Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

51–60 of 327 posts

Re: Uber investigating breach of its computer systems

#51

Post by bombcar »

CPLX wrote: post #30
gnu8 wrote: post #17

Earlier quoted context omitted.

A reasonably sophisticated attacker could arrange for the entire team to get SIM-swapped and suspended from Facebook when they launch an attack. If only there were some way to have a central rallying point for everyone to meet at. Perhaps some sort of a structure, with the company's name on it, and it would have places to sit inside, with computers connected to the company's infrastructure to use.

Who controls the database of RFID cards allowed to open the doors?

Usually the datacenter was manned (sometimes by guys with guns) and they had various mechanisms for ID verifications.

And they had an entirely separate IT setup that wasn’t related to yours.

Re: Uber investigating breach of its computer systems

#52

Post by colemannugent »

arkadiyt wrote: post #2

Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems

>scan their intranet and find a network share

Did their IDS/IPS not go off on this? I wonder if this was a sophisticated scan designed to go slow and evade detection or if it was just nmap lol

I can't wait for the post-mortem, hopefully lots of good lessons to learn.

Re: Uber investigating breach of its computer systems

#53

Post by Undertow_ »

kaesar14 wrote: post #31

Forgive me for being frank, but how do people seriously fall for phishing scams? How do you work at a company like Uber and do something like click on a link in an email to claim a gift card? It’s insane to me.

everyone is susceptible to it,,, everyone

Re: Uber investigating breach of its computer systems

#54

Post by zmgsabst »

bombcar wrote: post #24
gnu8 wrote: post #17

Earlier quoted context omitted.

A reasonably sophisticated attacker could arrange for the entire team to get SIM-swapped and suspended from Facebook when they launch an attack. If only there were some way to have a central rallying point for everyone to meet at. Perhaps some sort of a structure, with the company's name on it, and it would have places to sit inside, with computers connected to the company's infrastructure to use.

In the old days you’d have physical restrictions on access to the datacenter - in a major breach you’d get there physically and shut it down and disconnect it. With everything cloud now, how do you recover your cloud account of the master got compromised?

For someone Uber’s size, you call your AWS rep and co-ordinate with AWS security.

Re: Uber investigating breach of its computer systems

#55

Post by sullivanmatt »

beardedwizard wrote: post #44

(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed her…

[removed by author]

Re: Uber investigating breach of its computer systems

#56

Post by vishnugupta »

kortilla wrote: post #38
BarryMilo wrote: post #28

Earlier quoted context omitted.

What? Security is the one domain I found where you can't just waltz in because you've heard of a computer. You need to do the work upfront with Sec+ or the like, it would take months for a newbie. Past that point, what more guarantee can you have? Even work experience can be meaningless if they weren't in the right team/role.

Security is a cost center, not a profit center. Most companies cut that investment to the bone, which means paying the bare minimum that lets them check boxes. This is true for basically any non-tech company, and is true for like 75% of the tech companies. > You need to do the work upfront with Sec+ Sec+ is part of the paper mill parent is referring to. A book of terms to memorize for 3 months and then call it good.

+100

Not only is it a cost center it’s also seen as a hindrance to the fast progress. Rarely will you come across an exec who takes security seriously. For them it’s just a checkbox at best and an obstacle at worst. I’m speaking about application security though. It’s possible that IT sec, physical security etc are taken more seriously.

Re: Uber investigating breach of its computer systems

#57

Post by dogecoinbase »

beardedwizard wrote: post #44

(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed her…

> Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here.

Is remaining in a role in which it's not possible to be effective negligent?

Re: Uber investigating breach of its computer systems

#59

Post by beardedwizard »

dogecoinbase wrote: post #57
beardedwizard wrote: post #44

(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed her…

> Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here. Is remaining in a role in which it's not possible to be effective negligent?

What is your alternative? Should we do nothing instead? Should all SWEs quit because they can't stop writing security bugs?

Re: Uber investigating breach of its computer systems

#60

Post by beardedwizard »

sullivanmatt wrote: post #55
beardedwizard wrote: post #44

(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed her…

[removed by author]

Fair play.
Post reply on HN