Access Denied (eventually)

Access Denied (eventually)

Speakers: Ioan Constantin, Cyber Security Expert, Orange România

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=0Ri3vJN0AfI

Overview

In a candid and insightful presentation at DefCamp, Ioan Constantin, a Cyber Security Expert at Orange România, shared a detailed post-mortem analysis of a significant data breach that impacted the telecommunications giant in February 2024. Titled "Access Denied (eventually)," the talk provided an unvarnished account of what happened, what worked, what didn't, and, most importantly, the profound lessons learned. This isn't just a technical summary; it's a testament to the resilience of a large enterprise facing a real-world cyber attack and its commitment to transparency and continuous improvement.

Constantin, with 20 years of experience in cybersecurity, emphasized the importance of sharing these experiences with the community, not as a "mea culpa" but as a collaborative learning opportunity. The core message revolved around the fact that while a data breach occurred, Orange România's critical services remained unaffected, maintaining all Service Level Agreements (SLAs). This distinction, often lost in the immediate aftermath of an incident, was a crucial point highlighted by the speaker, underscoring the success of their incident response in protecting core operations despite data exfiltration.

The talk serves as a vital resource for any organization, regardless of size, grappling with the complexities of cybersecurity in an ever-evolving threat landscape. It meticulously dissects the technical vulnerabilities, the human element, and the organizational processes that were both challenged and strengthened by the incident. From the initial notification by a journalist to the multi-channel communication strategy implemented post-breach, Constantin provided a comprehensive blueprint for turning a crisis into a catalyst for significant security enhancements.

Background

▶ Watch: Introduction and talk agenda (0:00)

The incident began to unfold in February 2024 when Orange Group was notified by a respected tech journalist about claims from an unknown group possessing approximately 6 to 7 gigabytes of files allegedly exfiltrated from an Orange Romania system. This notification, received by Constantin's boss on a quiet evening, triggered an immediate and extensive internal investigation. The breach was confirmed on February 24th, 2024, the same day the malicious actor posted an archive of the leaked data on breach forums.

The root cause of the breach stemmed from several critical security oversights concerning a Jira instance exposed to the internet. This instance, a production system, was not adequately secured. Key vulnerabilities included the use of local accounts that were not managed under Orange Romania's broader federated password policies. Consequently, these accounts lacked the stringent password complexity and rotation requirements enforced across other corporate systems. Furthermore, the Jira instance was running an outdated version, which critically did not support Multi-Factor Authentication (MFA) for its local accounts, leaving a significant authentication gap.

The initial compromise vector was identified as an infostealer deployed on a personal device belonging to a legitimate user of the vulnerable Jira instance. This infostealer successfully collected active credentials, which the attackers then used to gain unauthorized access. The lack of rigorous enforcement and auditing of existing technical controls on this specific Jira instance, coupled with a pervasive "comfort with exceptions" among some technical users, created the perfect storm for the breach. This scenario highlights a common challenge in large enterprises: balancing operational flexibility with consistent security posture, especially for systems perceived as less critical or those managed outside standard corporate governance.

Key Findings

▶ Watch: Services unaffected, only a data breach (5:00)

The investigation revealed that the malicious actor successfully exfiltrated just over 7 gigabytes of data, comprising more than 12,000 files, from the compromised Jira instance. This data, which included records for some of Orange Romania's B2B and B2C customers, was subsequently published on online breach forums. The attack was mapped against the MITRE ATT&CK framework, providing a structured understanding of the adversary's tactics and techniques.

Crucially, the speaker stressed what didn't happen, which was as important as what did. At no point were Orange Romania's telecommunication services affected; all SLAs were maintained, and customer voice and data communications remained operational. This was a data breach, not a service disruption. The attackers gained no file system access to the Jira instance, operating entirely within the userland through the web interface and the Jira API. There was no encryption of data (e.g., ransomware or cryptolockers), no lateral movement to other production networks, and no Remote Code Execution (RCE). Consequently, no implants, persistence mechanisms, or backdoors were established, and the integrity of the data was not compromised. Constantin humorously noted that the attackers effectively provided "an online backup" of the Jira instance, albeit an unwelcome one.

The incident response, though triggered by a breach, showcased several strengths. A cross-functional team involving technology, IT, business, information security, legal, and communications departments quickly formed war rooms. This collaborative effort, described as "teamwork not like this, but like this," was vital for swift coordination, mitigation, and communication. Orange Romania also engaged in excellent collaboration with national authorities, specifically thanking the DNSC (National Cyber Security Directorate) for their support. The business and communication teams were particularly effective in translating technical findings into clear, actionable information for stakeholders and affected customers, demonstrating the value of non-technical roles in crisis management. Formal notification to national authorities and adherence to incident processes were also executed effectively, confirming that established procedures, though not flawless, ultimately worked under pressure.

