Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

111–120 of 327 posts

Re: Uber investigating breach of its computer systems

#111

Post by SamoyedFurFluff »

raverbashing wrote: post #106
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

So, where does it end? Cybersecurity has been playing those silly games of "increasing security" and some 80% of recommendations were frankly BS "longer passwords" yes. "password has to have symbols, numbers and be rotated every 3 mo" no 2FA yes, but not SMS, but not OTP because people get fished, blah blah blah Not to forget the "put everything in a password manager" then you lose or forget your "extra safe random p…

I don’t think it ever truly ends, so long as there are secrets and people who want to uncover them. This is the classic arms race, and subsequently people who can’t keep up are just casualties…

Re: Uber investigating breach of its computer systems

#112

Post by Shank »

staticassertion wrote: post #95
Shank wrote: post #27

Earlier quoted context omitted.

> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it…

People who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.

I was recently on a call with someone who said their company was "totally zero-trust" because they disabled copy & paste on all workstations. I definitely believe in the concept, but it's definitely turning into a parroted term that's applied to anything.

Re: Uber investigating breach of its computer systems

#113

Post by pat2man »

raverbashing wrote: post #106
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

So, where does it end? Cybersecurity has been playing those silly games of "increasing security" and some 80% of recommendations were frankly BS "longer passwords" yes. "password has to have symbols, numbers and be rotated every 3 mo" no 2FA yes, but not SMS, but not OTP because people get fished, blah blah blah Not to forget the "put everything in a password manager" then you lose or forget your "extra safe random p…

Smart cards have long been mostly phishing proof. WebAuthN is essentially a more convenient interface to the same technology.

Re: Uber investigating breach of its computer systems

#114

Post by yeuxardents »

cyral wrote: post #93
kaesar14 wrote: post #31

Forgive me for being frank, but how do people seriously fall for phishing scams? How do you work at a company like Uber and do something like click on a link in an email to claim a gift card? It’s insane to me.

Probably because it was more sophisticated than a gift card.. There are some screenshots on Twitter from the hackers with all kinds of internal uber tools and admin panels, many on non-uber domains (like uber. .com). With all the internal email lists that employees are on for different departments in these large companies, it's not unimaginable that they click a link that appears to be some malicious site in disguise…

This is one of my biggest fears about companies constantly outsourcing easily deployed internal apps as SaaS and just using mycompany.saasprovider.com

Normal users stand no chance, especially when there are URLs that are sketchy because oops, saasprovider already has a customer with your requested url, so you end up with

mycompany0.saasprovider.com or mycompany-1.saasprovider.com

Its terrible practice all around and lazy systems and services administration

Re: Uber investigating breach of its computer systems

#115

Post by raverbashing »

pat2man wrote: post #113
raverbashing wrote: post #106

Earlier quoted context omitted.

So, where does it end? Cybersecurity has been playing those silly games of "increasing security" and some 80% of recommendations were frankly BS "longer passwords" yes. "password has to have symbols, numbers and be rotated every 3 mo" no 2FA yes, but not SMS, but not OTP because people get fished, blah blah blah Not to forget the "put everything in a password manager" then you lose or forget your "extra safe random p…

Smart cards have long been mostly phishing proof. WebAuthN is essentially a more convenient interface to the same technology.

Then your phishing involves them installing some type of remote access on their machines. Or to get some information you need

Re: Uber investigating breach of its computer systems

#116

Post by Semaphor »

staticassertion wrote: post #92
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

Regarding AWS, it's truly insane that they only support 1 device (breaking from the FIDO2 recommendation) but you can also put AWS behind SSO, and then have 2FA on the SSO.

> it's truly insane that they only support 1 device

I recently got a notification to create a separate AWS account (I don’t use it), and thought might as well enable 2FA. Added the first key. Looked for a way to add the backup key. Was confused, removed 2FA. What is that, lockout Russian roulette?

Re: Uber investigating breach of its computer systems

#117

Post by vineyardmike »

lmm wrote: post #91
mdeeks wrote: post #46

Earlier quoted context omitted.

It’s too bad the user experience across devices sucks. The best experience by far is a yubikey nano since it is mostly permanently attached to your laptop. It’s always there and you just quickly tap it. Love it. Of course that doesn’t work with my iPhone. So I guess I need a second NFC yubikey that stays on my key chain in my pocket (which I don’t have since I don’t carry keys.). So then I have to remember to registe…

> Of course that doesn’t work with my iPhone. So I guess I need a second NFC yubikey that stays on my key chain in my pocket (which I don’t have since I don’t carry keys.). So then I have to remember to register both yubikeys. Then every time I have to login to GitHub or whatever on my phone I have to pull out my keychain (which I don’t have) and tap it on my phone. That's why I use one of these rather than a yubikey…

YukiKey does make a dual key. The problem is that these keys suck to have because you can’t leave them in your laptop and carry it around like that. Which makes it easy to forget.

I personally was always forgetting my key when I worked in office. Or more likely I’d have the key and forget a USB A to USB C adapter (work was cheap and wouldn’t give out USBC keys).

My new job gives out USBC keys and I have yet to forget it when I needed it. They just don’t work as NFC on a phone.

https://www.yubico.com/product/yubikey-5ci/

Re: Uber investigating breach of its computer systems

#118

Post by beardedwizard »

dogecoinbase wrote: post #68
beardedwizard wrote: post #59

Earlier quoted context omitted.

What is your alternative? Should we do nothing instead? Should all SWEs quit because they can't stop writing security bugs?

I don't have a specific alternative, but I think that if it's not possible to be effective in a role, one should decline it. It's possible to be an effective SWE while still writing (and hopefully also sometimes fixing) bugs.

One could argue the security industry exists because of the failings of computer science.

Maybe swes should start facing legal liability for thier failings like most other engineering disciplines. We would see this problem change overnight.

Re: Uber investigating breach of its computer systems

#120

Post by rolandog »

mdeeks wrote: post #46
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

It’s too bad the user experience across devices sucks. The best experience by far is a yubikey nano since it is mostly permanently attached to your laptop. It’s always there and you just quickly tap it. Love it. Of course that doesn’t work with my iPhone. So I guess I need a second NFC yubikey that stays on my key chain in my pocket (which I don’t have since I don’t carry keys.). So then I have to remember to registe…

Regarding the keychain issue, what works for me is using a wallet with a side pocket, that way the yubikey doesn't fall out... (can't remember the name for such an item; clutch wallet?).
Post reply on HN