19 ms·

Uber investigating breach of its computer systems

591 points by arkadiyt 4y ago

arkadiyt 4y ago
Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems
- bombcar 4y ago
  Someone forgot the “and then watch that basket” part about putting all your eggs in one.
- gnu8 4y ago
  > - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic This is gross incompetence.
- toomuchtodo 4y ago
  Thycotic and Centrify have been rolled up into Delinea fwiw. https://delinea.com/ https://delinea.com/
  - gnu8 4y ago
    It's just multiuser keepass with integrations for active directory and such. It's not surprising that three startups building the same thing would realize they could merge and charge 10x the price they could get if they were competing. Since Delinea's rep just took a hit (due to customer error), there is easily room for two or three new players in this space.
- galacticaactual 4y ago
  Thoroughly basic and preventable attack.
- Shank 4y ago
  > - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it's behind a VPN, because you now have to hope and pray all of your VPN users aren't bribable, aren't morally bankrupt, aren't disgruntled, etc. The same thing could have happened via insider from the lowest level of employee with VPN access if that report is true.
  - hardnose 4y ago
    Ding ding ding. This whole incident is symptomatic of eggshell security - crunchy exterior with a delicious gooey inside once you break through it. Hedgehogs dont have this problem.
  - staticassertion 4y ago
    People who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.
    - Shank 4y ago
      I was recently on a call with someone who said their company was "totally zero-trust" because they disabled copy & paste on all workstations. I definitely believe in the concept, but it's definitely turning into a parroted term that's applied to anything.
    - jjav 4y ago
      > People who call ZTN a meme are usually just ignorant. It's become a "meme" because it is used in endless irrelevant ways. So many companies are pushing zero-trust solutions that don't have anything to do with the basic idea of requiring access control at every endpoint. Also, while it is a very sound practice, there's also the hyped idea that it replaces everything else. Which is not very wise. You still want defense in depth over and above requiring acess control everywhere.
- colemannugent 4y ago
  >scan their intranet and find a network share Did their IDS/IPS not go off on this? I wonder if this was a sophisticated scan designed to go slow and evade detection or if it was just nmap lol I can't wait for the post-mortem, hopefully lots of good lessons to learn.
  - judge2020 4y ago
    >scan their intranet and find a network share Assuming screenshot is real[0], they have over 1PB in their Google Drive, so chances are everyone just uses Google Drive with shared drives, and employees use Drive for Desktop (previously drive file stream)[1]. Shared drives are pretty powerful and access to them can be gated at the same level as you can regular Drive files. My theory is that some high-level IT person either got phished and didn't have hardware 2fa, or that high-level IT person downloaded malware / got RAT'd and the Google Drive scanning was done in the background on their machine. Depending on the hierarchy, it might not have even been a scan, could've been the attackers sating their curiosity by browsing through all their internal files and happening to find some PAM credentials. 0: https://twitter.com/praise_terryd/status/1570583105123258369?s=20 https://twitter.com/praise_terryd/status/1570583105123258369... 1: https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cwindows https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cw...
  - dx034 4y ago
    Maybe just clicking around until they found something. That's what many employees do on a daily basis looking for files on network drives, so nothing that would be noticed easily.
- marcinzm 4y ago
  >Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Even using certificate based authentication for VPN along with their existing MFA would have prevented this. Unless the attacker compromised the employee's laptop in which case nothing would stop that.
- AtNightWeCode 4y ago
  Assume breach. I just hate it when you can access anything on networks just cause you are logged on to it.
throwoutway 4y ago
Pour one out for our fellow sys admins & security teams that are going to be working late into the night. They took down their Slack so I wonder what out-of-band comma they’re using. EDIT: Comms not comma. I'll leave the typo because I LOVE bombcar's comment about the semicolon. Confused at first, but I smiled
- pm90 4y ago
  Yup, gonna be a rough night for all involved.
- bombcar 4y ago
  Probably a semicolon! (I’d assume going to text messaging to set something up, which is why you should know enough about your immediate coworkers to verify their identity via non-public information.)
  - gnu8 4y ago
    A reasonably sophisticated attacker could arrange for the entire team to get SIM-swapped and suspended from Facebook when they launch an attack. If only there were some way to have a central rallying point for everyone to meet at. Perhaps some sort of a structure, with the company's name on it, and it would have places to sit inside, with computers connected to the company's infrastructure to use.
    - bombcar 4y ago
      In the old days you’d have physical restrictions on access to the datacenter - in a major breach you’d get there physically and shut it down and disconnect it. With everything cloud now, how do you recover your cloud account of the master got compromised?
      - fjfbsufhdvfy 4y ago
        That's the fun part, you don't!
      - 4y ago
sullivanmatt 4y ago
I think it's worth repeating: at this point, MFA that is not based on Webauthn (https://webauthn.guide/#about-webauthn https://webauthn.guide/#about-webauthn) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus campaign, a sufficiently-skilled attacker will simply proxy the MFA calls to the real identity provider in real-time, the user none the wiser. Webauthn, however, binds the authenticator to the domain and port, and requires https as the scheme. If a user gets phished, they cannot be compromised: the phisher's domain will not match and any Webauthn authentication challenge would fail. So if your workplace is letting you authenticate with SMS codes, push notifications to an app, or 6-digit codes generated by an authenticator app/hardware device, you need to start banging on pots and pans up your reporting chain to get your security team the support they need to make Webauthn + FIDO2 hardware tokens or Webauthn + Mac Touch ID happen.
- saagarjha 4y ago
  I would be shocked if they didn’t issue all employees YubiKeys.
  - bombcar 4y ago
    I my experience, prepare to be shocked. And even if they do, they likely have a “backup” for people who never seem to be able to use the Yubikey right.
  - pm90 4y ago
    - metadat 4y ago
      This is false, a gross oversimplification. Every organization has complexities, it doesn't reduce to a common idiocy. Even when the net result is idiotic in hindsight.
