Uber investigating breach of its computer systems • Hacker News Board

Re: Uber investigating breach of its computer systems

#231

Post by numbsafari » Fri, Sep 16, 2022, 1:07 PM UTC

fjfbsufhdvfy wrote: post #185

_Adam wrote: post #162

Earlier quoted context omitted.

The powershell script is a minor part of the screw up. The real issues are multitude... 1) hardcoding actual production credentials in a script at all. Seriously what the fuck. 2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security. The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assu…

I'm curious what's the alternative if the script must have those credentials to do its job.

As another commenter pointed out: you authorize the executor of the script, not the script itself.

Consider how an AWS instance runs code that is able to ... talk back to the rest of the AWS system.

For code that is not being directly run by a tethered meatball, use some form of workload identity [1].

When you are talking to another system that that can't understand your workload identity (legacy apis, etc.), keep those credentials in a tool like Vault[2], Secret Manager[3], etc. That system can/should handle credential rotation wherever possible, but it also ensures that the workload running the script is authorized to access the credentials in question. This is far superior to passing via env vars, but even that is better than hard-coding in the script itself. Oh, and using a memory-backed mount that contains those vars is better than env vars because there's less risk of leaking those when you fork.

Key points:

- externalize all secrets

- prefer workload identity

- prefer a workload identity aware secret store / manager

- fall back to fs mounted secrets and then env vars

[1] https://spiffe.io

[2] https://www.vaultproject.io

[3] https://docs.aws.amazon.com/secretsmanager/latest/userguide/...

edit: formatting now that I'm on a desktop

Re: Uber investigating breach of its computer systems

#232

Post by [deleted] » Fri, Sep 16, 2022, 1:12 PM UTC

hotpotamus wrote: post #45

fjfbsufhdvfy wrote: post #35

Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?

You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no…

[deleted]

Re: Uber investigating breach of its computer systems

#233

Post by mellavora » Fri, Sep 16, 2022, 1:12 PM UTC

Semaphor wrote: post #211

protomyth wrote: post #202

Earlier quoted context omitted.

Any 2FA is better than no 2FA That's simply false because of the poor customer service of the providers and fates of many phones.

How is that false? Name a single example where SMS 2FA is worse than none. And just because it will always come up: 2FA, not treating the second factor as only factor.

when your sim gets hijacked and someone steals your entire bitcoin wallet?

worse than none because it "justifies" being sloppy with the first factor (i.e. account password).

Re: Uber investigating breach of its computer systems

#234

Post by hamburglar » Fri, Sep 16, 2022, 1:15 PM UTC

happyopossum wrote: post #212

traceroute66 wrote: post #196

Earlier quoted context omitted.

> Will a million dollar sales call fail and/or have to be rescheduled because you didn't have 2FA access? You should accept the responsibility, apologise with whoever it is that you let down and move on. Spoken as someone who has clearly never had any tech duties in the financial sector. You don't understand what time critical means until a dealer's access stops working / computer freezes 10 minutes before market clo…

The answer there, clearly, is to not have an individual be a potential SPOF. If failure of that kind of support costs millions of dollars, you absolutely need to have the ‘walked in front of a bus’ scenarios worked out.

Unfortunately, some places' idea of having this problem "worked out" is to react by making the SPOF's life miserable with punishment or firing. And the bus scenario is "covered" by having the scapegoat be dead. Not a good strategy for the business, of course, but it's definitely the reality at some places. Actually having the SPOF scenarios prevented would be a much more mature approach.

Re: Uber investigating breach of its computer systems

#235

Post by Semaphor » Fri, Sep 16, 2022, 1:21 PM UTC

mellavora wrote: post #233

Semaphor wrote: post #211

Earlier quoted context omitted.

How is that false? Name a single example where SMS 2FA is worse than none. And just because it will always come up: 2FA, not treating the second factor as only factor.

when your sim gets hijacked and someone steals your entire bitcoin wallet? worse than none because it "justifies" being sloppy with the first factor (i.e. account password).

