OneLogin Hack – Encrypted Data Compromised


The OneLogin hack is blowing up now it seems like whoever got access can also decrypt encrypted customer data which is just about AS BAD as it can get for a password/identity management service.

OneLogin Hack - Encrypted Data Compromised

Now I’m a HUGE supporter of password management tools as I’ve mentioned many times here, so anyone who signed up for this one – sorry.. I recently switched to Dashlane, which seems great – and now I’m recommending that so I hope it’s as safe as they claim.

Identity management outfit OneLogin has revealed it’s suffered a security incident that’s seen “unauthorized access to OneLogin data in our US data region”, but has offered rather scarier information in different documents.

The company blog describes only “unauthorized access”. In emails sent to customers seen by The Reg the company adds news that “customer data was potentially compromised.” And on a registration-required support page the threat is described as follows:

“All customers served by our US data center are affected; customer data was compromised, including the ability to decrypt encrypted data.”
Decrypt data? Woah! That’s a bit more than mere unauthorized access.

OneLogin’s blog does say that customers have been told what to do in the wake of the attack and the email we’ve seen does “strongly advise” customers to visit support page to which we have linked.


So a service got hacked? No big deal right? Some user data got leaked though, oh well that’s not that common. Sadly that’s not where it ends, OneLogin has said the attackers have the ability to decrypt encrypted data.

WHAT? How does that even happen, does that mean the keys were right there on the server with the data? that’s just insanity.

The company says it is “working with an independent security firm to determine how the unauthorized access happened and verify the extent of the impact of this incident.” In the email to customers it adds that it can’t reveal all, due to the involvement of law enforcement agencies. The blog says the company is “actively working to determine how best to prevent such an incident from occurring in the future and will update our customers as these improvements are implemented.”

OneLogin offers a single sign-on and other authentication management services it says gives “employees, customers and partners with secure access to your cloud and company apps on any device.”

It’s not the only such outfit: The Register in no way suggests that the likes of Okta, VMware and Citrix have been attacked, but notes all offer single-sign-on across lots of cloudy apps and are therefore obviously a tasty target for criminals who want to get their hands on lots of credentials with one hit.

So this company claiming to provide secure access has been totally owned, doesn’t give you much confidence does it?

They are also hiding behind claims of law enforcement involvement to avoid sharing more details about the breach. We shall have to see if anything comes out in the future (which from past experience is highly unlikely).

Source: The Register

Posted in: Cryptography, Exploits/Vulnerabilities, Privacy, Web Hacking

, ,


Latest Posts:


dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).
WiFi-Dumper - Dump WiFi Profiles and Cleartext Passwords WiFi-Dumper – Dump WiFi Profiles and Cleartext Passwords
WiFi-Dumper is an open-source Python-based tool to dump WiFi profiles and cleartext passwords of the connected access points on a Windows machine.
truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.


2 Responses to OneLogin Hack – Encrypted Data Compromised

  1. Ashok June 8, 2017 at 10:31 pm #

    Did you say Dashlane in place of OneLogin in 2nd paragraph in this sentence? Sadly that’s not where it ends, Dashlane has said the attackers have the ability to decrypt encrypted data.

    • Darknet June 9, 2017 at 1:32 pm #

      Yes, you’re right, apologies if that was confusing I’ve corrected it.