cddotdotslash 4y ago
They could be fake, of course, but this thread[1] of screenshots is pretty bad... internal tools, Slack Admin, Google Workspace admin, an AWS account showing admin permissions. [1] https://twitter.com/Savitar0x01/status/1570580235716014081 https://twitter.com/Savitar0x01/status/1570580235716014081
- bombcar 4y ago
  This is where all the secondary hackers will come into play - I expect to get “new uber signup” random texts later tonight.
- jtchang 4y ago
  Those screenshots look pretty convincing to me.
- dx034 4y ago
  And as other people have already written, that's the main issue. Not that someone got compromised, but that passwords for admin accounts to all those services were stored on a network share.
  - lbriner 4y ago
    What happens is that as a company scales to this sort of size, all kinds of shortcuts are made, all kinds of compromise decisions are made because there is still little non-financial cost for getting it wrong. Imagine deciding to add some extra floors to your office made from cardboard because, "we are scaling too quickly to build them out of concrete". Wouldn't happen. Why? The legal and marketing fallout would be fatal. In the corporate world, especially in ones at the extreme levels of inefficiency/size/etc. it is easy just to blame the previous job holder, the previous culture, "we have made improvements since then" etc. as if that makes it alright. tbf, we also see this in Healthcare and Government so I think it is Human Nature rather than corporate greed.
  - marcinzm 4y ago
    Security is like an onion and in this case every layer was rotten. * Social engineering successfully got someone * MFA approach did not protect from a simple fake webpage tunneling hack * VPN was based on a password rather than a certificate * Network scan was not detected and stopped * High level credentials were stored in a public file and not detected * Abnormal credential usage was not detected and stopped I probably missed a few but point there were many ways to stop this hack and all of them were broken. This wasn't some highly funded government operation that bypassed layers through clever approaches and expensive zero-day exploits.
metadat 4y ago
Archive links: https://archive.ph/DttLG https://archive.ph/DttLG https://web.archive.org/web/20220916011028/https://www.nytimes.com/2022/09/15/technology/uber-hacking-breach.html https://web.archive.org/web/20220916011028/https://www.nytim...
- josu 4y ago
  Working archive link: https://archive.ph/rBRmn https://archive.ph/rBRmn
deleted 4y ago
[deleted]
ghuntley 4y ago
> "Feel free to share but please don’t credit me: > at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a > website, I am taken to a REDACTED page with a > pornographic image and the message “F** you wankers.” From: https://twitter.com/samwcyo/status/1570583182726266883 https://twitter.com/samwcyo/status/1570583182726266883
- FeistySkink 4y ago
  I see somebody else got hit with a cancellation fee and took it personally.
- hotpotamus 4y ago
  Ah, an old fashioned troll/artist rather than someone who just wants to make money with ransomware. How refreshing.
  - yellow_lead 4y ago
    We need more LulzSec
- paxys 4y ago
  > at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a How does an employee know if that message is legitimate or not? If you break into a secure system, mass-emailing all employees saying "URGENT: WE HAVE BEEN HACKED. PLEASE EMAIL YOUR PASSWORD AND SSN TO THIS ADDRESS IMMEDIATELY." is sure to get some percentage of success.
  - bombcar 4y ago
    In general you can trust a “stop doing the thing” email blast that appears legitimate but should be highly suspicious of the same asking you to do the thing.
  - cddotdotslash 4y ago
    It does make me wonder whether we’re headed towards some kind of “breach via chaos” scenario. Clearly the attackers have the cell phone numbers of employees. Suppose they started mass texting conflicting information? It’d be noisy as hell, but take 1000s of employees getting a never ending stream of texts, purporting to be from their employer, saying “don’t use Slack,” “don’t use email,” “here’s a Zoom bridge for incident response,” “oh and here’s an MFA notification you should accept.” This could lead to a scenario where no one knows what to believe, internal systems are down, attackers are setting up fake IR channels to get even more info, etc. There’s no way most companies could weather an onslaught like that.
harry8 4y ago
Think about all that information you trusted uber with because now you're trusting organised crime. You /have/ to treat uber and the like as though they are organised crime even if you think they are and will always be in league with rainbows, fairies and unicorns will never put your interests behind theirs. edit: wave to uber's PR flunkies.
- rodgerd 4y ago
  Given that Uber routinely tracked politicians and journos and shared it around the company, and had stood up toolsets to track and evade police so as to facilitate drivers dodging law enforcement, they always were organised crime.
  - tpxl 4y ago
    > evade police so as to facilitate drivers dodging law enforcement Isn't this illegal as fuck?
    - Nextgrid 4y ago
      The law doesn't apply if you're a big company.
    - anarticle 4y ago
      It's only illegal if you get caught! :D This was part of Uber's early strategy when cities responded with citing drivers of rideshare services. At this point, I've seen a rideshare stop in the center of an intersection with traffic to let people out, so maybe the cities were right in the end...
    - rodgerd 4y ago
      Most of the high-profile "tech startups" are mired in "doing illegal shit quicker than you get caught, with computers".
- judge2020 4y ago
  Eh, based on the screenshots and claim that they're doing some trolling, it might be a teen or small group of hackers that happened to gain such a wealth of data and their first instinct is to "download all the data, we'll figure out how to sell it later". If they had shopped around for a nation state buyer this certainly would've been more covert and a bigger hack.
kaesar14 4y ago
Forgive me for being frank, but how do people seriously fall for phishing scams? How do you work at a company like Uber and do something like click on a link in an email to claim a gift card? It’s insane to me.
- metadat 4y ago
  Not everyone is paranoid and jaded. It's pointless to judge the stupid ones. Bottom line is Uber got pwned, and the dirty laundry is now out in the open for all to see and inspect. Tomorrow it'll be for sale on the darkweb.
  - kaesar14 4y ago
    If the theory posted elsewhere in this thread is true there was definitely gross negligence elsewhere in the security chain so it’s not the fault of that one person for sure.
  - kirbys-memeteam 4y ago
    “Paranoid and jaded” is reading as “not stupid” to me here.
- Undertow_ 4y ago
  everyone is susceptible to it,,, everyone
  - spoils19 4y ago
    We don't run internal honeypots and no one has ever been caught in our company, so I disagree. And yes, a reply may be "That you know of...", but considering that we run weekly audits and nothing has leaked, I can be 100% sure of it.
    - cyral 4y ago
