Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

251–260 of 327 posts

Re: Uber investigating breach of its computer systems

#251

Post by Ensorceled »

saagarjha wrote: post #219
Ensorceled wrote: post #216

Earlier quoted context omitted.

How did you drop into the office to get a new key? Is your office eight time zones away from where you live?

Nope, I was traveling on business to a place with another office. This is true of a significant portion of business travel, no?

Perhaps, but what does this have to do with the situation you are responding to where the person WASN'T doing that.

I have literally never travelled to "another office" in my entire career. But then I've always worked for startups ...

Re: Uber investigating breach of its computer systems

#252

Post by mr_mitm »

uselpa wrote: post #178
technion wrote: post #89

Earlier quoted context omitted.

An underlying issue is that Microsoft Active Directory does not support MFA of any kind at all. That's why third party PAM vendors exist, but they don't really change the fact that you the most widely deployed authentication service in business is effectively run by password hashes. That's the whole reason we so commonly see the "mimikatz scraped a hash from RAM and it was all over" write up in incidents. Smartcards…

Worse: un-salted hashes.

Worst: The hashes are actually the passwords (for all services that allow NTLM authentication).

Re: Uber investigating breach of its computer systems

#253

Post by michaelt »

acdha wrote: post #215
Dowwie wrote: post #193

Earlier quoted context omitted.

You think that it is worth repeating that multifactor authentication not based on the latest unproven marketing hype technology, Webauthn, is dangerously insecure? You don't know what you're talking about.

> not based on the latest unproven marketing hype technology, Webauthn WebAuthn is an ongoing project but the history goes back almost a decade to U2F, and the ongoing work has been carefully reviewed by a number of industry heavy-hitters. We know that it’s robust against phishing, too, which is why it’s so relevant to this conversation. I’d also like to know more about your rationale for describing a system all of t…

Well, they have recently added a bunch of weirdness to the spec.

At one point U2F was simple - a USB token with a hardwired user presence button, providing a second factor alongside a username and password. Trivial to move between different computers and OSes. Secure even if the host OS can't be trusted. Physically unpluggable.

These days there's a mad variety of options. Options that are only secure if the host OS can be trusted. TPM-based options that are tied to a single laptop. Options like Windows Hello that are locked to a single OS vendor. Passwordless login, turning two factors into one. Copying credentials between devices, through the cloud. Sketchy low-cost biometric scanners.

For a security system, the latest versions sure are embracing a lot of complexity.

Re: Uber investigating breach of its computer systems

#254

Post by anarticle »

tpxl wrote: post #141
rodgerd wrote: post #33

Earlier quoted context omitted.

Given that Uber routinely tracked politicians and journos and shared it around the company, and had stood up toolsets to track and evade police so as to facilitate drivers dodging law enforcement, they always were organised crime.

> evade police so as to facilitate drivers dodging law enforcement Isn't this illegal as fuck?

It's only illegal if you get caught! :D

This was part of Uber's early strategy when cities responded with citing drivers of rideshare services. At this point, I've seen a rideshare stop in the center of an intersection with traffic to let people out, so maybe the cities were right in the end...

Re: Uber investigating breach of its computer systems

#255

Post by arianvanp »

reissbaker wrote: post #152
j1elo wrote: post #148

Earlier quoted context omitted.

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

I think the tradeoff between "the entire company is breached" vs "I lost my device while on vacation and I have a tight deadline" is probably best geared to help prevent the former than the latter. (Webauthn by design requires physical hardware tokens, not cloud storage.)

Not true. Apple Passkeys is cloud based; syncs through iCloud and is webauthn.

Nothing about the spec mandates physical hardware tokens. Software tokens work fine too. https://developer.apple.com/passkeys/

Re: Uber investigating breach of its computer systems

#256

Post by Sebguer »

vittygreen wrote: post #48

The other thing of note with this is timing as yesterday an ex attorney testified against the ex security chief for the 2016 breach cover up. And the next day there is this breach. So based on the damaging nature of the testimony where further discovery could be needed it seems a bit too convenient to have a breach the next day. So is it possible this is a fake breach in order to scrub further damaging evidence of ot…

ah yes the famous "have a bigger breach so people stop worrying about your smaller breach" strategy

Re: Uber investigating breach of its computer systems

#257

Post by cddotdotslash »

paxys wrote: post #79
ghuntley wrote: post #23

> "Feel free to share but please don’t credit me: > at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a > website, I am taken to a REDACTED page with a > pornographic image and the message “F** you wankers.” From: https://twitter.com/samwcyo/status/1570583182726266883

> at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a How does an employee know if that message is legitimate or not? If you break into a secure system, mass-emailing all employees saying "URGENT: WE HAVE BEEN HACKED. PLEASE EMAIL YOUR PASSWORD AND SSN TO THIS ADDRESS IMMEDIATELY." is sure to get some percentage of success.

It does make me wonder whether we’re headed towards some kind of “breach via chaos” scenario. Clearly the attackers have the cell phone numbers of employees. Suppose they started mass texting conflicting information? It’d be noisy as hell, but take 1000s of employees getting a never ending stream of texts, purporting to be from their employer, saying “don’t use Slack,” “don’t use email,” “here’s a Zoom bridge for incident response,” “oh and here’s an MFA notification you should accept.”

This could lead to a scenario where no one knows what to believe, internal systems are down, attackers are setting up fake IR channels to get even more info, etc. There’s no way most companies could weather an onslaught like that.

Re: Uber investigating breach of its computer systems

#259

Post by michaelt »

metadat wrote: post #41
kirbys-memeteam wrote: post #39

Earlier quoted context omitted.

Quoted post unavailable.

It sounds like you're experience has been at a small firm. At scale, 2fa and yubikeys are a no brainer with regard to risk vs reward/ safety. Do you think all security engineers or whatever you want to call them are total incompetent idiots? If yes, I can't help you. If no, then you don't need further explanation from me. Security requires a complex balancing act, and in this case they got it wrong, end of story. As…

Corporate security teams are built on three different traditions:

1. The policy/compliance tradition - the kind of people who looked at PCI-DSS and decided that was what they wanted to devote their life to. The accountants of the tech world. You've got resources and want to roll out U2F? That's not in the policy document, we'd rather spend the resources on this great audit of our suppliers' compliance that I've been planning....

2. The be-lazy-be-popular tradition - for the team that hires a guy to reduce other people's workload, not increase it. Resources to roll out U2F? I won't stop you if you've got the money to spend, but what we've got is probably enough - a lot of companies don't use U2F, you know.

3. The hacker tradition - the kind of people who see every real, exploitable vulnerability they find as proof of their 1337 status. They don't care if a policy document says you should disable paste, that's bad advice, don't do it. Rolling out U2F sounds like a great idea - but a lot of corporate environments will chase these types out, or curb their enthusiasm by ignoring their reports.

Perhaps kirbys-memeteam worked in companies with security teams that tended more towards traditions 1 and 2, while your employer's security team had more of tradition 3?

Re: Uber investigating breach of its computer systems

#260

Post by HyperSane »

j1elo wrote: post #148
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

Truly secure access to computers is simply not possible under those conditions. A hardware root of trust used to verify your identity is mandatory.
Post reply on HN