{"id":29686,"date":"2025-03-26T14:58:39","date_gmt":"2025-03-26T21:58:39","guid":{"rendered":"https:\/\/essential.construction\/news\/researchers-back-claim-of-oracle-cloud-breach-despite-companys-denials\/"},"modified":"2025-03-26T14:58:39","modified_gmt":"2025-03-26T21:58:39","slug":"researchers-back-claim-of-oracle-cloud-breach-despite-companys-denials","status":"publish","type":"post","link":"https:\/\/essential.construction\/news\/researchers-back-claim-of-oracle-cloud-breach-despite-companys-denials\/","title":{"rendered":"Researchers back claim of Oracle Cloud breach despite company\u2019s denials"},"content":{"rendered":"<p> [ad_1]<br \/>\n<\/p>\n<div>\n<div class=\"text-to-speech\">\n    <button class=\"text-to-speech__button button\"><\/p>\n<p>            <img decoding=\"async\" class=\"text-to-speech__button__icon\" src=\"https:\/\/www.constructiondive.com\/static\/images\/audio_icon.svg?482016190122\" alt=\"-\"><\/p>\n<p>        Listen to the article<br \/>\n        <span class=\"text-to-speech__button__audio-length\">2 min<\/span><br \/>\n    <\/button><\/p>\n<div class=\"text-to-speech__controls\">\n        <audio controls=\"\" class=\"js-text-to-speech\" preload=\"none\"><source src=\"https:\/\/res.cloudinary.com\/dmgi9movl\/video\/upload\/q_1\/v1743006050\/news\/text_to_speech\/researchers-oracle-cloud-breach_vbumea.wav\" type=\"audio\/mp3\"><\/source><\/audio><\/p>\n<div class=\"text-to-speech__controls__text\">\n            This audio is auto-generated. Please let us know if you have <a rel=\"nofollow noopener\" href=\"https:\/\/www.constructiondive.com\/contact\/\" target=\"_blank\">feedback<\/a>.\n        <\/div>\n<\/p><\/div>\n<\/div>\n<h3>Dive Brief:<\/h3>\n<ul>\n<li><span><span><span><span><span><span>Security researchers said they confirmed a breach of Oracle Cloud after a previously unknown threat actor posted an offer to sell more than 6 million records. The technology firm denied the original hacking claim, but CloudSEK presented supporting evidence in a <\/span><\/span><\/span><\/span><\/span><\/span><a rel=\"nofollow noopener\" href=\"https:\/\/www.cloudsek.com\/blog\/part-2-validating-the-breach-oracle-cloud-denied-cloudseks-follow-up-analysis\" target=\"_blank\"><span><span><span><span><span><span><span><span>follow-up report released Monday<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/a><span><span><span><span><span><span>.<\/span><\/span><\/span><\/span><\/span><\/span><\/li>\n<li><span><span><span><span><span><span>Researchers said the hacker, identified as \u201crose87168,\u201d\u00a0successfully exploited a vulnerability in Oracle Cloud\u2019s login endpoint, allowing the attacker to access the records.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/li>\n<li><span><span><span><span><span><span>The stolen data includes single sign-on credentials, Lightweight Director Access Protocol passwords, OAuth2 keys and tenant data, according to CloudSEK. <\/span><\/span><\/span><\/span><\/span><\/span><\/li>\n<\/ul>\n<h3>Dive Insight:<\/h3>\n<p><span><span><span><span><span><span>CloudSEK on Friday <\/span><\/span><\/span><\/span><\/span><\/span><a rel=\"nofollow noopener\" href=\"https:\/\/www.cloudsek.com\/blog\/the-biggest-supply-chain-hack-of-2025-6m-records-for-sale-exfiltrated-from-oracle-cloud-affecting-over-140k-tenants\" target=\"_blank\"><span><span><span><span><span><span><span><span>released a report<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/a><span><span><span><span><span><span> claiming the hacker had exfiltrated more than 6 million records that impacted more than 140,000 tenants.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<p><span><span><span><span><span><span>Researchers said the hacker, who has been active since January, was offering incentives for anyone to help decrypt the SSO passwords so they could pressure companies to pay a \u201cfee\u201d for data removal, according to CloudSEK researchers.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<p><span><span><span><span><span><span>Oracle issued a <\/span><\/span><\/span><\/span><\/span><\/span><a rel=\"nofollow noopener\" href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/oracle-denies-data-breach-after-hacker-claims-theft-of-6-million-data-records\/\" target=\"_blank\"><span><span><span><span><span><span><span><span>statement to BleepingComputer<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/a><span><span><span><span><span><span> Friday denying there was any breach. However, CloudSEK researchers released an additional report on Monday, with new evidence supporting the breach claim.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<p><span><span><span><span><span><span>CloudSEK said the hacker accessed login.us2.oraclecloud.com, a production SSO server that was active about 30 days before researchers discovered the breach on Friday.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<p><span><span><span><span><span><span>\u201cWe suspect the actor leveraged a zero-day vulnerability or misconfiguration in the OAuth2 authentication process,\u201d a spokesperson for CloudSEK said via email.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<p><span><span><span><span><span><span>A spokesperson for Oracle was not immediately available for comment.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<p><span><span><span><span><span><span>Jake Williams, a faculty member at IANS Research and VP of R&amp;D at Hunter Strategy, said even with Oracle\u2019s denials, he has \u201clittle doubt\u201d that a compromise of Oracle\u2019s environment took place.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<p><span><span><span><span><span><span>\u201cThere is direct evidence that a threat actor was able to upload data to the web root of a login server that was being actively used, so it can\u2019t just be a \u2018legacy endpoint\u2019 as some have suggested,\u201d Williams said via email.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<\/p><\/div>\n<p>[ad_2]<br \/>\n<br \/><a href=\"https:\/\/www.constructiondive.com\/news\/researchers-oracle-cloud-breach\/743609\/\" rel=\"nofollow noopener\" target=\"_blank\">This article was originally posted at Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[ad_1] Listen to the article 2 min This audio is auto-generated. Please let us know if you have feedback. Dive &#8230; <a title=\"Researchers back claim of Oracle Cloud breach despite company\u2019s denials\" class=\"read-more\" href=\"https:\/\/essential.construction\/news\/researchers-back-claim-of-oracle-cloud-breach-despite-companys-denials\/\" aria-label=\"Read more about Researchers back claim of Oracle Cloud breach despite company\u2019s denials\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[457],"tags":[],"class_list":["post-29686","post","type-post","status-publish","format-standard","hentry","category-construction-dive","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-33"],"_links":{"self":[{"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/posts\/29686","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/comments?post=29686"}],"version-history":[{"count":0,"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/posts\/29686\/revisions"}],"wp:attachment":[{"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/media?parent=29686"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/categories?post=29686"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/essential.construction\/news\/wp-json\/wp\/v2\/tags?post=29686"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}