrypted data'.

By Zack Whittaker for Zero Day | June 1, 2017 -- 15:47 GMT (08:47 PDT) | Topic: Security

Password manager and single sign-on provider OneLogin has been hacked.

In a brief blog post, the company's chief security officer Alvaro Hoyos said that it was aware of "unauthorized access to OneLogin data in our US data region," and that it had reached out to customers.

Hoyos said that the company had blocked the unauthorized access after the breach and is working with law enforcement.

The blog post initially lacked detailed information about the incident, although the post had omitted that hackers had stolen sensitive customer data -- a point that the company had instead only mentioned in an email sent to customers, seen by ZDNet.

"OneLogin believes that all customers served by our US data center are affected and customer data was potentially compromised," the email read.

Later in the day, the company said in an update: "Our review has shown that a threat actor obtained access to a set of [Amazon Web Services, or AWS] keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US."

The company confirmed that the attack appears to have started at 2am (PT), but staff were alerted of unusual database activity some seven hours later, who "within minutes, shut down the affected instance as well as the AWS keys that were used to create it".

"The threat actor was able to access database tables that contain information about users, apps, and various types of keys," the company said.


The company added that although it encrypts "certain sensitive data at rest," it could not rule out the possibility that the hacker "also obtained the ability to decrypt data".

But a spokesperson did not say what kind of data is and isn't encrypted. We have asked for clarity, and will update when we hear back.

Some had questioned earlier in the day how the hackers had access to customer data that could ultimately be decrypted.

"Am I the only 1 to find it disturbing OneLogin had a decryption method for customer data accessible enough to be grabbed via breach?" said one user on Twitter.

The company has advised customers to change their passwords, generate new API keys for their services, and create new OAuth tokens -- used for logging into accounts -- as well as to create new security certificates. The company said that information stored in its Secure Notes feature, used by IT administrators to store sensitive network passwords, can be decrypted.

The company also hasn't said how many customers were affected.

According to its website, dozens of major multinationals, including ARM, Dun & Bradstreet, The Carlyle Group, Conde Nast, and Dropbox (which a spokesperson disputed in an email), are customers.

OneLogin allows corporate users to access multiple web applications, sites, and services with just one password. It's thought that the company has millions of users serving more than 2,000 companies in dozens of countries, according to CrunchBase.

The single sign-on provider integrates hundreds of different third-party apps and services, such as Amazon Web Services, Microsoft's Office 365, LinkedIn, Slack, Twitter, and Google services.

It's the second such breach in as many years. Last August, the company warned users that its Secure Notes service had been accessed by an "unauthorized user," but it denied that any customer data had been compromised.

Updated at 8pm ET: Additional details from the company.

Contact me securely

Zack Whittaker can be reached securely on Signal and WhatsApp at 646-755–8849, and his PGP fingerprint for email is: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.

Yeah, there are a bunch of them out there now. My preference is LastPass with 2 factor auth, If you use one that by design, does NOT (have/keep/need/maintain) a copy of the decryption key, (like LastPass), you can basically ignore when they get breached (and they will).

I know it will seem unintuitive to keep all of your passwords "in one basket" so to speak. But the ability to use huge complex and unique passwords for EVERY site/service and then let a password manager handle the mess means that ALL of those sites (large threat surface) are more secure. I can then focus on securing and understanding the one main point of security. I'd recommend it to anyone.

https://lastpass.com/support.php?cmd=showfaq&id=6926

I use norton. Thx for the heads up.

This is why I've traditionally been disinclined to store my encrypted keyring on servers not under my direct control. (Which is all "the cloud" is.)

I do, now, but, the encrypted keyring is again encrypted in a general file store, not a keyring-specific store. So, not only is the keyring doubly-encrypted, with strong encryption in each case, but, it's buried in with photos, music, notes of no consequence and all manner of other uninteresting cruft. That, in and of itself, is a form of "encryption." (Not unlike the principles behind secure spread-spectrum radio communications, which look essentially like noise.)

