Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

201–210 of 327 posts

Re: Uber investigating breach of its computer systems

#201

Post by vel0city »

highwaylights wrote: post #195
traceroute66 wrote: post #159

Earlier quoted context omitted.

> So if your workplace is letting you authenticate with SMS codes There's an old saying in photography, "the best camera is the one you have with you". IMHO its very much the same thing with 2FA. Any 2FA is better than no 2FA. Sure some 2FA options are more secure than others, but by the same token, there's also a scary number of websites out there that have zero 2FA options. Others make it inordinately difficult to…

> Any 2FA is better than no 2FA. False. SMS 2FA is significantly, uncategorically, undeniably worse than no 2FA at all. If your SIM card is hijacked, most websites/companies will quite happily let the impostor click a "Forgot password" link and get a SMS code to verify their identity, which will allow them into the account to take/change whatever other details they want at that time.

That's a poor password reset process, not SMS 2FA. You can do SMS 2FA without having that terrible reset process, you can have a terrible SMS reset process without SMS 2FA. They're two different concepts.

Re: Uber investigating breach of its computer systems

#202

Post by protomyth »

traceroute66 wrote: post #159
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> So if your workplace is letting you authenticate with SMS codes There's an old saying in photography, "the best camera is the one you have with you". IMHO its very much the same thing with 2FA. Any 2FA is better than no 2FA. Sure some 2FA options are more secure than others, but by the same token, there's also a scary number of websites out there that have zero 2FA options. Others make it inordinately difficult to…

Any 2FA is better than no 2FA

That's simply false because of the poor customer service of the providers and fates of many phones.

Re: Uber investigating breach of its computer systems

#203

Post by Dowwie »

insanitybit wrote: post #107
_8j50 wrote: post #98

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…

Because auth to the VPN should have required a device cert and/ or unphishable 2FA. Also because the SMS phish was one of the first details leaked. Obviously access to the VPN shouldn't also be a full system compromise. There are many things to criticize here, we can point all of them out.

I'm curious what your take is on the incident detection side of things. Would Grapl have helped Uber detect anomalies?

Re: Uber investigating breach of its computer systems

#204

Post by chromatin »

mdeeks wrote: post #46
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

It’s too bad the user experience across devices sucks. The best experience by far is a yubikey nano since it is mostly permanently attached to your laptop. It’s always there and you just quickly tap it. Love it. Of course that doesn’t work with my iPhone. So I guess I need a second NFC yubikey that stays on my key chain in my pocket (which I don’t have since I don’t carry keys.). So then I have to remember to registe…

And some sites like AWS management console don’t allow you to register more than one key :/

Re: Uber investigating breach of its computer systems

#206

Post by notakio »

_Adam wrote: post #164
hotpotamus wrote: post #45

Earlier quoted context omitted.

You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no…

The best approach is to assume there's a renegade employee constantly trying to screw the company over. Granularity of permissions should be set to minimize the blast radius to the absolute minimum they need to do their job.

Part of what I do first at any new employer is ask myself the question, "if I wanted to burn all of this to the ground, how would I do it?" I generally don't share the fact that I'm going through this little thought experiment with my management, but it helps triage what's currently "broken", and gives me a clearer focus on what needs to be fixed.

If I'm thinking about it, I can be assured that someone with differing motivations likely already has, or soon will be thinking about the same.

Re: Uber investigating breach of its computer systems

#208

Post by oblio »

madeofpalk wrote: post #173
traceroute66 wrote: post #159

Earlier quoted context omitted.

> So if your workplace is letting you authenticate with SMS codes There's an old saying in photography, "the best camera is the one you have with you". IMHO its very much the same thing with 2FA. Any 2FA is better than no 2FA. Sure some 2FA options are more secure than others, but by the same token, there's also a scary number of websites out there that have zero 2FA options. Others make it inordinately difficult to…

That's like saying MD5 is fine for hashing passwords, because it's better than plaintext.

> That's like saying MD5 is fine for hashing passwords, because it's better than plaintext.

If for whatever reason you can't have anything else, MD5 is obviously better than plaintext. Not fine, but better.

With passwords you don't have external dependencies but with MFA, you do. Things are more complicated and real life is messy.

Re: Uber investigating breach of its computer systems

#210

Post by marcinzm »

dx034 wrote: post #145
cddotdotslash wrote: post #8

They could be fake, of course, but this thread[1] of screenshots is pretty bad... internal tools, Slack Admin, Google Workspace admin, an AWS account showing admin permissions. [1] https://twitter.com/Savitar0x01/status/1570580235716014081

And as other people have already written, that's the main issue. Not that someone got compromised, but that passwords for admin accounts to all those services were stored on a network share.

Security is like an onion and in this case every layer was rotten.

* Social engineering successfully got someone

* MFA approach did not protect from a simple fake webpage tunneling hack

* VPN was based on a password rather than a certificate

* Network scan was not detected and stopped

* High level credentials were stored in a public file and not detected

* Abnormal credential usage was not detected and stopped

I probably missed a few but point there were many ways to stop this hack and all of them were broken. This wasn't some highly funded government operation that bypassed layers through clever approaches and expensive zero-day exploits.

Post reply on HN