      Do you really know for sure though? That is what keeps me up at night. The irony is that one of the leaked screenshots is of an internal security auditing/monitoring tool.
fjfbsufhdvfy 4y ago
Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?
- Kalium 4y ago
  The thing about security is that it's perfectly fine to not have it most days. Suddenly, all at once, it's not fine at all. A very large company has an exceptionally bad time and a lot of people are affected. Small startups and businesses can absolutely get it right. It's usually much easier, with a small number of people and systems involved. You just have to approach it knowing it will take work every day. Some things will be harder than you want them to be. It will be worth it to avoid this kind of stuff.
- julianlam 4y ago
  You'll always have one extra layer of security that those companies can't buy... obscurity. Just don't rely on only that layer, and watch out for oddly quiet individuals named Sam Sepiol.
- hotpotamus 4y ago
  You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no security at all, but in the back of my mind, I think it might be the best thing I've got going for me working at a small place. Though I should say, that's far from being our only security - we do work at it too.
  - _Adam 4y ago
    The best approach is to assume there's a renegade employee constantly trying to screw the company over. Granularity of permissions should be set to minimize the blast radius to the absolute minimum they need to do their job.
beardedwizard 4y ago
(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here.
- sullivanmatt 4y ago
  [removed by author]
  - beardedwizard 4y ago
    Fair play.
- dogecoinbase 4y ago
  > Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here. Is remaining in a role in which it's not possible to be effective negligent?
  - beardedwizard 4y ago
    What is your alternative? Should we do nothing instead? Should all SWEs quit because they can't stop writing security bugs?
    - dogecoinbase 4y ago
      I don't have a specific alternative, but I think that if it's not possible to be effective in a role, one should decline it. It's possible to be an effective SWE while still writing (and hopefully also sometimes fixing) bugs.
      - 4y ago
vittygreen 4y ago
The other thing of note with this is timing as yesterday an ex attorney testified against the ex security chief for the 2016 breach cover up. And the next day there is this breach. So based on the damaging nature of the testimony where further discovery could be needed it seems a bit too convenient to have a breach the next day. So is it possible this is a fake breach in order to scrub further damaging evidence of others involved in the original 2016 cover up? Something to think about plus the notice seemed to go up in record speed.
- encryptluks2 4y ago
  I actually really like this theory and it does sound like a possible explanation. I used to know quite a few ex-Uber techs and I wouldn't put it past their ethics to do so.
  - vittygreen 4y ago
    Looking at the screen shots that could be just to help support it, but sole of those look like the security techs screen shots by looking at the names on the logins but that too can be viewed as questionable evidence given the context and using this theory as the pov when analyzing the "evidence"
- alldayeveryday 4y ago
  > So is it possible this is a fake breach in order to scrub further damaging evidence of others involved in the original 2016 cover up? Can you elaborate what scrub means in this context? In what ways would this breach cover up the 2016 breach? Would the prosecutors suddenly lose their memory of the 2016 breach? Would evidence suddenly go missing?
  - vittygreen 4y ago
    By locking out your company and chat mediums you can search and purge evidence or artifacts in hopes to not expose further corruption or others involved in the past one. While treating it as a real threat to feds and public. In the org cover up they hired the attackers as employees with modified NDAs as per the testimony given on the 14th. So with that info I wouldn't put it past them as will as the ftc passing gig worker protections which would also financially impact uber on top of the lawsuits that will come out of the 2016 breach cover up. So with those factors and their history this could be used as a cost savings measure in a way to limit the money they are going to pay out in both areas. So with the testimony it would in theory open discovery for new evidence which this could prevent if used as a clean up job for lack of a better term.
cryptozeus 4y ago
Wife has been locked out since afternoon! This is a bad one, she tried accessing internal doc…got redirected to dick pick
- nottorp 4y ago
  That's not bad. Bad is if my credit card that's in Uber starts showing interesting charges...
vimda 4y ago
Interesting timing, and good comms at a time when their former CISO is currently undergoing trial for not disclosing a previous incident
_8j50 4y ago
Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powershell script on a network share. A cheap pentest would have uncovered something like that. Modern security is not perimeter focused where you try to keep the bad guys out. Yes, you should do MFA,firewalls,vpns the whole schtick but(!!) your presumption should always be that threat actors already have a foot-hold in your network. This is very important because it helps you focus on basic things like scripts and gpos with creds in them but also you treat internal devices the same as internet exposed devices. It's sort of what the whole "zero trust" thing is about as well. In other words, host/user compromise is a given but lateral movement should be at least as difficult as breaching the perimeter. But my prediction is, just like top commenters here, they will slap MFA on it and of course cleanup scripts with creds and call it fixed until the next compromise. Oh and FYI, MFA on VPNs is a PITA, that's rarely done for good reason, instead you use device certificates in addition to passwords which is what the recommendation should be not yubikeys or webauthn (vpn!=web??) because VPNs need to reconnect and you can't have people insert a yubi each time their connection drops. Ideal setup would have 7 day valid (or however long is reasonable for users to disconnect their PC and remain out of office) mutual-auth certs+ocsp getting conditionally reissued new certs to remain connected (compliance stuff like patching, unapporoved software,security alerts for the device). If you think about it, you typically issue users two yubikeys not just one so if the backup gets stolen you have a problem depending on how easy it is to social engineer users or reset their password with a good yubikey but a stolen laptop means certs+password revoked immediately.
- philliphaydon 4y ago
  There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…
  - vanshg 4y ago
kuraudo 4y ago
I heard from a security friend that their sentinel one endpoint detection got popped and the hacker posted screenshots of thousands of unaddressed security alerts in the dashboard. Can anyone confirm? I'm still looking for the proof.
- mcintyre1994 4y ago
