Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

291–300 of 327 posts

Re: Uber investigating breach of its computer systems

#291

Post by pm90 »

softveda wrote: post #123
vishnugupta wrote: post #56

Earlier quoted context omitted.

+100 Not only is it a cost center it’s also seen as a hindrance to the fast progress. Rarely will you come across an exec who takes security seriously. For them it’s just a checkbox at best and an obstacle at worst. I’m speaking about application security though. It’s possible that IT sec, physical security etc are taken more seriously.

That is why government intervention is needed. Australia is proposing significant changes to its cyber security framework and legislation. https://www.homeaffairs.gov.au/reports-and-pubs/files/streng... Mandatory cyber security obligations backed by penalties and direct government intervention for critical national security companies. https://www.homeaffairs.gov.au/reports-and-pubs/files/exposu...

We kinda sorta already have laws designed to make software systems secure, but they aren't really followed in spirit. I suspect what's needed is an expansion of NIST-like bodies, more concrete specifications for what is and isn't allowed (e.g. like seatbelt regulations) and such.

Ultimately, its going to be a cat and mouse game. A really determined hacker will find a way. But admin users with permissions over everything, passwords/encryption keys stored in plaintext etc. these are things that we can probably patch up really well, and force companies that can't afford to do that to (justifiably) go out of business.

Re: Uber investigating breach of its computer systems

#292

Post by pm90 »

bombcar wrote: post #20
pm90 wrote: post #15

Earlier quoted context omitted.

Quoted post unavailable.

And even when you do get it setup you end up having to make all sorts of exceptions for various people who can’t be told “no”.

Painfully true. And once that exception is made, its easy to poke holes for more requests, until the security systems becomes somewhat pointless.

Re: Uber investigating breach of its computer systems

#293

Post by marcosdumay »

breser wrote: post #286
acdha wrote: post #278

Earlier quoted context omitted.

If you haven't dealt with this before, it's not calling support and social-engineering someone into hitting the reset button. The last time I knew someone who had to reset an AWS root account password (broken Yubikey), it required multiple phone calls AWS initiated to the billing & technical contacts (which can only be set by root so an attacker can't easily change them) to confirm intention and then they had to sign…

You do not have to even talk to AWS to remove the MFA from the root account. You simply need access to the phone number on the account (though there are ways around the phone number, see below) and the email address for the root account. It's been a little over a year since I've done it but as I recall this is how it goes. You receive an email with a link that takes you to a site that starts a verification process vi…

Ok, that's not trivial to hack, but it's in no way more secure than accepting a few more backup tokens.

Both email and phone numbers have widely known and exploited vulnerabilities that won't ever be fixed (worse if the phone part is only SMS). Requiring both at the same time is OKish, but not any exemplary security.

Re: Uber investigating breach of its computer systems

#294

Post by highwaylights »

addingnumbers wrote: post #268
highwaylights wrote: post #195

Earlier quoted context omitted.

> Any 2FA is better than no 2FA. False. SMS 2FA is significantly, uncategorically, undeniably worse than no 2FA at all. If your SIM card is hijacked, most websites/companies will quite happily let the impostor click a "Forgot password" link and get a SMS code to verify their identity, which will allow them into the account to take/change whatever other details they want at that time.

> most websites/companies will quite happily let the impostor click a "Forgot password" link and get a SMS code to verify their identity That's not 2FA. There is one single factor there, the SMS code. SMS 2FA does not require you to have a 1FA backdoor, so you can't claim the latter is an inherent fault of the former. For example, pairing "enter the SMS code" with "click the link we sent to your backup e-mail address…

You’re right and fair enough.

I do feel though that SMS porting is such a lax system that using it as an authentication factor leads you into a lot of (SMS && social-engineering) situations that would be more preventable if SMS was not involved.

I say this fully realising that in this scenario the party allowing allowing these attacks to work due to poor understanding or lack of proper checks is the real problem.

Re: Uber investigating breach of its computer systems

#295

Post by breser »

marcosdumay wrote: post #293
breser wrote: post #286

Earlier quoted context omitted.

You do not have to even talk to AWS to remove the MFA from the root account. You simply need access to the phone number on the account (though there are ways around the phone number, see below) and the email address for the root account. It's been a little over a year since I've done it but as I recall this is how it goes. You receive an email with a link that takes you to a site that starts a verification process vi…

Ok, that's not trivial to hack, but it's in no way more secure than accepting a few more backup tokens. Both email and phone numbers have widely known and exploited vulnerabilities that won't ever be fixed (worse if the phone part is only SMS). Requiring both at the same time is OKish, but not any exemplary security.

For what it's worth the phone portion is a voice call where you have to enter a number with touchtone.

Re: Uber investigating breach of its computer systems

#296

Post by alldayeveryday »

vittygreen wrote: post #279
alldayeveryday wrote: post #245

Earlier quoted context omitted.

> So is it possible this is a fake breach in order to scrub further damaging evidence of others involved in the original 2016 cover up? Can you elaborate what scrub means in this context? In what ways would this breach cover up the 2016 breach? Would the prosecutors suddenly lose their memory of the 2016 breach? Would evidence suddenly go missing?

By locking out your company and chat mediums you can search and purge evidence or artifacts in hopes to not expose further corruption or others involved in the past one. While treating it as a real threat to feds and public. In the org cover up they hired the attackers as employees with modified NDAs as per the testimony given on the 14th. So with that info I wouldn't put it past them as will as the ftc passing gig w…

> In the org cover up they hired the attackers as employees with modified NDAs as per the testimony given on the 14th.

Do you have citation for this?

Re: Uber investigating breach of its computer systems

#297

Post by cco »

j1elo wrote: post #148
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

> Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine.

Apple is solving for this exact request with Apple Passkeys; it is just WebAuthn under the hood with cloud backup, multi-device, and sharing built in.

Re: Uber investigating breach of its computer systems

#298

Post by wglb »

junon wrote: post #147

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at…

> Yubikeys were phased out early on

What security team on earth would be against these?

Re: Uber investigating breach of its computer systems

#299

Post by wglb »

kaesar14 wrote: post #31

Forgive me for being frank, but how do people seriously fall for phishing scams? How do you work at a company like Uber and do something like click on a link in an email to claim a gift card? It’s insane to me.

There is nobody that it totally immune to phishing. No one.

Re: Uber investigating breach of its computer systems

#300

Post by acdha »

breser wrote: post #286
acdha wrote: post #278

Earlier quoted context omitted.

If you haven't dealt with this before, it's not calling support and social-engineering someone into hitting the reset button. The last time I knew someone who had to reset an AWS root account password (broken Yubikey), it required multiple phone calls AWS initiated to the billing & technical contacts (which can only be set by root so an attacker can't easily change them) to confirm intention and then they had to sign…

You do not have to even talk to AWS to remove the MFA from the root account. You simply need access to the phone number on the account (though there are ways around the phone number, see below) and the email address for the root account. It's been a little over a year since I've done it but as I recall this is how it goes. You receive an email with a link that takes you to a site that starts a verification process vi…

It's possible that even though we are not using GovCloud they had additional precautions enabled for us (this was a few years back). My coworker vividly remembers having to wait for the notary to show up.
Post reply on HN