Uber investigating breach of its computer systems

Post by ghaff » Fri, Sep 16, 2022, 6:03 AM UTC

mdeeks wrote: post #46

sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

It’s too bad the user experience across devices sucks. The best experience by far is a yubikey nano since it is mostly permanently attached to your laptop. It’s always there and you just quickly tap it. Love it. Of course that doesn’t work with my iPhone. So I guess I need a second NFC yubikey that stays on my key chain in my pocket (which I don’t have since I don’t carry keys.). So then I have to remember to registe…

Post by softveda » Fri, Sep 16, 2022, 6:04 AM UTC

vishnugupta wrote: post #56

kortilla wrote: post #38

Earlier quoted context omitted.

Security is a cost center, not a profit center. Most companies cut that investment to the bone, which means paying the bare minimum that lets them check boxes. This is true for basically any non-tech company, and is true for like 75% of the tech companies. > You need to do the work upfront with Sec+ Sec+ is part of the paper mill parent is referring to. A book of terms to memorize for 3 months and then call it good.

+100 Not only is it a cost center it’s also seen as a hindrance to the fast progress. Rarely will you come across an exec who takes security seriously. For them it’s just a checkbox at best and an obstacle at worst. I’m speaking about application security though. It’s possible that IT sec, physical security etc are taken more seriously.

Post by nindalf » Fri, Sep 16, 2022, 6:23 AM UTC

raverbashing wrote: post #115

pat2man wrote: post #113

Earlier quoted context omitted.

Smart cards have long been mostly phishing proof. WebAuthN is essentially a more convenient interface to the same technology.

Then your phishing involves them installing some type of remote access on their machines. Or to get some information you need

Post by jjav » Fri, Sep 16, 2022, 6:32 AM UTC

raverbashing wrote: post #106

sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

So, where does it end? Cybersecurity has been playing those silly games of "increasing security" and some 80% of recommendations were frankly BS "longer passwords" yes. "password has to have symbols, numbers and be rotated every 3 mo" no 2FA yes, but not SMS, but not OTP because people get fished, blah blah blah Not to forget the "put everything in a password manager" then you lose or forget your "extra safe random p…

Post by jjav » Fri, Sep 16, 2022, 6:55 AM UTC

staticassertion wrote: post #95

Shank wrote: post #27

Earlier quoted context omitted.

> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it…

People who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.