  Maybe referring to this image? https://twitter.com/vxunderground/status/1570597582417821703/photo/3 https://twitter.com/vxunderground/status/1570597582417821703... (3rd photo if it doesn't open)
piyushpr134 4y ago
Perimeter based security must die for people to stop doing insecure data sharing. Concept of VPN based lan in this remote work kind of setup is highly insecure and open to all kinds of abuse. In fact it was always insecure I would say. All you need is wifi password and you have tonnes of super sensitive information on windows shares
belter 4y ago
"Uber reels from 'security incident’ in which cloud systems seemingly hijacked" - https://www.theregister.com/2022/09/16/uber_security_incident/ https://www.theregister.com/2022/09/16/uber_security_inciden... "We're told that an employee was socially engineered by the attacker to gain access to Uber's VPN, through which the intruder scanned the network, found a PowerShell script containing the hardcoded credentials for an administrator user in Thycotic, which were then used to unlock access to all of Uber's internal cloud and software-as-a-service resources, among other things. After that, everything was at the intruder's fingertips, allegedly. The New York Times reported that Uber staff were told to stop using the corporate Slack, and that the call to quit the chat app came after the intruder sent a message declaring: “I announce I am a hacker and Uber has suffered a data breach.” The Times stated the Slack message listed “several internal databases that the hacker claimed had been compromised.” Various corporate systems have now been shut down by Uber." ""Instead of doing anything, a good portion of the staff was interacting and mocking the hacker thinking someone was playing a joke," Curry said. "After being told to stop going on slack, people kept going on for the jokes." Evidence of that misunderstanding has surfaced on Twitter in the form of a screenshot of Uber's private Slack workspace." The message: https://nitter.net/vxunderground/status/1570626503947485188 https://nitter.net/vxunderground/status/1570626503947485188
junon 4y ago
Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at least when I was there, there was pretty good training on SE deterrence. Further, OneLogin was used, Yubikeys were phased out early on. I'd be surprised if they had brought them back, as I remember the security team being somewhat averse to them. I'm sure OneLogin is also investigating. The security team at Uber was quite good. Constantly under stress. Constantly overworked. The last thing they need are knowitalls speculating about how stupid they are on HN. Cut them some slack - this could happen to any company (yes, it could, even yours - don't try to convince me otherwise).
- vayne 4y ago
  - junon 4y ago
    You clearly don't understand how SE can be used even if Yubikey or WebAuthn are used here. Perhaps you'd like to explain instead of insult someone you know nothing about (which violates HN guidelines).
    - vayne 4y ago
      I get what you are saying now. Agree if the right actors are on it, all those doesn’t matter. Sorry about that.
    - reissbaker 4y ago
      I mean, "social engineering" is pretty broad; saying MFA can't stop social engineering is like saying password managers can't stop hacking, or HTTPS can't stop spying. I mean, sure... but Webauthn would have in fact stopped this type of social engineering attack (which was a fake login page). And scanning internal networks for hardcoded secrets would have stopped this type of privilege escalation afterwards. Security is never absolute, but we're not talking about a nation-state/APT attack here; current reports seem to indicate this was a bored 18 year old acting alone.
oblio 4y ago
This is bad :-(
deleted 4y ago
[deleted]
lumberjack24 4y ago
That hardcoded secret in the powershell script really was the key to the Uber ride-hailing kingdom – https://blog.gitguardian.com/uber-breach-2022 https://blog.gitguardian.com/uber-breach-2022.
zod50 4y ago
> sent a text message to an Uber worker claiming to be a corporate information technology person I'm confused. Was the hacker claiming to be an IT person or was it the Uber worker?
- cal85 4y ago
  The hacker
mcstempel 4y ago
The common thread in all of these recent attacks (Uber, Twilio, Okta, etc) is the “phishability” of the authentication methods involved. Remote attacks like this only work when you can socially engineer an employee and phish sensitive credentials like a password from them (or a SMS one-time passcode during the MFA step). What’s head-scratching to me is why tech-forward enterprises haven’t been faster to adopt unphishable forms of authentication like WebAuthn. WebAuthn supports both built-in device biometrics like FaceID/TouchID and external hardware keys (eg YubiKey), which are inherently incapable of being phished — there’s no text-based secret for an attacker to deceive a user into sharing with them. I’m biased as I run an identity and access management company (stytch.com), but I hope more companies will consider integrating WebAuthn to support unphishable MFA. Today, WebAuthn introduces some nuances that can discourage a B2C company from supporting it today (e.g. account recovery with lost devices), but it’s a clear win for corporate network/workplace authentication and B2B apps. I believe some of the lack of adoption is due to complexity to build (more complex than traditional MFA) and cost for off-the-shelf solutions (Incumbents like Auth0/Okta require ~$30k annual commitments to let developers use WebAuthn). If you decide to build with Stytch, WebAuthn is included in our pay-as-you-go plan (https://stytch.com/products/webauthn https://stytch.com/products/webauthn)
WirelessGigabit 4y ago
Our security just send around an email that they're disabling Google Chrome's password manager. While I understand not wanting those passwords in Google's hands, the reality is that they do have the $$$ for security. But instead of being able to leverage that functionality, and the Generate Password functionality we now have to resort back to name_of_application_my_name or something like that. Do not ban things just because it has an issue. Provide a better alternative.
- halz 4y ago
  When browser managed credentials are synchronized across devices, an attacker may be able to move laterally into an enterprise by compromising the personally managed device or personally managed account (since it may be without 2FA, or may use a shared/guessable/weak password thats shared across dozens of compromised websites, or be far behind on app/OS patches, etc..)
- kccqzy 4y ago
  Disabling a password manager that's built into a browser? That's simply madness. What do they expect people to use? Their brain to remember all their passwords rather than a password manager? And rely on their brain to know they are on a site whose domain doesn't match the domain in the password manager despite looking very similar? Also this has nothing to do with passwords in Google's hands. They could turn off syncing in Chrome and have a completely local password manager. I personally do exactly that. Your org will suffer many data breaches due to this policy.

