Top all-time · #5469
beyondtrust.com
Company blog · beyondtrust.com/blogsecurity
beyondtrust.com is the company blog at beyondtrust.com, writing about security. Since 2016, 15 different Hacker News readers have linked it 18 times, most often “BeyondTrust Discovers Breach of Okta Support Unit”. No feed was found, so read it on the site itself.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
HN commenters link BeyondTrust's security blog as sources, mainly its write-up of the Okta support unit breach, plus posts explaining sudo flaws and attack terminology. No comment judges the writing.
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- BeyondTrust Discovers Breach of Okta Support Unit4 people · 7 mentions · first linked 2023-10-20
What Hacker News says?
https://www.beyondtrust.com/blog/entry/understanding-sudo-vu...
Comment linking /blog/entry/understanding-sudo-vulnerability-cve-2021-3156-and-how-privilege-management-for-unix-linux-can-protect-your-enterprise
on “No support Linux hosting shutting down from hack”Submitted Pwning AWS Bedrock AgentCore's AI Code Interpreter as a story · 6 points
HN discussion> Is it better to use a different passphrase on each key, or does using the same one not matter much? Using a passphrase is highly recommended except for server-to-server accounts, which should be locked down (and specify the specific command that server can execute in the authorized_keys file - Userify[1] supports this). You should definitely use a different passphrase for keys stored on separate computers, and it'…
Comment linking /
on “Ask HN: What are the best practises for using SSH keys?”Submitted Command Injection Vulnerability in OpenAI Codex Leads to GitHub Token Compromise as a story · 4 points
HN discussionYeah this is pretty basic information security terminology. An "attack" is any attempted intrusion, successful or not, damaging or not. If the threat actor managed to breach your defenses and gain unauthorized access, that's called an attack. For some definitions: https://www.beyondtrust.com/blog/entry/difference-between-a-...
Comment linking /blog/entry/difference-between-a-threat-actor-hacker-attacker
on “U.S. Escalates Online Attacks on Russia’s Power Grid”Submitted BeyondTrust Discovers Breach of Okta Support Unit as a story · 3 points
HN discussion> Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing? This is a good path to go down anyway, despite the fact that Kerberos, for instance, is totally susceptible to 'pass the hash'[1] type attacks. Concentrate on things like Yubikey-based authentication. You can do SAML/OIDC2/mTLS and SSH with Yubikeys. Eliminate passwords. [1] - https://www.beyondtrust.com/…
Comment linking /resources/glossary/pass-the-hash-pth-attack
on “Show HN: Credentials dumper for Linux using eBPF”Submitted NIST Cybersecurity Framework 2.0: What's New and What You Need to Know as a story · 2 points
HN discussionThanks for letting me know. Here's a shorter link that hopefully works: https://www.beyondtrust.com/assets/documents/BeyondTrust-Mic...
Comment linking /assets/documents/BeyondTrust-Microsoft-Vulnerabilities-Report-2021.pdf
on “Windows 10 minus the spyware plus added stability and security”Submitted BeyondTrust Remote Support SaaS Service Security Investigation as a story · 1 points
HN discussionBeyondTrust Discovers Breach of Okta Support Unit https://www.beyondtrust.com/blog/entry/okta-support-unit-bre...
Comment linking /blog/entry/okta-support-unit-breach
on “Hackers Stole Access Tokens from Okta's Support Unit”See this blog post (linked in original article) from a security firm that was one of Okta's customers, and alerted them to the breech, when they detected suspicious activity on their network shortly after sharing the HAR file with Okta: https://www.beyondtrust.com/blog/entry/okta-support-unit-bre...
Comment linking /blog/entry/okta-support-unit-breach
on “Hackers Stole Access Tokens from Okta's Support Unit”See also, https://www.beyondtrust.com/blog/entry/okta-support-unit-bre... > We raised our concerns of a breach to Okta on October 2nd. Having received no acknowledgement from Okta of a possible breach, we persisted with escalations within Okta until October 19th when Okta security leadership notified us that they had indeed experienced a breach and we were one of their affected customers.
Comment linking /blog/entry/okta-support-unit-breach
on “Cloudflare mitigated yet another Okta compromise”BeyondTrust Discovers Breach of Okta Support Unit https://www.beyondtrust.com/blog/entry/okta-support-unit-bre...
Comment linking /blog/entry/okta-support-unit-breach
on “Okta's stock plunges after security breach”All 3 customers detected it quickly on their own. It sounds from their blog posts that BeyondTrust and Cloudflare both had good alerting that immediately alerted them to the problem. It sounds like 1Password's alerting wasn't as good, and they got lucky that the impacted employee saw a suspicious email saying "here's the report you requested" thought "I didn't request that report" and reported the suspicious email t…
Comment linking /blog/entry/okta-support-unit-breach
on “1Password detects "suspicious activity" in its internal Okta account”There were 3 known customers targeted. >BeyondTrust reported the issue. All 3 customers discovered the issue before Okta fixed the issue. I think all 3 reported the issue to Okta before Okta fixed the issue, but I'm not sure. 1Password and BeyondTrust both reported the issue to Okta before Okta discovered the issue (although 1Password wasn't sure whether the cause was a compromise of Okta's support or malware on the…
Comment linking /blog/entry/okta-support-unit-breach
on “1Password detects "suspicious activity" in its internal Okta account”+1 for Darknet Diaries Also, a few others that I did not see here: - Programming Throwdown: https://www.programmingthrowdown.com/ - This Developer's Life: https://thisdeveloperslife.com/ - Adventures of Alice & Bob: https://www.beyondtrust.com/podcast
Comment linking /podcast
on “Ask HN: What is your favorite Tech Podcasts these days?”Commercial products exist for this purpose, such as Power Broker: https://www.beyondtrust.com/products/powerbroker-identity-se... In addition, it's involved but possible for an experienced user to set up AD authentication on Linux. All AD really amounts to is a database; the endpoint (computer, server, whatever) performs a query, AD produces a response. That can be as a simple as 'is this username/password combinati…
Comment linking /products/powerbroker-identity-services-ad-bridge/
on “Ask HN: Are there any security issues when connecting linux to ActiveDirectory?”
