4 ms·

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used onlin

by junon 4y ago

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at least when I was there, there was pretty good training on SE deterrence. Further, OneLogin was used, Yubikeys were phased out early on. I'd be surprised if they had brought them back, as I remember the security team being somewhat averse to them. I'm sure OneLogin is also investigating. The security team at Uber was quite good. Constantly under stress. Constantly overworked. The last thing they need are knowitalls speculating about how stupid they are on HN. Cut them some slack - this could happen to any company (yes, it could, even yours - don't try to convince me otherwise).

vayne 4y ago
- junon 4y ago
  You clearly don't understand how SE can be used even if Yubikey or WebAuthn are used here. Perhaps you'd like to explain instead of insult someone you know nothing about (which violates HN guidelines).
  - vayne 4y ago
    I get what you are saying now. Agree if the right actors are on it, all those doesn’t matter. Sorry about that.
  - reissbaker 4y ago
    I mean, "social engineering" is pretty broad; saying MFA can't stop social engineering is like saying password managers can't stop hacking, or HTTPS can't stop spying. I mean, sure... but Webauthn would have in fact stopped this type of social engineering attack (which was a fake login page). And scanning internal networks for hardcoded secrets would have stopped this type of privilege escalation afterwards. Security is never absolute, but we're not talking about a nation-state/APT attack here; current reports seem to indicate this was a bored 18 year old acting alone.
smeej 4y ago
OneLogin is fine and all, but why not protect your OneLogin with a hardware key?
marcinzm 4y ago
>No MFA protects against social engineering (no, not even ____ - don't try to convince me). Certain MFAs can protect against more types of attacks than others. You covering your head in the sand when people point that out doesn't change that fact but merely indicates you prefer feeling right to being right. >as I remember the security team being somewhat averse to them So you're saying that the security team was averse to the thing that would have prevented this hack? And that means we shouldn't put blame on them?
moolcool 4y ago
> this could happen to any company (yes, it could, even yours - don't try to convince me otherwise) There's a lot of cognitive dissonance in discussion around this story IMO. Nowadays I assume everyone has been or will be pwned, because no breech surprises me anymore. Any small gap can and will be exploited, and as organisations grow the surface area only gets larger and larger. The only way to truly secure data is to not put it on the internet from the jump. For every breach that's published, there's likely a dozen that we never find out about.
lima 4y ago
> No MFA protects against social engineering That's true - some kinds of social engineering cannot be prevented by technical means. BUT hardware keys prevent an entire class of extremely common attacks that every other form of MFA is vulnerable to. It would have prevented the method of compromise used here. Any company not using FIDO/WebAuthn in 2022 is behind on best practices.
deleted 4y ago
[deleted]
marcosdumay 4y ago
Oh, cloud-based MFA. Dream stuff where you SaaS can reauthenticate at any time, and it just sends a request to the users, without having to rely on them to initiate anything. No idea what could go wrong with that. /s
wglb 4y ago
> Yubikeys were phased out early on What security team on earth would be against these?
- junon 4y ago
  Wasn't their decision. Was finance's. Blame them.
  - choppaface 4y ago
    Blame greyballing on finance too? It seems unlikely for finance to really own the final call here.
unity1001 4y ago
> The last thing they need are knowitalls speculating about how stupid they are on HN Don't you know that sh*tting on everyone else and saying that how you could do it with only 5 people are the traditions of HN...

by junon 4y ago

vayne 4y ago

junon 4y ago
You clearly don't understand how SE can be used even if Yubikey or WebAuthn are used here. Perhaps you'd like to explain instead of insult someone you know nothing about (which violates HN guidelines).
- vayne 4y ago
  I get what you are saying now. Agree if the right actors are on it, all those doesn’t matter. Sorry about that.
- reissbaker 4y ago
  I mean, "social engineering" is pretty broad; saying MFA can't stop social engineering is like saying password managers can't stop hacking, or HTTPS can't stop spying. I mean, sure... but Webauthn would have in fact stopped this type of social engineering attack (which was a fake login page). And scanning internal networks for hardcoded secrets would have stopped this type of privilege escalation afterwards. Security is never absolute, but we're not talking about a nation-state/APT attack here; current reports seem to indicate this was a bored 18 year old acting alone.

smeej 4y ago

OneLogin is fine and all, but why not protect your OneLogin with a hardware key?

marcinzm 4y ago

>No MFA protects against social engineering (no, not even ____ - don't try to convince me). Certain MFAs can protect against more types of attacks than others. You covering your head in the sand when people point that out doesn't change that fact but merely indicates you prefer feeling right to being right. >as I remember the security team being somewhat averse to them So you're saying that the security team was averse to the thing that would have prevented this hack? And that means we shouldn't put blame on them?

moolcool 4y ago

> this could happen to any company (yes, it could, even yours - don't try to convince me otherwise) There's a lot of cognitive dissonance in discussion around this story IMO. Nowadays I assume everyone has been or will be pwned, because no breech surprises me anymore. Any small gap can and will be exploited, and as organisations grow the surface area only gets larger and larger. The only way to truly secure data is to not put it on the internet from the jump. For every breach that's published, there's likely a dozen that we never find out about.

lima 4y ago

> No MFA protects against social engineering That's true - some kinds of social engineering cannot be prevented by technical means. BUT hardware keys prevent an entire class of extremely common attacks that every other form of MFA is vulnerable to. It would have prevented the method of compromise used here. Any company not using FIDO/WebAuthn in 2022 is behind on best practices.

deleted 4y ago

[deleted]

marcosdumay 4y ago

Oh, cloud-based MFA. Dream stuff where you SaaS can reauthenticate at any time, and it just sends a request to the users, without having to rely on them to initiate anything. No idea what could go wrong with that. /s

wglb 4y ago

> Yubikeys were phased out early on What security team on earth would be against these?

junon 4y ago
Wasn't their decision. Was finance's. Blame them.
- choppaface 4y ago
  Blame greyballing on finance too? It seems unlikely for finance to really own the final call here.

unity1001 4y ago

> The last thing they need are knowitalls speculating about how stupid they are on HN Don't you know that sh*tting on everyone else and saying that how you could do it with only 5 people are the traditions of HN...