Technical Deep Dive

▶ Watch: Effective incident response and teamwork (10:00)

The technical details of the breach, mapped to the MITRE ATT&CK framework, illustrate a straightforward yet effective attack chain that capitalized on fundamental security hygiene gaps.

Initial Access:

• T1078 (Valid Accounts): The primary vector was the Jira instance being exposed directly to the internet. While not an inherent vulnerability of Jira itself, its internet-facing posture without sufficient compensating controls was a critical enabler.
• T1589 (Drive-by Compromise): The attacker acquired active credentials for a legitimate Jira user. This was achieved through an infostealer deployed on the user's personal device, highlighting the risk posed by employees using personal equipment to access corporate resources, even indirectly.

Execution & Persistence (or lack thereof):

The speaker explicitly stated that the attackers did not achieve Remote Code Execution (RCE), file system access, or establish any persistence mechanisms like implants or backdoors. Their interaction was limited to the application layer.

Collection & Exfiltration:

• T1119 (Automated Collection): Once authenticated, the attackers leveraged the Jira API. This API, typically used by legitimate users and integrations for pushing and pulling data, was exploited to systematically collect the desired information.
• T1048 (Exfiltration Over Unencrypted/Obfuscated Channel): The collected data, totaling approximately 7 GB across 12,000+ files, was then exfiltrated. Given the nature of API interaction, this would likely have occurred over standard web protocols.

Vulnerabilities and Weaknesses:

Several specific technical and process-related vulnerabilities contributed to the breach:

1. Internet Exposure: The Jira instance was directly accessible from the internet, increasing its attack surface.
2. Local Account Management: The instance used local accounts that were explicitly not under the purview of Orange Romania's federated identity and access management systems. This meant they bypassed corporate password policies (e.g., complexity, rotation requirements).
3. Outdated Software: The Jira version in use was outdated. While not the direct cause of the breach, its age meant it did not support MFA for local accounts. This critical deficiency allowed the stolen credentials to be used without a second factor.
4. Control Enforcement Gaps: The enforcement and audit of technical controls for this specific Jira instance were not sufficiently rigorous. It was treated as an "exception" to standard security policies, demonstrating how a single point of failure in policy application can undermine overall security.
5. Lack of Security Awareness: A broader issue of security awareness, particularly among technical users, led to comfort with "exceptions" to security controls. The speaker highlighted the risk of technical personnel believing they are exempt from certain controls due to their "in-the-know" status, which proved detrimental in this scenario.

The isolation of the Jira instance from other production networks was a critical control that did work, preventing the attackers from performing lateral movement and expanding their foothold within Orange Romania's broader infrastructure. This containment measure limited the scope of the breach to the specific Jira instance and its data.

Demo / Proof of Concept

▶ Watch: Unenforced controls and user awareness gaps (14:00)

This talk was a retrospective analysis of a real-world incident rather than a demonstration of a specific exploit or proof-of-concept. Speaker Ioan Constantin focused on sharing lessons learned from Orange Romania's experience, providing insights into the breach's mechanics and the subsequent improvements. There was no live demonstration of the infostealer, Jira API exploitation, or any other technical attack vector.

Defensive Implications

▶ Watch: Q&A: Company's threat hunting capabilities (45:30)

The Orange Romania breach provided a stark reminder of fundamental security principles and catalyzed significant changes, offering actionable insights for defenders:

1. Robust Data Policies and Minimization: Organizations must ensure data policies are in place, audited, and respected. This includes knowing precisely what data is stored, minimizing volumes, and critically questioning the necessity of data storage across all platforms (on-premises or cloud). "Do I need to have this data?" should be a continuous question.

1. Advanced Anomaly Detection: Relying solely on signature-based or policy-driven security is insufficient. Investing in anomaly detection capabilities, particularly on the network side, is crucial to identify "unknown unknowns" and potential zero-day exploits. This pushes defenses beyond reactive measures.

1. Strict Privileged Access Management (PAM) and MFA: All privileged users and their access to platforms, even internal ones, must be rigorously managed and audited. Multi-Factor Authentication (MFA) should be implemented everywhere, including internal applications, to prevent credential theft from leading directly to access.