591 points by arkadiyt 4y ago

Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems

bombcar 4y ago
Someone forgot the “and then watch that basket” part about putting all your eggs in one.
gnu8 4y ago
> - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic This is gross incompetence.
toomuchtodo 4y ago
Thycotic and Centrify have been rolled up into Delinea fwiw. https://delinea.com/ https://delinea.com/
- gnu8 4y ago
  It's just multiuser keepass with integrations for active directory and such. It's not surprising that three startups building the same thing would realize they could merge and charge 10x the price they could get if they were competing. Since Delinea's rep just took a hit (due to customer error), there is easily room for two or three new players in this space.
galacticaactual 4y ago
Thoroughly basic and preventable attack.
Shank 4y ago
> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it's behind a VPN, because you now have to hope and pray all of your VPN users aren't bribable, aren't morally bankrupt, aren't disgruntled, etc. The same thing could have happened via insider from the lowest level of employee with VPN access if that report is true.
- hardnose 4y ago
  Ding ding ding. This whole incident is symptomatic of eggshell security - crunchy exterior with a delicious gooey inside once you break through it. Hedgehogs dont have this problem.
- staticassertion 4y ago
  People who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.
  - Shank 4y ago
    I was recently on a call with someone who said their company was "totally zero-trust" because they disabled copy & paste on all workstations. I definitely believe in the concept, but it's definitely turning into a parroted term that's applied to anything.
  - jjav 4y ago
    > People who call ZTN a meme are usually just ignorant. It's become a "meme" because it is used in endless irrelevant ways. So many companies are pushing zero-trust solutions that don't have anything to do with the basic idea of requiring access control at every endpoint. Also, while it is a very sound practice, there's also the hyped idea that it replaces everything else. Which is not very wise. You still want defense in depth over and above requiring acess control everywhere.
colemannugent 4y ago
>scan their intranet and find a network share Did their IDS/IPS not go off on this? I wonder if this was a sophisticated scan designed to go slow and evade detection or if it was just nmap lol I can't wait for the post-mortem, hopefully lots of good lessons to learn.
- judge2020 4y ago
  >scan their intranet and find a network share Assuming screenshot is real[0], they have over 1PB in their Google Drive, so chances are everyone just uses Google Drive with shared drives, and employees use Drive for Desktop (previously drive file stream)[1]. Shared drives are pretty powerful and access to them can be gated at the same level as you can regular Drive files. My theory is that some high-level IT person either got phished and didn't have hardware 2fa, or that high-level IT person downloaded malware / got RAT'd and the Google Drive scanning was done in the background on their machine. Depending on the hierarchy, it might not have even been a scan, could've been the attackers sating their curiosity by browsing through all their internal files and happening to find some PAM credentials. 0: https://twitter.com/praise_terryd/status/1570583105123258369?s=20 https://twitter.com/praise_terryd/status/1570583105123258369... 1: https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cwindows https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cw...
- dx034 4y ago
  Maybe just clicking around until they found something. That's what many employees do on a daily basis looking for files on network drives, so nothing that would be noticed easily.
marcinzm 4y ago
>Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Even using certificate based authentication for VPN along with their existing MFA would have prevented this. Unless the attacker compromised the employee's laptop in which case nothing would stop that.
AtNightWeCode 4y ago
Assume breach. I just hate it when you can access anything on networks just cause you are logged on to it.

throwoutway 4y ago

Pour one out for our fellow sys admins & security teams that are going to be working late into the night. They took down their Slack so I wonder what out-of-band comma they’re using. EDIT: Comms not comma. I'll leave the typo because I LOVE bombcar's comment about the semicolon. Confused at first, but I smiled

pm90 4y ago
Yup, gonna be a rough night for all involved.
bombcar 4y ago
Probably a semicolon! (I’d assume going to text messaging to set something up, which is why you should know enough about your immediate coworkers to verify their identity via non-public information.)
- gnu8 4y ago
  A reasonably sophisticated attacker could arrange for the entire team to get SIM-swapped and suspended from Facebook when they launch an attack. If only there were some way to have a central rallying point for everyone to meet at. Perhaps some sort of a structure, with the company's name on it, and it would have places to sit inside, with computers connected to the company's infrastructure to use.
  - bombcar 4y ago
    In the old days you’d have physical restrictions on access to the datacenter - in a major breach you’d get there physically and shut it down and disconnect it. With everything cloud now, how do you recover your cloud account of the master got compromised?
    - fjfbsufhdvfy 4y ago
      That's the fun part, you don't!
    - 4y ago

sullivanmatt 4y ago

I think it's worth repeating: at this point, MFA that is not based on Webauthn (https://webauthn.guide/#about-webauthn https://webauthn.guide/#about-webauthn) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus campaign, a sufficiently-skilled attacker will simply proxy the MFA calls to the real identity provider in real-time, the user none the wiser. Webauthn, however, binds the authenticator to the domain and port, and requires https as the scheme. If a user gets phished, they cannot be compromised: the phisher's domain will not match and any Webauthn authentication challenge would fail. So if your workplace is letting you authenticate with SMS codes, push notifications to an app, or 6-digit codes generated by an authenticator app/hardware device, you need to start banging on pots and pans up your reporting chain to get your security team the support they need to make Webauthn + FIDO2 hardware tokens or Webauthn + Mac Touch ID happen.

saagarjha 4y ago
I would be shocked if they didn’t issue all employees YubiKeys.
- bombcar 4y ago
  I my experience, prepare to be shocked. And even if they do, they likely have a “backup” for people who never seem to be able to use the Yubikey right.
- pm90 4y ago
  - metadat 4y ago
    This is false, a gross oversimplification. Every organization has complexities, it doesn't reduce to a common idiocy. Even when the net result is idiotic in hindsight.

