Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

141–150 of 327 posts

Re: Uber investigating breach of its computer systems

#141

Post by tpxl »

rodgerd wrote: post #33
harry8 wrote: post #26

Think about all that information you trusted uber with because now you're trusting organised crime. You /have/ to treat uber and the like as though they are organised crime even if you think they are and will always be in league with rainbows, fairies and unicorns will never put your interests behind theirs. edit: wave to uber's PR flunkies.

Given that Uber routinely tracked politicians and journos and shared it around the company, and had stood up toolsets to track and evade police so as to facilitate drivers dodging law enforcement, they always were organised crime.

> evade police so as to facilitate drivers dodging law enforcement

Isn't this illegal as fuck?

Re: Uber investigating breach of its computer systems

#142

Post by dx034 »

colemannugent wrote: post #52
arkadiyt wrote: post #2

Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems

>scan their intranet and find a network share Did their IDS/IPS not go off on this? I wonder if this was a sophisticated scan designed to go slow and evade detection or if it was just nmap lol I can't wait for the post-mortem, hopefully lots of good lessons to learn.

Maybe just clicking around until they found something. That's what many employees do on a daily basis looking for files on network drives, so nothing that would be noticed easily.

Re: Uber investigating breach of its computer systems

#143

Post by junon »

saagarjha wrote: post #9
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

I would be shocked if they didn’t issue all employees YubiKeys.

They did for a while but it was too expensive. Uber uses OneLogin, who I'm sure is also investigating. We had apps on our phones that received as "is this you trying to log in?" notification. You had to consciously hit "Yes" in order to continue the login flow. It wasn't offline 2FA like Authy or something. There _was_ a much higher standard of security there.

This was _social engineering_, something that even the finest MFA algorithms don't guard against.

Re: Uber investigating breach of its computer systems

#144

Post by Thorrez »

yeuxardents wrote: post #114
cyral wrote: post #93

Earlier quoted context omitted.

Probably because it was more sophisticated than a gift card.. There are some screenshots on Twitter from the hackers with all kinds of internal uber tools and admin panels, many on non-uber domains (like uber. .com). With all the internal email lists that employees are on for different departments in these large companies, it's not unimaginable that they click a link that appears to be some malicious site in disguise…

This is one of my biggest fears about companies constantly outsourcing easily deployed internal apps as SaaS and just using mycompany.saasprovider.com Normal users stand no chance, especially when there are URLs that are sketchy because oops, saasprovider already has a customer with your requested url, so you end up with mycompany0.saasprovider.com or mycompany-1.saasprovider.com Its terrible practice all around and…

Even without SaaS I get weird URLs on login pages. The login page for my personal Chase account is

    https://secure07a.chase.com/web/auth/#/logon/logon/chaseOnline?treatment=chase&lang=en
At least the etld+1 makes sense, but most people aren't going to recognize that generally the etld+1 is what you need to verify and you can ignore the rest.

Re: Uber investigating breach of its computer systems

#145

Post by dx034 »

cddotdotslash wrote: post #8

They could be fake, of course, but this thread[1] of screenshots is pretty bad... internal tools, Slack Admin, Google Workspace admin, an AWS account showing admin permissions. [1] https://twitter.com/Savitar0x01/status/1570580235716014081

And as other people have already written, that's the main issue. Not that someone got compromised, but that passwords for admin accounts to all those services were stored on a network share.

Re: Uber investigating breach of its computer systems

#146

Post by belter »

"Uber reels from 'security incident’ in which cloud systems seemingly hijacked" - https://www.theregister.com/2022/09/16/uber_security_inciden...

"We're told that an employee was socially engineered by the attacker to gain access to Uber's VPN, through which the intruder scanned the network, found a PowerShell script containing the hardcoded credentials for an administrator user in Thycotic, which were then used to unlock access to all of Uber's internal cloud and software-as-a-service resources, among other things.

After that, everything was at the intruder's fingertips, allegedly.

The New York Times reported that Uber staff were told to stop using the corporate Slack, and that the call to quit the chat app came after the intruder sent a message declaring: “I announce I am a hacker and Uber has suffered a data breach.”

The Times stated the Slack message listed “several internal databases that the hacker claimed had been compromised.” Various corporate systems have now been shut down by Uber."

""Instead of doing anything, a good portion of the staff was interacting and mocking the hacker thinking someone was playing a joke," Curry said. "After being told to stop going on slack, people kept going on for the jokes."

Evidence of that misunderstanding has surfaced on Twitter in the form of a screenshot of Uber's private Slack workspace."

The message: https://nitter.net/vxunderground/status/1570626503947485188

Re: Uber investigating breach of its computer systems

#147

Post by junon »

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough.

We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me).

And yes, at least when I was there, there was pretty good training on SE deterrence.

Further, OneLogin was used, Yubikeys were phased out early on. I'd be surprised if they had brought them back, as I remember the security team being somewhat averse to them. I'm sure OneLogin is also investigating.

The security team at Uber was quite good. Constantly under stress. Constantly overworked. The last thing they need are knowitalls speculating about how stupid they are on HN. Cut them some slack - this could happen to any company (yes, it could, even yours - don't try to convince me otherwise).

Re: Uber investigating breach of its computer systems

#148

Post by j1elo »

sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team

Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine.

Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stolen. I'm optimizing for when I am traveling from home around the other side of the world, 6 time zones away, and my phone / stuff gets lost.

2FA is already unmanageable at this point: "just use your recovery keys" is what people tell you, but that's NOT a viable solution to the problem. Sorry but my recovery codes are in a safe lock, 10,000 Km away from me, I just lost the purse with my phone, or my device broke, or got stolen, or whatever, and need the damn TOTP code to telework _right now_.

Re: Uber investigating breach of its computer systems

#149

Post by mcintyre1994 »

kuraudo wrote: post #119

I heard from a security friend that their sentinel one endpoint detection got popped and the hacker posted screenshots of thousands of unaddressed security alerts in the dashboard. Can anyone confirm? I'm still looking for the proof.

Maybe referring to this image? https://twitter.com/vxunderground/status/1570597582417821703... (3rd photo if it doesn't open)

Re: Uber investigating breach of its computer systems

#150

Post by vayne »

junon wrote: post #147

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at…

No post body was provided.
Post reply on HN