1. Web Application Firewalls (WAFs): For any internet-exposed application, a Web Application Firewall (WAF) is a non-negotiable security layer. WAFs, whether open-source or commercial, provide an essential barrier against common web-based attacks.

1. Continuous Password Policy Overhaul and Education: Passwords remain a critical control. Policies must be continuously updated, and users must understand why these policies exist. Education should move beyond generic advice to explain the rationale behind security measures.

1. Proactive Forensics and Threat Hunting: Organizations need established forensics procedures, including isolating affected instances, creating snapshots for investigation, and preserving evidence. Implementing automated data leak monitoring is essential to track exfiltrated data and proactively notify affected parties.

1. Regular Penetration Testing and Vulnerability Management: Penetration testing (both internal and external) is vital to understand how vulnerabilities can be exploited in practice, enabling more efficient risk management. Vulnerability management must be an ongoing process, involving all relevant stakeholders, moving beyond mere audit reporting to active remediation.

1. Comprehensive Communication Strategy: In the event of a breach, a multi-channel communication strategy is paramount. This includes internal communications (board, CEO, management, technical teams), external communications (customers, authorities), and a proactive approach using tools like CRM integration to track customer notifications. Dedicated mini-sites and training for frontline staff are also critical.

1. Strong Collaboration with Authorities and Partners: Rapid and transparent collaboration with national authorities (e.g., DNSC in Romania) and group partners is essential. Proactive notification and information sharing build trust and facilitate a coordinated response.

1. Targeted Security Awareness Training: Generic annual training is not enough. Security awareness must be focused and relevant to specific threats and systems. For example, educating users on the risks of using personal devices for corporate access or understanding the purpose and security implications of specific applications like Jira.

1. Translating Policy to Practice: Security policies must be backed by technical controls that are implemented, monitored, and regularly reviewed. Establishing a minimum security requirements baseline for all devices, applications, and users ensures a consistent security posture. Controls that are no longer relevant must be deprecated to avoid unnecessary complexity.

1. Risk-Based Prioritization: Organizations should shift from low-risk analysis to focusing on actions that could lead to impactful incidents. Prioritizing decisions based on actual risk, rather than generic compliance, ensures resources are directed where they matter most. For example, focusing on how data is stored and who has access, rather than just its classification.

1. Critical System Upgrades: While costly, regular upgrades for critical systems are non-negotiable. They not only patch known vulnerabilities but also introduce new security features and processes that enhance overall resilience.

Ultimately, the overarching defensive implication is that security is everyone's job. This needs to be ingrained in the company culture, fostering collaboration across departments and turning incidents into opportunities for growth and improvement.

Key Takeaways

• Proactive Incident Response and Cross-Functional Collaboration are Paramount: The Orange Romania breach highlighted the critical role of swift, coordinated action involving diverse teams (IT, legal, communications, business) and external partners (national authorities) in containing damage and managing stakeholder expectations.
• Rigorous Enforcement of Security Controls is Non-Negotiable: The incident underscored that "exceptions" to security policies, particularly for critical systems like Jira, create significant vulnerabilities. Consistent application, auditing, and management of controls, including MFA, are essential.
• Comprehensive and Targeted Security Awareness Training is Crucial: Generic training often falls short. Awareness campaigns must be specific, addressing the why behind security rules and the risks associated with actions like using personal devices for corporate access, especially for technical staff.
• Prioritize Security Investments Based on Actual Impact Risk: Organizations should move away from low-risk analysis and focus resources on mitigating threats that could lead to truly impactful incidents. This includes investing in PAM, WAFs, anomaly detection, and ensuring critical system upgrades.
• Translate Security Policies into Actionable, Monitored Technical Controls: Policies on paper are insufficient. They must be backed by implemented, tested, and continuously monitored technical controls. Regular review and deprecation of outdated controls are vital for an efficient security posture.
• Transparency and Timely Communication Build Trust: Proactive, multi-channel communication with all stakeholders—internal teams, customers, and regulatory bodies—is crucial during a breach. This transparency, facilitated by tools like CRM integration, helps manage reputational damage and fulfills legal obligations.

About the Speaker(s)

Ioan Constantin is a seasoned Cyber Security Expert with Orange România. He brings approximately 20 years of experience in the cybersecurity field, nearly half of which has been with Orange. His primary role involves R&D in cybersecurity, but he also serves as a critical responder, often called upon when the company faces significant security incidents. Constantin's extensive practical experience, particularly in navigating complex enterprise security challenges, makes him a credible voice in discussing real-world breach scenarios and the practical lessons learned.