Dive Brief:
- Security researchers said they confirmed a breach of Oracle Cloud after a previously unknown threat actor posted an offer to sell more than 6 million records. The technology firm denied the original hacking claim, but CloudSEK presented supporting evidence in a follow-up report released Monday.
- Researchers said the hacker, identified as “rose87168,” successfully exploited a vulnerability in Oracle Cloud’s login endpoint, allowing the attacker to access the records.
- The stolen data includes single sign-on credentials, Lightweight Director Access Protocol passwords, OAuth2 keys and tenant data, according to CloudSEK.
Dive Insight:
CloudSEK on Friday released a report claiming the hacker had exfiltrated more than 6 million records that impacted more than 140,000 tenants.
Researchers said the hacker, who has been active since January, was offering incentives for anyone to help decrypt the SSO passwords so they could pressure companies to pay a “fee” for data removal, according to CloudSEK researchers.
Oracle issued a statement to BleepingComputer Friday denying there was any breach. However, CloudSEK researchers released an additional report on Monday, with new evidence supporting the breach claim.
CloudSEK said the hacker accessed login.us2.oraclecloud.com, a production SSO server that was active about 30 days before researchers discovered the breach on Friday.
“We suspect the actor leveraged a zero-day vulnerability or misconfiguration in the OAuth2 authentication process,” a spokesperson for CloudSEK said via email.
A spokesperson for Oracle was not immediately available for comment.
Jake Williams, a faculty member at IANS Research and VP of R&D at Hunter Strategy, said even with Oracle’s denials, he has “little doubt” that a compromise of Oracle’s environment took place.
“There is direct evidence that a threat actor was able to upload data to the web root of a login server that was being actively used, so it can’t just be a ‘legacy endpoint’ as some have suggested,” Williams said via email.
