/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

Bill Demirkapi

@billdemirkapi
20 posts
2024-04-03
Worth a read! While there do appear to be a few factual errors, I strongly agree with the CSRB's conclusion. Until we have the right incentives to optimize for the outcomes we care about, i.e., customer security, we'll keep seeing the same problems we promised to fix last time.
2024-04-03 View on X
Washington Post

The US Cyber Safety Review Board faults Microsoft for a “cascade of avoidable errors” that led to the 2023 Chinese hack of top US government officials' emails

The independent Cyber Safety Review Board's forthcoming report knocks the tech giant for shoddy cybersecurity practices …

2022-09-17
Some new information since last night. The attacker claims that they were able to gain persistent MFA access to their compromised accounts by social engineering the victims into accepting a prompt that allowed the attacker to register their own device for MFA. 15/N https://twitter.com/...
2022-09-17 View on X
New York Times

Uber takes some internal systems offline to investigate a network breach; Yuga Labs' Sam Curry says it appears the hacker pretty much has “full access to Uber”

what you need to know Msmash / Slashdot : Uber Investigating Breach of Its Computer Systems Prajeet Nair / BankInfoSecurity.com : Uber Probes Breach After Hacker Boasts About Intru...

Some new information since last night. The attacker claims that they were able to gain persistent MFA access to their compromised accounts by social engineering the victims into accepting a prompt that allowed the attacker to register their own device for MFA. 15/N https://twitter.com/...
2022-09-17 View on X
The Verge

Uber says there is “no evidence” the hacker accessed sensitive user info, like trip histories, during the breach and that all its products are now “operational”

Uber says there is “no evidence” that any of its users' private information was compromised in a breach of its internal computer systems.

2022-03-29
My questions for Okta: You knew that the machine of one of your customer support members was compromised back in January. Why didn't you investigate it? Having the capability to detect an attack is useless if you aren't willing to respond. 7/N
2022-03-29 View on X
Wired

Leaked Mandiant report: Okta's contractor Sitel first sent a Lapsus$ breach notification to Okta on January 25 and a detailed “Intrusion Timeline” on March 17

Documents shed some light on how Okta and its subprocessor Sitel reacted to a breach, but they don't explain the apparent lack of urgency.

With the endpoint agent disabled, LAPSUS$ simply downloaded the official version of Mimikatz (a popular credential dumping utility) directly from its repository. 4/N https://twitter.com/...
2022-03-29 View on X
Wired

Leaked Mandiant report: Okta's contractor Sitel first sent a Lapsus$ breach notification to Okta on January 25 and a detailed “Intrusion Timeline” on March 17

Documents shed some light on how Okta and its subprocessor Sitel reacted to a breach, but they don't explain the apparent lack of urgency.

New documents for the Okta breach: I have obtained copies of the Mandiant report detailing the embarrassing Sitel/SYKES breach timeline and the methodology of the LAPSUS$ group. 1/N https://twitter.com/... https://twitter.com/...
2022-03-29 View on X
Wired

Leaked Mandiant report: Okta's contractor Sitel first sent a Lapsus$ breach notification to Okta on January 25 and a detailed “Intrusion Timeline” on March 17

Documents shed some light on how Okta and its subprocessor Sitel reacted to a breach, but they don't explain the apparent lack of urgency.

We can see how LAPSUS$ originally began investigating their compromised host on January 19th, 2022. With little regard for OPSEC, LAPSUS$ searched for a CVE-2021-34484 bypass on their compromised host and downloaded the pre-built version from GitHub. 2/N https://twitter.com/... https://twitter.com/...
2022-03-29 View on X
Wired

Leaked Mandiant report: Okta's contractor Sitel first sent a Lapsus$ breach notification to Okta on January 25 and a detailed “Intrusion Timeline” on March 17

Documents shed some light on how Okta and its subprocessor Sitel reacted to a breach, but they don't explain the apparent lack of urgency.

LAPSUS$ used off-the-shelf tooling from GitHub for the majority of their attacks. After downloading Process Explorer and Process Hacker, LAPSUS$ bypassed the FireEye endpoint agent by simply terminating it! 3/N https://twitter.com/...
2022-03-29 View on X
Wired

Leaked Mandiant report: Okta's contractor Sitel first sent a Lapsus$ breach notification to Okta on January 25 and a detailed “Intrusion Timeline” on March 17

Documents shed some light on how Okta and its subprocessor Sitel reacted to a breach, but they don't explain the apparent lack of urgency.

Good questions to ask include: Who knows how your sub-processors handle their own security? As we saw in this case, Sitel didn't take the security of their environment very seriously. What can an attacker do if one of your sub-processors becomes compromised? 11/N
2022-03-29 View on X
Wired

Leaked Mandiant report: Okta's contractor Sitel first sent a Lapsus$ breach notification to Okta on January 25 and a detailed “Intrusion Timeline” on March 17

Documents shed some light on how Okta and its subprocessor Sitel reacted to a breach, but they don't explain the apparent lack of urgency.

