Our HR system has a self service portal where employees view payslips, book holiday and update their personal details. When it went live it was given its own username and password rather than our single sign on, because the supplier charged extra for the integration and the portal was thought to hold nothing an attacker would want.
Two years later we connected it to our identity system, so that a new starter's details would flow across automatically. One of the fields that flowed across every night was the personal mobile number. Our self service password reset uses that number to send a code. It seemed sensible: HR held the most accurate number for each person, so the reset would always reach them.
In March a warehouse supervisor received an email that looked like a payslip notification and entered her portal password on a copied page. That night somebody signed in to the real portal and changed her mobile number. The nightly sync passed the new number to our identity system. The next morning the attacker reset her password with a code sent to their own phone, and signed in to her email and our remote access service.
They were inside for about two hours before an alert fired on a sign in from another country.
Nobody had attacked our password reset, our second factor or our identity system. Each of them worked exactly as designed. The weak point was a field in a portal with a single password, which we had quietly turned into a credential by wiring it into authentication.
The portal now signs in through single sign on with a second factor, and that integration cost less than the incident. The mobile number in HR is no longer used for authentication at all. Reset methods are registered directly in the identity system, and changing one requires signing in with an existing method first. Any change of reset method sends a notice to the old number and the work email, and a reset in the following twenty four hours is blocked unless the service desk confirms it with the person by video call.
Any data that can reset a password is a password, wherever it happens to be edited. We had protected the lock and left a spare key in a drawer marked payslips.
– Serguey Shinder
