Okta Warns of Credential Stuffing Attacks Targeting Its CORS Feature
Summary: According to Okta, If your tenant does not use cross-origin authentication, but ‘scoa’ or ‘fcoa’ events are present in event logs, then it is likely that your tenant has been targeted in a credential stuffing attack. If cross-origin authentication is used then customers have been advised to look for abnormal spikes in 'fcoa' and 'scoa' events. Link(s):
Identity and Access Management company Okta warns that its cross-origin authentication feature in Customer Identity Cloud (CIC) is susceptible to credential-stuffing attacks. “Okta's Cross-Origin Resource Sharing (CORS) feature allows customers to add JavaScript to their websites and applications to send authentication calls to the Okta API hosted. For this feature to work, customers must grant access to the URLs from which cross-origin requests can originate. Okta states these URLs are targeted in credential stuffing attacks and should be disabled if they are not in use” (Bleeping Computer, 2024).
Credential stuffing attacks entail actors brute-forcing their way into online accounts using a list of usernames and passwords that are potentially acquired in previous data breaches or from phishing and malware campaigns. Okta says that a number of its customers have been the target of such attacks since April 15. While the exact number of impacted customers has not been disclosed, Okta has notified customers who have the CORS feature enabled and has provided additional guidance over email.
Analyst Comment:
Okta recommends reviewing logs for the following events for signs of potential login attempts:
Suggested Corrections:
In addition to checking logs, Okta recommends:
https://www.bleepingcomputer.com/ne...-stuffing-attacks-targeting-its-cors-feature/
https://sec.okta.com/articles/2024/...in-authentication-credential-stuffing-attacks