cddotdotslash 4y ago

They could be fake, of course, but this thread[1] of screenshots is pretty bad... internal tools, Slack Admin, Google Workspace admin, an AWS account showing admin permissions. [1] https://twitter.com/Savitar0x01/status/1570580235716014081 https://twitter.com/Savitar0x01/status/1570580235716014081

bombcar 4y ago
This is where all the secondary hackers will come into play - I expect to get “new uber signup” random texts later tonight.
jtchang 4y ago
Those screenshots look pretty convincing to me.
dx034 4y ago
And as other people have already written, that's the main issue. Not that someone got compromised, but that passwords for admin accounts to all those services were stored on a network share.
- lbriner 4y ago
  What happens is that as a company scales to this sort of size, all kinds of shortcuts are made, all kinds of compromise decisions are made because there is still little non-financial cost for getting it wrong. Imagine deciding to add some extra floors to your office made from cardboard because, "we are scaling too quickly to build them out of concrete". Wouldn't happen. Why? The legal and marketing fallout would be fatal. In the corporate world, especially in ones at the extreme levels of inefficiency/size/etc. it is easy just to blame the previous job holder, the previous culture, "we have made improvements since then" etc. as if that makes it alright. tbf, we also see this in Healthcare and Government so I think it is Human Nature rather than corporate greed.
- marcinzm 4y ago
  Security is like an onion and in this case every layer was rotten. * Social engineering successfully got someone * MFA approach did not protect from a simple fake webpage tunneling hack * VPN was based on a password rather than a certificate * Network scan was not detected and stopped * High level credentials were stored in a public file and not detected * Abnormal credential usage was not detected and stopped I probably missed a few but point there were many ways to stop this hack and all of them were broken. This wasn't some highly funded government operation that bypassed layers through clever approaches and expensive zero-day exploits.

metadat 4y ago

Archive links: https://archive.ph/DttLG https://archive.ph/DttLG https://web.archive.org/web/20220916011028/https://www.nytimes.com/2022/09/15/technology/uber-hacking-breach.html https://web.archive.org/web/20220916011028/https://www.nytim...

josu 4y ago
Working archive link: https://archive.ph/rBRmn https://archive.ph/rBRmn

deleted 4y ago

[deleted]

ghuntley 4y ago

> "Feel free to share but please don’t credit me: > at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a > website, I am taken to a REDACTED page with a > pornographic image and the message “F** you wankers.” From: https://twitter.com/samwcyo/status/1570583182726266883 https://twitter.com/samwcyo/status/1570583182726266883

FeistySkink 4y ago
I see somebody else got hit with a cancellation fee and took it personally.
hotpotamus 4y ago
Ah, an old fashioned troll/artist rather than someone who just wants to make money with ransomware. How refreshing.
- yellow_lead 4y ago
  We need more LulzSec
paxys 4y ago
> at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a How does an employee know if that message is legitimate or not? If you break into a secure system, mass-emailing all employees saying "URGENT: WE HAVE BEEN HACKED. PLEASE EMAIL YOUR PASSWORD AND SSN TO THIS ADDRESS IMMEDIATELY." is sure to get some percentage of success.
- bombcar 4y ago
  In general you can trust a “stop doing the thing” email blast that appears legitimate but should be highly suspicious of the same asking you to do the thing.
- cddotdotslash 4y ago
  It does make me wonder whether we’re headed towards some kind of “breach via chaos” scenario. Clearly the attackers have the cell phone numbers of employees. Suppose they started mass texting conflicting information? It’d be noisy as hell, but take 1000s of employees getting a never ending stream of texts, purporting to be from their employer, saying “don’t use Slack,” “don’t use email,” “here’s a Zoom bridge for incident response,” “oh and here’s an MFA notification you should accept.” This could lead to a scenario where no one knows what to believe, internal systems are down, attackers are setting up fake IR channels to get even more info, etc. There’s no way most companies could weather an onslaught like that.

harry8 4y ago

Think about all that information you trusted uber with because now you're trusting organised crime. You /have/ to treat uber and the like as though they are organised crime even if you think they are and will always be in league with rainbows, fairies and unicorns will never put your interests behind theirs. edit: wave to uber's PR flunkies.

rodgerd 4y ago
Given that Uber routinely tracked politicians and journos and shared it around the company, and had stood up toolsets to track and evade police so as to facilitate drivers dodging law enforcement, they always were organised crime.
- tpxl 4y ago
  > evade police so as to facilitate drivers dodging law enforcement Isn't this illegal as fuck?
  - Nextgrid 4y ago
    The law doesn't apply if you're a big company.
  - anarticle 4y ago
    It's only illegal if you get caught! :D This was part of Uber's early strategy when cities responded with citing drivers of rideshare services. At this point, I've seen a rideshare stop in the center of an intersection with traffic to let people out, so maybe the cities were right in the end...
  - rodgerd 4y ago
    Most of the high-profile "tech startups" are mired in "doing illegal shit quicker than you get caught, with computers".
judge2020 4y ago
Eh, based on the screenshots and claim that they're doing some trolling, it might be a teen or small group of hackers that happened to gain such a wealth of data and their first instinct is to "download all the data, we'll figure out how to sell it later". If they had shopped around for a nation state buyer this certainly would've been more covert and a bigger hack.

kaesar14 4y ago

Forgive me for being frank, but how do people seriously fall for phishing scams? How do you work at a company like Uber and do something like click on a link in an email to claim a gift card? It’s insane to me.

metadat 4y ago
Not everyone is paranoid and jaded. It's pointless to judge the stupid ones. Bottom line is Uber got pwned, and the dirty laundry is now out in the open for all to see and inspect. Tomorrow it'll be for sale on the darkweb.
- kaesar14 4y ago
  If the theory posted elsewhere in this thread is true there was definitely gross negligence elsewhere in the security chain so it’s not the fault of that one person for sure.
- kirbys-memeteam 4y ago
  “Paranoid and jaded” is reading as “not stupid” to me here.
Undertow_ 4y ago
everyone is susceptible to it,,, everyone
- spoils19 4y ago
  We don't run internal honeypots and no one has ever been caught in our company, so I disagree. And yes, a reply may be "That you know of...", but considering that we run weekly audits and nothing has leaked, I can be 100% sure of it.
  - cyral 4y ago
    Do you really know for sure though? That is what keeps me up at night. The irony is that one of the leaked screenshots is of an internal security auditing/monitoring tool.

fjfbsufhdvfy 4y ago

Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?