I have been terminated from Zoom for refusing to remove the following tweets. Anyone have recommendations for wrongful termination lawyers based in California? https://twitter.com/...
2022-03-29 View on X
Wired

Leaked Mandiant report: Okta's contractor Sitel first sent a Lapsus$ breach notification to Okta on January 25 and a detailed “Intrusion Timeline” on March 17

Documents shed some light on how Okta and its subprocessor Sitel reacted to a breach, but they don't explain the apparent lack of urgency.

2022-03-23
The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords: https://twitter.com/...
2022-03-23 View on X
Wired

Okta confirms an attacker accessed an engineer's laptop in January consistent with posted screenshots by Lapsus$, as customers struggle to grasp their exposure

Authentication firm Okta's statements on the Lapsus$ breach fails to answer key questions.  —  The digital extortion group Lapsus$ threw …

Microsoft published a great technical dive into the methodology of LAPSUS$. Worth a read if you're an organization trying to assess your own risk or want to learn more about how they operate. https://www.microsoft.com/...
2022-03-23 View on X
The Verge

Microsoft confirms Lapsus$ compromised “a single account” and stole portions of source code for some products, but says no customer code and data was involved

Lapsus$ says it has accessed data from Okta, Nvidia, Samsung, and Ubisoft  —  The hacking group Lapsus$ …

The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords: https://twitter.com/...
2022-03-23 View on X
Reuters

Okta says the “maximum potential impact” of its security breach was to 366 customers, out of 15K+, whose data was accessed by contractor Sitel; Okta is down 5%+

Hundreds of customers of digital authentication firm Okta Inc have possibly been affected by a security breach caused …

2022-03-22
LAPSUS$ appears to have gained access to some company VPNs given the Cisco AnyConnect icon and the GlobalProtect window in this image. https://twitter.com/...
2022-03-22 View on X
Reuters

Okta is investigating reports of a breach after Lapsus$ group posted alleged internal system screenshots; CEO says they could be related to a January incident

Authentication services provider Okta Inc (OKTA.O) is investigating a report of a digital breach, the company said on Tuesday … Source: @toddmckinnon and @toddmckinnon .

More screenshots demonstrating access to “superuser”, perhaps Okta's administrative access panel? Other access includes Jira and Slack for Okta. https://twitter.com/...
2022-03-22 View on X
Reuters

Okta is investigating reports of a breach after Lapsus$ group posted alleged internal system screenshots; CEO says they could be related to a January incident

Authentication services provider Okta Inc (OKTA.O) is investigating a report of a digital breach, the company said on Tuesday … Source: @toddmckinnon and @toddmckinnon .

Another scary note is the date in the VM used in the screenshot consistently appears to be January 21st, 2022. If this date is correct, this would suggest @okta failed to publicly acknowledge any breach for at least two months. https://twitter.com/...
2022-03-22 View on X
Reuters

Okta is investigating reports of a breach after Lapsus$ group posted alleged internal system screenshots; CEO says they could be related to a January incident

Authentication services provider Okta Inc (OKTA.O) is investigating a report of a digital breach, the company said on Tuesday … Source: @toddmckinnon and @toddmckinnon .

The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords: https://twitter.com/...
2022-03-22 View on X
Reuters

Okta is investigating reports of a breach after Lapsus$ group posted alleged internal system screenshots; CEO says they could be related to a January incident

Authentication services provider Okta Inc (OKTA.O) is investigating a report of a digital breach, the company said on Tuesday … Source: @toddmckinnon and @toddmckinnon .

It is possible that LAPSUS$ might have gotten all this access by abusing Okta's own remote control tooling they use to spy on their employees. It would explain things like why the Chrome browser is signed into a user. https://twitter.com/...
2022-03-22 View on X
Reuters

Okta is investigating reports of a breach after Lapsus$ group posted alleged internal system screenshots; CEO says they could be related to a January incident

Authentication services provider Okta Inc (OKTA.O) is investigating a report of a digital breach, the company said on Tuesday … Source: @toddmckinnon and @toddmckinnon .

LAPSUS$ edited their message to clarify that they did not breach Okta's databases, but rather targeted Okta customers. https://twitter.com/...
2022-03-22 View on X
Reuters

Okta is investigating reports of a breach after Lapsus$ group posted alleged internal system screenshots; CEO says they could be related to a January incident

Authentication services provider Okta Inc (OKTA.O) is investigating a report of a digital breach, the company said on Tuesday … Source: @toddmckinnon and @toddmckinnon .

The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems. https://twitter.com/...
2022-03-22 View on X
Reuters

Okta is investigating reports of a breach after Lapsus$ group posted alleged internal system screenshots; CEO says they could be related to a January incident

Authentication services provider Okta Inc (OKTA.O) is investigating a report of a digital breach, the company said on Tuesday … Source: @toddmckinnon and @toddmckinnon .