3 ms·

Uber hacked, internal systems breached and vulnerability reports stolen

• curmudgeon22 4y ago
  > ... who said they breached Uber after performing a social engineering attack on an employee and stealing their password. > As the Uber account was protected with multi-factor authentication, the attacker allegedly used an MFA Fatigue attack and pretended to be Uber IT support to convince the employee to accept the MFA request. > ... the hacker says they found a PowerShell script containing admin credentials for the company's Thycotic privileged access management (PAM) platform, which was used to access the login secrets for the company's other internal services. > BleepingComputer was also told by a source that the attacker downloaded all vulnerability reports before they lost access to Uber's bug bounty program. This likely includes vulnerability reports that have not been fixed, presenting a severe security risk to Uber.