This message has been edited. Last edited by: ensigmatic, June 02, 2017 11:27 AM

quote:

threat actor

WTF is a "threat actor"?

quote:

threat actor

It is the method, device or person used gain access to a system.

Think ISIS.

An IED, a car bomb, a Jihadi, the message groups, the some Mosque, some radical teacher, etc., all are the "threat actor". Each are a method to inflict the damage and terrorize.

So, whether it is a person, a group, a bit of code, a full program or application, a method such as social engineering and so forth.

It all is "the threat actor".

Back in the early days, it was "the hack". It coudl be anything, but "the hack" defiend the "tip of the spear" if you will.

But, that is the broadbrush generalization, it gets more complex the more you dig and work to understand.

As is the "cloud", being a great many small parts that make up the whole, and someone fluid, and somewhat static, some phisical, some virtual, some intellect and some hard code instructions.

You cannot simply point at any one thing and call it "the cloud" (internet), so is "the threat actor".

quote:

Originally posted by wxdave:

quote:

threat actor

WTF is a "threat actor"?

Perp in common parlance (Pre PC)

On a Mac I use "KeyPass". Local only database. If I need access remotely, I VNC in and open it up (encrypted access)and get the data. I don't trust the "One login Access" model just for this precise reason. I also DO NOT LINK any of my accounts to google, facebook or whatever.

If someone wants me they're gonna have to work a bit harder at it.

I use a piece of paper...

It will never be hacked

No password keeper for me.

I use long, unique, complex passwords for each site memorized and based on a system.

I keep tiers of passwords. A tier for financial and banking. A tier for my top level email. A tier for shopping websites that keep banking info, a tier for accounts with value (paid services, utilities), and a tier for non sensitive websites (web forums, social media).

When I make a new password, I push the password to the top tier, and then push all the passwords down so that I only have to memorize one new password.

The passwords are long, complex, and unique, but easy to remember. An example would be "I H8 P@ssword Keepers! 4 BAN" which is case sensitive, uses letters, numbers, and symbols, and has the last 3 letters change with each website it uses.

Even if a password is breached, damage is contained to a single tier.

quote:

Originally posted by JimTheo:
On a Mac I use "KeyPass". Local only database. If I need access remotely, I VNC in and open it up (encrypted access)and get the data. I don't trust the "One login Access" model just for this precise reason. I also DO NOT LINK any of my accounts to google, facebook or whatever.

If someone wants me they're gonna have to work a bit harder at it.

My password manager is local-only too: "mSecure", with 256-bit blowfish encryption. I have it on my iPhone and my MacBook.

quote:

Originally posted by Lord Vaalic:
I use a piece of paper...

It will never be hacked

Tell us, where do you hide the paper?

quote:

Originally posted by TBH:

quote:

Originally posted by Lord Vaalic:
I use a piece of paper...

It will never be hacked

Tell us, where do you hide the paper?

See, you don't know where it is! Hack proof....

quote:

Originally posted by V-Tail:
1Password

Same here. I like it. I only use local storage for the password vault.

quote:

Originally posted by TBH:

quote:

Originally posted by Lord Vaalic:
I use a piece of paper...

It will never be hacked

Tell us, where do you hide the paper?

I keep mine under the keyboard. They'd never think to look there.

quote:

Originally posted by TBH:

quote:

Originally posted by Lord Vaalic:
I use a piece of paper...

It will never be hacked

Tell us, where do you hide the paper?

As a child of four can plainly see, in an envelope, hermetically sealed, kept in a mayonnaise jar on Funk and Wagnalls' porch since noon today.

quote:

Originally posted by Lord Vaalic:
I use a piece of paper...

It will never be hacked

An index card kept in the safe seems like a perfectly good option to me.

quote:

Originally posted by TBH:

quote:

Originally posted by Lord Vaalic:
I use a piece of paper...

It will never be hacked

Tell us, where do you hide the paper?

Post-It note on the edge of the monitor.

Does anyone here have any experience with the "Logmeinonce" password manager?
If so what's your opinion of it?
Thanks,