March 26, 2024

Risky Business: How HR Tech Can Hurt Identity Security

SHUYANG WANG AND FARAH IYER

In today’s digital-first world, individuals are bringing B2C behaviors into the B2B sphere. Just as someone might casually share personal login details with platforms like Turbotax for tax filing, many are now sharing corporate credentials with third-party providers, for various personal and professional tasks, compromising identity security.

Moreover, a recent investigation by Obsidian’s Threat Research team has shed light on the risks associated with this trend. They detected a critical risk associated with Argyle—a service that facilitates employment and income verification and payroll management by integrating with HR Management (HRM) systems through credential flow.

‍

Why it matters

Argyle’s service presents a significant risk to organizations due to its insecure integration via credential flow. If compromised, this integration provides an uncontrolled pathway for accessing sensitive data, thereby undermining identity security.

HRM system powered by Argyle.

From Obsidian’s investigation thus far, this Argyle risk affects over 800 G2000 companies and numerous others through their HRM systems and Identity Providers (IdPs).

‍

Investigation overview

Obsidian’s Threat Security Research team observed the following suspicious sequence of events across multiple tenants:

  1. An unknown identity is authenticated through an employee’s Identity Provider (IdP) account via anonymous proxy infrastructure with Multi-Factor Authentication (MFA) approval.
  2. Following authentication, the identity employed Single Sign-On (SSO) to gain access to the company’s Human Resource Management (HRM) system, which may have included platforms like Workday and PeopleSoft.
  3. Our telemetry data reveals that within the HRM system, the identity traversed sensitive employment and income information and, in some instances, altered payment elections.

This activity resembles common identity threats, such as gaining initial access through an access broker or carrying out complete payroll theft following an account takeover.

‍

The suspicious identity authenticated through the IdP (via proxy IP) and then employed SSO to access Workday.
The identity was observed modifying payment elections.

‍

The suspicious activity illustrated above was traced back to Argyle. Below, we have outlined how this activity unfolded, starting with the employee entering their corporate credentials into a third-party site, through to Argyle gaining access to both the IdP and HRM service.

‍

‍

Security implications

Although there hasn’t been any observed exploitation, the integration facilitated by Argyle raises various security concerns around identity risks. These include:

‍

Blast radius

A variety of HRM services and IdP solutions are implicated by this risk due to their integration with Argyle.

IdPs:

‍

What should I do to protect my organization?

Unlike the classic identity threat via account takeover, individuals willingly engage in these processes, making self-reporting unlikely. Even strong MFA based on WebAuthN may fall short if weaker methods like SMS or TOTP are allowed to be downgraded. Therefore, continuous monitoring of corporate identity threats becomes paramount to detect and mitigate risks.

‍

Obsidian recommended actions

To enhance security and mitigate risks, we recommend taking the following actions:

1. Deploy Obsidian’s new detection rule:

2. Review audit logs:

3. Identify and take action for exposed accounts:

‍

What identity risks should vendors look out for when implementing 3rd party services?

There’s no denying the value provided by tools that automate traditionally manual processes like employment and income verification. However, as this identity risk scenario highlights, services must undergo careful assessment to safeguard your organization’s security.

OAuth addresses these needs by authorizing access to user-owned resources without exposing credentials to third parties.

Moreover, secure integration should adhere to the principle of least privilege, requesting only essential information for validation (e.g., employment or income status). It should avoid accessing sensitive data such as pay slips or W2 forms. Our examination of HRM systems revealed challenges in meeting these requirements due to the broad access permissions available, sometimes limited to read/write access across all resources.

‍

Appendix (indicators of compromise)

Identified IP addresses:

Most incoming traffic originates from proxy providers. Notable IP addresses observed over the past month include:

User agent strings:

The user agent string linked to the activity may vary over time but frequently repeats:

‍

‍

Get Started

Start in minutes and secure your critical SaaS applications with continuous monitoring and data-driven insights.

get a demo