Olivia

Offensive Security. Cat lover. Language nerd. Gif enthusiast. Gamer girl. previous: @Mapbox, @Arcadia

[Olivia @oliikit]

After 8 years on the iPhone, iOS 16 has finally made me change my wallpaper.

My upbringing has not prepared me for this moment.

[Olivia @oliikit]

The problem isn't that I have 100 tabs opened up....

The problem is those 100 tabs on each 11 desktop screens.

I'm working on exponential growth here.

[Olivia @oliikit]

Ah yes, going to five year old code is a great way to spend the morning.

[Olivia @oliikit]

Don’t you love it when technology just works?

[Olivia @oliikit]

When automation goes wrong.

[Daniel P. Aldrich urbanists.social/web/@dpaldrich @DanielPAldrich]

Plane delayed for hard to understand reasons

[Olivia @oliikit]

@tjl 😮Yours came in faster than mine! So jealous. But yeah, the sub-1 is what I'm most excited about it as well.

[Tom Lee @tjl]

This is genuinely outrageous. @Ubiquiti I urge you to knock off this abusive behavior. I'm a mostly-happy Unifi customer, but there's no way I can support a company with judgment this disastrously bad.

[Bill Demirkapi @BillDemirkapi]

New documents for the Okta breach: I have obtained copies of the Mandiant report detailing the embarrassing Sitel/SYKES breach timeline and the methodology of the LAPSUS$ group. 1/N https://t.co/z05uQYclg9

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

I want to be clear... 125k log entries without any qualification means jack squat.

Did you know you can make a Windows desktop system generate that many events in under an hour?

There's a lot that Okta has done in this event that is sus, But for me, this is probably the worst

[Jimmy Vo @JimmyVo]

The Cloudflare team put together a great write up of how they investigated: https://t.co/JhrO0byzfZ

investigated these events:
user.account.reset_password, user.mfa.factor.update, system.mfa.factor.deactivate, user.mfa.attempt_bypass, and user.session.impersonation.initiate

[Olivia @oliikit]

@tjl Oy! Glad to hear your alright. But damn, that sucks

[Olivia @oliikit]

@Understudy77 @FrankMcG You can also download admin role assignments here: [tenant].okta.com/admin/access/admins/reports

[Olivia @oliikit]

🙌 All great advice coming from everyone.

It's best to review logs since January.

Okta's impersonation setting is off by default. You can review over in your account settings at [tenant].okta.com/admin/settings/account

[Ben Goerz @bengoerz]

Great advice from @FrankMcG. But what does "Bad" behavior look like in an SSO breach?

Look for:
1. Audit logs for unusual config changes (ex. MFA policy change)
2. Unusual new account creations
3. Unusual modifications to existing users (password resets)

[Olivia @oliikit]

It was beginning to be too quiet lately anyway. Hopefully there's independent verification soon.

[MG @_MG_]

Oh man, if this it what it looks (Okta got popped)… Blue Team everywhere is gonna be crazy busy.

[Wes Kao 🏛 @wes_kao]

Most people suck at managing up.

They waste their boss’ time with too much (or too little) information.

Here’s how to give the right amount of context:

[Olivia @oliikit]

The best way to be productive is to have really important things to do and starting with your backlog items first.

[Olivia @oliikit]

@aloria @iRobot There’s no way that cute face could do such a thing 😍