Kalium 4y ago
The thing about security is that it's perfectly fine to not have it most days. Suddenly, all at once, it's not fine at all. A very large company has an exceptionally bad time and a lot of people are affected. Small startups and businesses can absolutely get it right. It's usually much easier, with a small number of people and systems involved. You just have to approach it knowing it will take work every day. Some things will be harder than you want them to be. It will be worth it to avoid this kind of stuff.
julianlam 4y ago
You'll always have one extra layer of security that those companies can't buy... obscurity. Just don't rely on only that layer, and watch out for oddly quiet individuals named Sam Sepiol.
hotpotamus 4y ago
You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no security at all, but in the back of my mind, I think it might be the best thing I've got going for me working at a small place. Though I should say, that's far from being our only security - we do work at it too.
- _Adam 4y ago
  The best approach is to assume there's a renegade employee constantly trying to screw the company over. Granularity of permissions should be set to minimize the blast radius to the absolute minimum they need to do their job.

beardedwizard 4y ago

(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here.

sullivanmatt 4y ago
[removed by author]
- beardedwizard 4y ago
  Fair play.
dogecoinbase 4y ago
> Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here. Is remaining in a role in which it's not possible to be effective negligent?
- beardedwizard 4y ago
  What is your alternative? Should we do nothing instead? Should all SWEs quit because they can't stop writing security bugs?
  - dogecoinbase 4y ago
    I don't have a specific alternative, but I think that if it's not possible to be effective in a role, one should decline it. It's possible to be an effective SWE while still writing (and hopefully also sometimes fixing) bugs.
    - 4y ago

vittygreen 4y ago

The other thing of note with this is timing as yesterday an ex attorney testified against the ex security chief for the 2016 breach cover up. And the next day there is this breach. So based on the damaging nature of the testimony where further discovery could be needed it seems a bit too convenient to have a breach the next day. So is it possible this is a fake breach in order to scrub further damaging evidence of others involved in the original 2016 cover up? Something to think about plus the notice seemed to go up in record speed.

encryptluks2 4y ago
I actually really like this theory and it does sound like a possible explanation. I used to know quite a few ex-Uber techs and I wouldn't put it past their ethics to do so.
- vittygreen 4y ago
  Looking at the screen shots that could be just to help support it, but sole of those look like the security techs screen shots by looking at the names on the logins but that too can be viewed as questionable evidence given the context and using this theory as the pov when analyzing the "evidence"
alldayeveryday 4y ago
> So is it possible this is a fake breach in order to scrub further damaging evidence of others involved in the original 2016 cover up? Can you elaborate what scrub means in this context? In what ways would this breach cover up the 2016 breach? Would the prosecutors suddenly lose their memory of the 2016 breach? Would evidence suddenly go missing?
- vittygreen 4y ago
  By locking out your company and chat mediums you can search and purge evidence or artifacts in hopes to not expose further corruption or others involved in the past one. While treating it as a real threat to feds and public. In the org cover up they hired the attackers as employees with modified NDAs as per the testimony given on the 14th. So with that info I wouldn't put it past them as will as the ftc passing gig worker protections which would also financially impact uber on top of the lawsuits that will come out of the 2016 breach cover up. So with those factors and their history this could be used as a cost savings measure in a way to limit the money they are going to pay out in both areas. So with the testimony it would in theory open discovery for new evidence which this could prevent if used as a clean up job for lack of a better term.

cryptozeus 4y ago

Wife has been locked out since afternoon! This is a bad one, she tried accessing internal doc…got redirected to dick pick

nottorp 4y ago
That's not bad. Bad is if my credit card that's in Uber starts showing interesting charges...

vimda 4y ago

Interesting timing, and good comms at a time when their former CISO is currently undergoing trial for not disclosing a previous incident

_8j50 4y ago

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powershell script on a network share. A cheap pentest would have uncovered something like that. Modern security is not perimeter focused where you try to keep the bad guys out. Yes, you should do MFA,firewalls,vpns the whole schtick but(!!) your presumption should always be that threat actors already have a foot-hold in your network. This is very important because it helps you focus on basic things like scripts and gpos with creds in them but also you treat internal devices the same as internet exposed devices. It's sort of what the whole "zero trust" thing is about as well. In other words, host/user compromise is a given but lateral movement should be at least as difficult as breaching the perimeter. But my prediction is, just like top commenters here, they will slap MFA on it and of course cleanup scripts with creds and call it fixed until the next compromise. Oh and FYI, MFA on VPNs is a PITA, that's rarely done for good reason, instead you use device certificates in addition to passwords which is what the recommendation should be not yubikeys or webauthn (vpn!=web??) because VPNs need to reconnect and you can't have people insert a yubi each time their connection drops. Ideal setup would have 7 day valid (or however long is reasonable for users to disconnect their PC and remain out of office) mutual-auth certs+ocsp getting conditionally reissued new certs to remain connected (compliance stuff like patching, unapporoved software,security alerts for the device). If you think about it, you typically issue users two yubikeys not just one so if the backup gets stolen you have a problem depending on how easy it is to social engineer users or reset their password with a good yubikey but a stolen laptop means certs+password revoked immediately.

philliphaydon 4y ago
There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…
- vanshg 4y ago

kuraudo 4y ago

I heard from a security friend that their sentinel one endpoint detection got popped and the hacker posted screenshots of thousands of unaddressed security alerts in the dashboard. Can anyone confirm? I'm still looking for the proof.