Okay, I guess if you stretch that hard you can reach your goal.

edit: Your first sentence is meaningless because that is just as stolen with no 2FA.

Re: Uber investigating breach of its computer systems

#236

Post by hardnose » Fri, Sep 16, 2022, 1:21 PM UTC

Shank wrote: post #27

arkadiyt wrote: post #2

Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems

> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it…

Ding ding ding. This whole incident is symptomatic of eggshell security - crunchy exterior with a delicious gooey inside once you break through it.

Hedgehogs dont have this problem.

Re: Uber investigating breach of its computer systems

#237

Post by vinay_ys » Fri, Sep 16, 2022, 1:24 PM UTC

j1elo wrote: post #148

sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

To start with, let's say you have your corp laptop and corp phone (both are access devices and both should have device bound certificates), and your yubikey for webauthn, and your corp photo-badge and your government issued photo identity (all three are authentication factors).

Let's say you are traveling and you lost one or both of your access devices. First immediate step is contact your security hotline and notify them that you lost the device(s). They should immediately remote-wipe/disable said devices.

If you are visiting another branch office of your company, local IT should be able to physically verify you with your government issued ID and your corp badge and issue you a temporary laptop/phone and get you basic access privileges.

If you need high-trust access, it should require more verification steps (your manager has to confirm you are not on vacation and that it is really you who is meeting with the IT shop etc), and more elapsed time (this sucks but it is important to slow things down anytime primary access devices are reissued due to loss/theft).

Obviously, if you are a super critical person and have become a single point of failure, that's bad.

Re: Uber investigating breach of its computer systems

#238

Post by Dowwie » Fri, Sep 16, 2022, 1:26 PM UTC

acdha wrote: post #215

Dowwie wrote: post #193

Earlier quoted context omitted.

You think that it is worth repeating that multifactor authentication not based on the latest unproven marketing hype technology, Webauthn, is dangerously insecure? You don't know what you're talking about.

> not based on the latest unproven marketing hype technology, Webauthn WebAuthn is an ongoing project but the history goes back almost a decade to U2F, and the ongoing work has been carefully reviewed by a number of industry heavy-hitters. We know that it’s robust against phishing, too, which is why it’s so relevant to this conversation. I’d also like to know more about your rationale for describing a system all of t…

Maybe "unproven" was a poor choice of words. I'd be willing to go so far as to say that it is "proving" itself as bleeding edge technology. However, if measured by adoption and risk-taking, it is largely unproven.

The history may go back almost a decade, as experimental technologies driven by industry working groups tend to do, but that work does not extend beyond the theoretical. If Facebook and Google implemented WebAuthn, they're still not staking their reputations on it. If they did, we wouldn't be using password-based logins nor MFA. Instead, they're slowly testing the waters in the real world, waiting to see how hackers respond to it. Consequently, WebAuthn remains on the bleeding edge, in the very early part of the adoption curve as it proves itself.

Re: Uber investigating breach of its computer systems

#239

Post by brianoconnor » Fri, Sep 16, 2022, 1:28 PM UTC

philliphaydon wrote: post #110

_8j50 wrote: post #98

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…

There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…

The benefit over SMS or Authenticator apps is that it doesn't pre-fill codes (and passwords) if the URL doesn't match. But yeah, I also have mixed feelings about it. Just slightly better than SMS maybe.

Re: Uber investigating breach of its computer systems

#240

Post by moolcool » Fri, Sep 16, 2022, 1:36 PM UTC

junon wrote: post #147

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at…

> this could happen to any company (yes, it could, even yours - don't try to convince me otherwise)

There's a lot of cognitive dissonance in discussion around this story IMO. Nowadays I assume everyone has been or will be pwned, because no breech surprises me anymore. Any small gap can and will be exploited, and as organisations grow the surface area only gets larger and larger. The only way to truly secure data is to not put it on the internet from the jump. For every breach that's published, there's likely a dozen that we never find out about.