Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

221–230 of 327 posts

Re: Uber investigating breach of its computer systems

#221

Post by Tostino »

beardedwizard wrote: post #118
dogecoinbase wrote: post #68

Earlier quoted context omitted.

I don't have a specific alternative, but I think that if it's not possible to be effective in a role, one should decline it. It's possible to be an effective SWE while still writing (and hopefully also sometimes fixing) bugs.

One could argue the security industry exists because of the failings of computer science. Maybe swes should start facing legal liability for thier failings like most other engineering disciplines. We would see this problem change overnight.

By productivity going completely down the drain.

Re: Uber investigating breach of its computer systems

#222

Post by UncleMeat »

j1elo wrote: post #148
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

Your bus factor is the problem here, not your 2FA system.

"I absolutely need full access to systems while working on a random device using only my password" means that phishing gives all the keys to the kingdom and that you don't have systems in place to make sure things work when people go on vacation.

Re: Uber investigating breach of its computer systems

#223

Post by jsnell »

reissbaker wrote: post #152
j1elo wrote: post #148

Earlier quoted context omitted.

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

I think the tradeoff between "the entire company is breached" vs "I lost my device while on vacation and I have a tight deadline" is probably best geared to help prevent the former than the latter. (Webauthn by design requires physical hardware tokens, not cloud storage.)

> (Webauthn by design requires physical hardware tokens, not cloud storage.)

That's not true. As an obvious reductio ad absurdum, you could just build a fake USB driver that presents as a security key. But more practically, I'm pretty sure that iOS the Webauthn secrets are synced cross-device via iCloud.

Re: Uber investigating breach of its computer systems

#224

Post by michaelt »

zikzak wrote: post #192
rsynnott wrote: post #166

Earlier quoted context omitted.

> I just lost the purse with my phone, or my device broke, or got stolen, or whatever, and need the damn TOTP code to telework _right now_. So, wait for a new authenticator device to be shipped to you. Like, if the work laptop broke, you'd presumably have to wait on a replacement for that, too...

The way I view these types of objections - I know one or two people who have lost their wallet more than a couple times in their live ("I need new ID!") and the rest of the people I have know have NEVER lost their wallet. Even people who have their wallet stolen often recover it later (thieves remove valuable part and throw it away so they aren't caught with it). We probably shouldn't design our security procedures a…

"User lost their token/forgot their password/lost access to their e-mail/lost their phone/changed their phone number/changed their mailing address" may only be 0.1% of users - but it's 100% of social engineering attacks :)

Re: Uber investigating breach of its computer systems

#225

Post by lapser »

fjfbsufhdvfy wrote: post #185
_Adam wrote: post #162

Earlier quoted context omitted.

The powershell script is a minor part of the screw up. The real issues are multitude... 1) hardcoding actual production credentials in a script at all. Seriously what the fuck. 2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security. The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assu…

I'm curious what's the alternative if the script must have those credentials to do its job.

Besides what the sibling comments said, it's very unlikely to that any script needs keys to the kingdom. Credentials should be created with limited access, just enough for the script to do its thing.

Re: Uber investigating breach of its computer systems

#226

Post by UncleMeat »

_Adam wrote: post #164
hotpotamus wrote: post #45

Earlier quoted context omitted.

You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no…

The best approach is to assume there's a renegade employee constantly trying to screw the company over. Granularity of permissions should be set to minimize the blast radius to the absolute minimum they need to do their job.

This approach is possible but increases the complexity of your problem by enormous amounts. I know of only a very tiny number of companies that have an active goal of preventing rogue insider threats in a serious way. And the solutions do meaningfully inhibit developer productivity.

Re: Uber investigating breach of its computer systems

#227

Post by ClumsyPilot »

traceroute66 wrote: post #196
berdario wrote: post #174

Earlier quoted context omitted.

> ...or whatever, and need the damn TOTP code to telework _right now_. Do you? Really? "Your lack of planning is not my emergency" Unless you're the founder+owner, I'd expect that tech support at your company wouldn't expedite your access request just because you feel entitled to it. Will a million dollar sales call fail and/or have to be rescheduled because you didn't have 2FA access? You should accept the responsib…

> Will a million dollar sales call fail and/or have to be rescheduled because you didn't have 2FA access? You should accept the responsibility, apologise with whoever it is that you let down and move on. Spoken as someone who has clearly never had any tech duties in the financial sector. You don't understand what time critical means until a dealer's access stops working / computer freezes 10 minutes before market clo…

this does not even apply to Uber in any way.

There is no job at uber that could not be done by a coklwague that has access. There is no situation where 10 million delay in uber loses you 100 million dollars

Re: Uber investigating breach of its computer systems

#228

Post by Rafert »

reissbaker wrote: post #152
j1elo wrote: post #148

Earlier quoted context omitted.

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

I think the tradeoff between "the entire company is breached" vs "I lost my device while on vacation and I have a tight deadline" is probably best geared to help prevent the former than the latter. (Webauthn by design requires physical hardware tokens, not cloud storage.)

WebAuthn does not mandate any kind of form factor[1], external tokens use CTAP for USB/Bluetooth/NFC, Apple FaceID/TouchID and Windows Hello using proprietary interfaces with the built-in hardware. Blink-based browsers ships with a virtual authenticator for debugging[2] and there are a few more[3].

Apple and Google already announced cloud syncing earlier this year, using "passkey" as a friendlier term for end-users. QR codes already allow for cross-ecosystem non-synced use cases, like using my personal Android phone to log in an account with my work Macbook. https://securitycryptographywhatever.buzzsprout.com/1822302/... is a good listen to catch up on the latest developments.

[1]: https://www.w3.org/TR/webauthn-2/#authenticator-model [2]: https://developer.chrome.com/docs/devtools/webauthn/ [3]: https://github.com/herrjemand/awesome-webauthn#software-auth...

Re: Uber investigating breach of its computer systems

#229

Post by acdha »

chinathrow wrote: post #209
tylerhou wrote: post #132

Earlier quoted context omitted.

Backup key on your keychain.

Do you mean a physical key?

I can't speak for them but that's exactly what I do with a Yubikey on my personal keys & work badgecard lanyard. My rationale is that the physical key prevents remote attacks since they can't use the token and anyone who finds/steals my keys won't have the password. Scenarios where the attacker has both aren't on my personal radar — that's the kind of situation where you're looking at things like duress codes.

Re: Uber investigating breach of its computer systems

#230

Post by sullivanmatt »

Dowwie wrote: post #193
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

You think that it is worth repeating that multifactor authentication not based on the latest unproven marketing hype technology, Webauthn, is dangerously insecure? You don't know what you're talking about.

I'm a security professional with a decade and a half of hands-on, real world experience. My most recent position being the product manager for Identity and Access Management for a leading B2B SaaS, dealing with real world attacks from extremely sophisticated threat actors. I assure you I know what I'm talking about, I've lived and breathed it every day for many years and have followed these standards since their initial drafts.

If you have knowledge on superior ways to protect users from MFA passthrough, please share it. I am always happy to learn about better ways of doing things. But contrarian bandwagoning without providing effective alternatives isn't helpful.

Post reply on HN