Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

191–200 of 327 posts

Re: Uber investigating breach of its computer systems

#191

Post by bad416f1f5a2 »

fjfbsufhdvfy wrote: post #185
_Adam wrote: post #162

Earlier quoted context omitted.

The powershell script is a minor part of the screw up. The real issues are multitude... 1) hardcoding actual production credentials in a script at all. Seriously what the fuck. 2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security. The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assu…

I'm curious what's the alternative if the script must have those credentials to do its job.

Environment variables are an easy first pass at ensuring a script at rest isn’t dangerous.

Re: Uber investigating breach of its computer systems

#192

Post by zikzak »

rsynnott wrote: post #166
j1elo wrote: post #148

Earlier quoted context omitted.

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

> I just lost the purse with my phone, or my device broke, or got stolen, or whatever, and need the damn TOTP code to telework _right now_. So, wait for a new authenticator device to be shipped to you. Like, if the work laptop broke, you'd presumably have to wait on a replacement for that, too...

The way I view these types of objections - I know one or two people who have lost their wallet more than a couple times in their live ("I need new ID!") and the rest of the people I have know have NEVER lost their wallet. Even people who have their wallet stolen often recover it later (thieves remove valuable part and throw it away so they aren't caught with it). We probably shouldn't design our security procedures around the very, very small number of people who have lost their wallet a few times as an adult.

Re: Uber investigating breach of its computer systems

#193

Post by Dowwie »

sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

You think that it is worth repeating that multifactor authentication not based on the latest unproven marketing hype technology, Webauthn, is dangerously insecure? You don't know what you're talking about.

Re: Uber investigating breach of its computer systems

#194

Post by arbitrage »

fjfbsufhdvfy wrote: post #185
_Adam wrote: post #162

Earlier quoted context omitted.

The powershell script is a minor part of the screw up. The real issues are multitude... 1) hardcoding actual production credentials in a script at all. Seriously what the fuck. 2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security. The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assu…

I'm curious what's the alternative if the script must have those credentials to do its job.

encryption based authentication (keys or certs) that can be revoked.

welcome to 1996.

Re: Uber investigating breach of its computer systems

#195

Post by highwaylights »

traceroute66 wrote: post #159
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> So if your workplace is letting you authenticate with SMS codes There's an old saying in photography, "the best camera is the one you have with you". IMHO its very much the same thing with 2FA. Any 2FA is better than no 2FA. Sure some 2FA options are more secure than others, but by the same token, there's also a scary number of websites out there that have zero 2FA options. Others make it inordinately difficult to…

> Any 2FA is better than no 2FA.

False.

SMS 2FA is significantly, uncategorically, undeniably worse than no 2FA at all.

If your SIM card is hijacked, most websites/companies will quite happily let the impostor click a "Forgot password" link and get a SMS code to verify their identity, which will allow them into the account to take/change whatever other details they want at that time.

Re: Uber investigating breach of its computer systems

#196

Post by traceroute66 »

berdario wrote: post #174
j1elo wrote: post #148

Earlier quoted context omitted.

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

> ...or whatever, and need the damn TOTP code to telework _right now_. Do you? Really? "Your lack of planning is not my emergency" Unless you're the founder+owner, I'd expect that tech support at your company wouldn't expedite your access request just because you feel entitled to it. Will a million dollar sales call fail and/or have to be rescheduled because you didn't have 2FA access? You should accept the responsib…

> Will a million dollar sales call fail and/or have to be rescheduled because you didn't have 2FA access? You should accept the responsibility, apologise with whoever it is that you let down and move on.

Spoken as someone who has clearly never had any tech duties in the financial sector.

You don't understand what time critical means until a dealer's access stops working / computer freezes 10 minutes before market close. ;-)

That could easily cost millions. That could easily loose the company the entire account.

And god help you if the market moves overnight and you were unable to get the trade on ...

A grovelling apology to the client might help avoid a complaint to the regulator, but you're unlikely to keep their business.

So yes, there will always be genuine need for IT to be able to bypass a user's 2FA, because its certain that user won't be able to wait until you send them a new Yubikey in the post.

And yes, financial companies are also well aware of phishing / SE and take appropriate steps to ID user.

Re: Uber investigating breach of its computer systems

#197

Post by ThePadawan »

fjfbsufhdvfy wrote: post #185
_Adam wrote: post #162

Earlier quoted context omitted.

The powershell script is a minor part of the screw up. The real issues are multitude... 1) hardcoding actual production credentials in a script at all. Seriously what the fuck. 2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security. The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assu…

I'm curious what's the alternative if the script must have those credentials to do its job.

As sibling points out: Don't authorize the script, authorize whoever is executing the script.

Re: Uber investigating breach of its computer systems

#198

Post by batch12 »

Dowwie wrote: post #193
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

You think that it is worth repeating that multifactor authentication not based on the latest unproven marketing hype technology, Webauthn, is dangerously insecure? You don't know what you're talking about.

I will grant you that the parent's opinion is a little strong, but fundamentally, they have a point. The weakness here is the human. Standards like this take make social engineering attacks much more difficult.

With that said, MFA in some form is better than none. However, some implementations provide better security than others (of course).

Re: Uber investigating breach of its computer systems

#199

Post by neilv »

berdario wrote: post #174
j1elo wrote: post #148

Earlier quoted context omitted.

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

> ...or whatever, and need the damn TOTP code to telework _right now_. Do you? Really? "Your lack of planning is not my emergency" Unless you're the founder+owner, I'd expect that tech support at your company wouldn't expedite your access request just because you feel entitled to it. Will a million dollar sales call fail and/or have to be rescheduled because you didn't have 2FA access? You should accept the responsib…

I'm sure it can be frustrating, the idea of employees who don't seem to be sufficiently diligent, and then expect IT to drop everything to fix problems that the employee caused.

Ideally, the IT department is empowered to work proactively on effective infosec, for all of the company's real-world situations.

Then the standard for responsibility of each non-IT employee is only good faith compliance with what IT dept. told them -- not to be an IT expert who can reason about infosec tactics and strategy.

Re: Uber investigating breach of its computer systems

#200

Post by notakio »

hotpotamus wrote: post #45
fjfbsufhdvfy wrote: post #35

Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?

You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no…

Obscurity, by itself, may be an ineffective security strategy, but it does provide an additional layer on top of other layers of security to improve things, overall. There's a Spafford quote on this, but I'm failing to find it. Let's just pretend it's like what I said, but more eloquent.
Post reply on HN