mcintyre1994 4y ago
Maybe referring to this image? https://twitter.com/vxunderground/status/1570597582417821703/photo/3 https://twitter.com/vxunderground/status/1570597582417821703... (3rd photo if it doesn't open)

piyushpr134 4y ago

Perimeter based security must die for people to stop doing insecure data sharing. Concept of VPN based lan in this remote work kind of setup is highly insecure and open to all kinds of abuse. In fact it was always insecure I would say. All you need is wifi password and you have tonnes of super sensitive information on windows shares

belter 4y ago

"Uber reels from 'security incident’ in which cloud systems seemingly hijacked" - https://www.theregister.com/2022/09/16/uber_security_incident/ https://www.theregister.com/2022/09/16/uber_security_inciden... "We're told that an employee was socially engineered by the attacker to gain access to Uber's VPN, through which the intruder scanned the network, found a PowerShell script containing the hardcoded credentials for an administrator user in Thycotic, which were then used to unlock access to all of Uber's internal cloud and software-as-a-service resources, among other things. After that, everything was at the intruder's fingertips, allegedly. The New York Times reported that Uber staff were told to stop using the corporate Slack, and that the call to quit the chat app came after the intruder sent a message declaring: “I announce I am a hacker and Uber has suffered a data breach.” The Times stated the Slack message listed “several internal databases that the hacker claimed had been compromised.” Various corporate systems have now been shut down by Uber." ""Instead of doing anything, a good portion of the staff was interacting and mocking the hacker thinking someone was playing a joke," Curry said. "After being told to stop going on slack, people kept going on for the jokes." Evidence of that misunderstanding has surfaced on Twitter in the form of a screenshot of Uber's private Slack workspace." The message: https://nitter.net/vxunderground/status/1570626503947485188 https://nitter.net/vxunderground/status/1570626503947485188

junon 4y ago

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at least when I was there, there was pretty good training on SE deterrence. Further, OneLogin was used, Yubikeys were phased out early on. I'd be surprised if they had brought them back, as I remember the security team being somewhat averse to them. I'm sure OneLogin is also investigating. The security team at Uber was quite good. Constantly under stress. Constantly overworked. The last thing they need are knowitalls speculating about how stupid they are on HN. Cut them some slack - this could happen to any company (yes, it could, even yours - don't try to convince me otherwise).

vayne 4y ago
- junon 4y ago
  You clearly don't understand how SE can be used even if Yubikey or WebAuthn are used here. Perhaps you'd like to explain instead of insult someone you know nothing about (which violates HN guidelines).
  - vayne 4y ago
    I get what you are saying now. Agree if the right actors are on it, all those doesn’t matter. Sorry about that.
  - reissbaker 4y ago
    I mean, "social engineering" is pretty broad; saying MFA can't stop social engineering is like saying password managers can't stop hacking, or HTTPS can't stop spying. I mean, sure... but Webauthn would have in fact stopped this type of social engineering attack (which was a fake login page). And scanning internal networks for hardcoded secrets would have stopped this type of privilege escalation afterwards. Security is never absolute, but we're not talking about a nation-state/APT attack here; current reports seem to indicate this was a bored 18 year old acting alone.

oblio 4y ago

This is bad :-(

deleted 4y ago

[deleted]

lumberjack24 4y ago

That hardcoded secret in the powershell script really was the key to the Uber ride-hailing kingdom – https://blog.gitguardian.com/uber-breach-2022 https://blog.gitguardian.com/uber-breach-2022.

zod50 4y ago

> sent a text message to an Uber worker claiming to be a corporate information technology person I'm confused. Was the hacker claiming to be an IT person or was it the Uber worker?

cal85 4y ago
The hacker

mcstempel 4y ago

The common thread in all of these recent attacks (Uber, Twilio, Okta, etc) is the “phishability” of the authentication methods involved. Remote attacks like this only work when you can socially engineer an employee and phish sensitive credentials like a password from them (or a SMS one-time passcode during the MFA step). What’s head-scratching to me is why tech-forward enterprises haven’t been faster to adopt unphishable forms of authentication like WebAuthn. WebAuthn supports both built-in device biometrics like FaceID/TouchID and external hardware keys (eg YubiKey), which are inherently incapable of being phished — there’s no text-based secret for an attacker to deceive a user into sharing with them. I’m biased as I run an identity and access management company (stytch.com), but I hope more companies will consider integrating WebAuthn to support unphishable MFA. Today, WebAuthn introduces some nuances that can discourage a B2C company from supporting it today (e.g. account recovery with lost devices), but it’s a clear win for corporate network/workplace authentication and B2B apps. I believe some of the lack of adoption is due to complexity to build (more complex than traditional MFA) and cost for off-the-shelf solutions (Incumbents like Auth0/Okta require ~$30k annual commitments to let developers use WebAuthn). If you decide to build with Stytch, WebAuthn is included in our pay-as-you-go plan (https://stytch.com/products/webauthn https://stytch.com/products/webauthn)

WirelessGigabit 4y ago

Our security just send around an email that they're disabling Google Chrome's password manager. While I understand not wanting those passwords in Google's hands, the reality is that they do have the $$$ for security. But instead of being able to leverage that functionality, and the Generate Password functionality we now have to resort back to name_of_application_my_name or something like that. Do not ban things just because it has an issue. Provide a better alternative.

halz 4y ago
When browser managed credentials are synchronized across devices, an attacker may be able to move laterally into an enterprise by compromising the personally managed device or personally managed account (since it may be without 2FA, or may use a shared/guessable/weak password thats shared across dozens of compromised websites, or be far behind on app/OS patches, etc..)
kccqzy 4y ago
Disabling a password manager that's built into a browser? That's simply madness. What do they expect people to use? Their brain to remember all their passwords rather than a password manager? And rely on their brain to know they are on a site whose domain doesn't match the domain in the password manager despite looking very similar? Also this has nothing to do with passwords in Google's hands. They could turn off syncing in Chrome and have a completely local password manager. I personally do exactly that. Your org will suffer many data breaches due to this policy.