Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

181–190 of 327 posts

Re: Uber investigating breach of its computer systems

#181

Post by acdha »

chinathrow wrote: post #130
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

How do you recover if you lose access to your device?

Currently: use a hardware key or printed backup codes.

Passkeys: same, or one of the other participating devices.

Re: Uber investigating breach of its computer systems

#182

Post by Griffinsauce »

zmgsabst wrote: post #54
bombcar wrote: post #24

Earlier quoted context omitted.

In the old days you’d have physical restrictions on access to the datacenter - in a major breach you’d get there physically and shut it down and disconnect it. With everything cloud now, how do you recover your cloud account of the master got compromised?

For someone Uber’s size, you call your AWS rep and co-ordinate with AWS security.

How do they verify your identity?

Re: Uber investigating breach of its computer systems

#183

Post by bombcar »

paxys wrote: post #79
ghuntley wrote: post #23

> "Feel free to share but please don’t credit me: > at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a > website, I am taken to a REDACTED page with a > pornographic image and the message “F** you wankers.” From: https://twitter.com/samwcyo/status/1570583182726266883

> at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a How does an employee know if that message is legitimate or not? If you break into a secure system, mass-emailing all employees saying "URGENT: WE HAVE BEEN HACKED. PLEASE EMAIL YOUR PASSWORD AND SSN TO THIS ADDRESS IMMEDIATELY." is sure to get some percentage of success.

In general you can trust a “stop doing the thing” email blast that appears legitimate but should be highly suspicious of the same asking you to do the thing.

Re: Uber investigating breach of its computer systems

#184

Post by bombcar »

_Adam wrote: post #164
hotpotamus wrote: post #45

Earlier quoted context omitted.

You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no…

The best approach is to assume there's a renegade employee constantly trying to screw the company over. Granularity of permissions should be set to minimize the blast radius to the absolute minimum they need to do their job.

Hell, you should offer an internal bounty to any employee who reports “I got access to something I shouldn’t need”.

Re: Uber investigating breach of its computer systems

#185

Post by fjfbsufhdvfy »

_Adam wrote: post #162
_8j50 wrote: post #98

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…

The powershell script is a minor part of the screw up. The real issues are multitude... 1) hardcoding actual production credentials in a script at all. Seriously what the fuck. 2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security. The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assu…

I'm curious what's the alternative if the script must have those credentials to do its job.

Re: Uber investigating breach of its computer systems

#186

Post by FeistySkink »

ghuntley wrote: post #23

> "Feel free to share but please don’t credit me: > at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a > website, I am taken to a REDACTED page with a > pornographic image and the message “F** you wankers.” From: https://twitter.com/samwcyo/status/1570583182726266883

I see somebody else got hit with a cancellation fee and took it personally.

Re: Uber investigating breach of its computer systems

#187

Post by fjfbsufhdvfy »

allset_ wrote: post #72
beardedwizard wrote: post #44

(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed her…

> many applications do not support webauthn, full stop You don't need the application to, only your IDP. Everything should be SSO from there.

What if that application doesn't support that setup either? So many services online barely manage to let you setup TOTP, nothing like this...

Re: Uber investigating breach of its computer systems

#188

Post by marcinzm »

arkadiyt wrote: post #2

Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems

>Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa)

Even using certificate based authentication for VPN along with their existing MFA would have prevented this. Unless the attacker compromised the employee's laptop in which case nothing would stop that.

Re: Uber investigating breach of its computer systems

#189

Post by smeej »

junon wrote: post #147

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at…

OneLogin is fine and all, but why not protect your OneLogin with a hardware key?

Re: Uber investigating breach of its computer systems

#190

Post by marcinzm »

junon wrote: post #147

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at…

>No MFA protects against social engineering (no, not even ____ - don't try to convince me).

Certain MFAs can protect against more types of attacks than others. You covering your head in the sand when people point that out doesn't change that fact but merely indicates you prefer feeling right to being right.

>as I remember the security team being somewhat averse to them

So you're saying that the security team was averse to the thing that would have prevented this hack? And that means we shouldn't put blame on them?

Post reply on HN