Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

131–140 of 327 posts

Re: Uber investigating breach of its computer systems

#131

Post by Phlarp »

paxys wrote: post #83
fjfbsufhdvfy wrote: post #35

Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?

It's the weakest link problem. Uber can have near perfect security but all it takes is a single one out of 20K+ employees to click on the wrong link, install the wrong app or trust the wrong person and suddenly the entire system is compromised. So in that sense your small business is more secure since there are way fewer possible targets.

In this case it took both the one employee out of 20k+ getting tricked and the entire (supposedly world class) engineering org that allowed admin authentication credentials to get hardcoded into a globally accessible power shell script exposed on the intranet.

Re: Uber investigating breach of its computer systems

#132

Post by tylerhou »

chinathrow wrote: post #130
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

How do you recover if you lose access to your device?

Backup key on your keychain.

Re: Uber investigating breach of its computer systems

#133

Post by philliphaydon »

vanshg wrote: post #122
philliphaydon wrote: post #110

Earlier quoted context omitted.

There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…

So that you're protected from data breaches of the service itself (e.g. revealing a reused password)

That doesn't have anything to do with MFA. If for some reason your 1Password masterpass is compromised, the hacker has access to your passwords and your MFA tokens.

If you use 1Password and say Authy (Assuming your Authy pass isn't in 1Password) or Google Authenticator. Then all services with MFA wont be compromised if the 1Password masterpass is...

Re: Uber investigating breach of its computer systems

#134

Post by piyushpr134 »

Perimeter based security must die for people to stop doing insecure data sharing. Concept of VPN based lan in this remote work kind of setup is highly insecure and open to all kinds of abuse.

In fact it was always insecure I would say. All you need is wifi password and you have tonnes of super sensitive information on windows shares

Re: Uber investigating breach of its computer systems

#135

Post by yellow_lead »

hotpotamus wrote: post #37
ghuntley wrote: post #23

> "Feel free to share but please don’t credit me: > at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a > website, I am taken to a REDACTED page with a > pornographic image and the message “F** you wankers.” From: https://twitter.com/samwcyo/status/1570583182726266883

Ah, an old fashioned troll/artist rather than someone who just wants to make money with ransomware. How refreshing.

We need more LulzSec

Re: Uber investigating breach of its computer systems

#136

Post by raesene9 »

staticassertion wrote: post #95
Shank wrote: post #27

Earlier quoted context omitted.

> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it…

People who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.

It shouldn't be buzzword soup, that does not mean that companies and vendors don't use it that way.

Pretty much any time a new security concept comes up vendors race to say that they implement it, whether they do or not.

With Zero trust, it's hardly a new idea (e.g the Jericho forum de-perimeterization) but it's hard to implement well across all systems.

Re: Uber investigating breach of its computer systems

#137

Post by sschueller »

harry8 wrote: post #26

Think about all that information you trusted uber with because now you're trusting organised crime. You /have/ to treat uber and the like as though they are organised crime even if you think they are and will always be in league with rainbows, fairies and unicorns will never put your interests behind theirs. edit: wave to uber's PR flunkies.

If they really did get in hope they grabed the internal company communications etc so we can finally criminally prosecute the people that have systematically and knowingly broken the law.

Additionally even if the information might not be admissible in US courts, it is in other countries making travel for those individuals very uncomfortable.

Re: Uber investigating breach of its computer systems

#139

Post by zinekeller »

acdha wrote: post #66
mdeeks wrote: post #46

Earlier quoted context omitted.

It’s too bad the user experience across devices sucks. The best experience by far is a yubikey nano since it is mostly permanently attached to your laptop. It’s always there and you just quickly tap it. Love it. Of course that doesn’t work with my iPhone. So I guess I need a second NFC yubikey that stays on my key chain in my pocket (which I don’t have since I don’t carry keys.). So then I have to remember to registe…

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

> That last part is important because AWS has a huge barrier: the number of MFA devices you get is one, which means you either need insecure things like synced TOTP seeds or you have to be comfortable never losing your Yubikey. I have been asking our TAM to prioritize fixing that for years so backups can be a real thing.

Actually, can we mark AWS as insecure? Seriously, it was a bother at the time it was rolled out but now I could say that Amazon is insecure. If they could not bother with this, there are definitely more security holes intentionally hidden from the general public.

Re: Uber investigating breach of its computer systems

#140

Post by dx034 »

acdha wrote: post #66
mdeeks wrote: post #46

Earlier quoted context omitted.

It’s too bad the user experience across devices sucks. The best experience by far is a yubikey nano since it is mostly permanently attached to your laptop. It’s always there and you just quickly tap it. Love it. Of course that doesn’t work with my iPhone. So I guess I need a second NFC yubikey that stays on my key chain in my pocket (which I don’t have since I don’t carry keys.). So then I have to remember to registe…

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

Recently my phone broke and it took a day to get a new one. I was so glad to have my 2fa codes somewhere else as well. I'd never want to rely solely on one device for access to everything.

Apples plan is that I need to own several Apple devices for that, this is a non-starter for me.

Post reply on HN