This audio is automatically generated. Do us know if you have comments.
Brief of diving:
- Security researchers said they confirmed a breach of Oracle Cloud after a previously unknown threat actor published an offer to sell more than 6 million records. The technology firm denied the original piracy claim but Cloudsek presented support tests in a Follow -up report posted on Monday.
- The researchers said that the computer pirate, identified as “Rose87168”, successfully exploited a vulnerability at the logging point of Oracle Cloud, allowing the attacker accessing the records.
- Stolen data include unique login credentials, Light Director’s Access Protocol Passwords, OAUTH2 Keys and tenant data, according to Cloudsek.
Divide vision:
Cloudsek on Friday published a report To say that the computer pirate had become more than 6 million records that affected more than 140,000 tenants.
The researchers said that the computer pirate, which has been active since January, offered incentives to anyone who helped decipher SSO passwords so that they could pressure companies so that they could pay a “quota” to delete the data, according to Cloudsek researchers.
Oracle issued a Declaration to BleepingComputer Friday denying that there was any breach. However, Cloudsek researchers published an additional Monday report, with new tests that support the complaint claim.
Cloudsek said that the computer pirate accessed Login.us2.oraclecloud.com, an active production SSO server about 30 days before the researchers discovered their breach on Friday.
“We suspect the actor took advantage of a zero -day vulnerability or configuration in the OAUTH2 authentication process,” said a Cloudsek spokesman via email.
An Oracle spokesman was not immediately available for comments.
Jake Williams, a member of the Teaching Teaching Research and Hunter Strategy R&D, said that even with Oracle’s denials, he has “little doubt” that there was a commitment to Oracle around.
“There is direct evidence that a threat actor has been able to upload data to the web root of a login server that was actively used, so it cannot be just an” end point inherited “as some have suggested,” said Williams via email.
