Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

301–310 of 327 posts

Re: Uber investigating breach of its computer systems

#301

Post by pyrale »

insanitybit wrote: post #107
_8j50 wrote: post #98

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…

Because auth to the VPN should have required a device cert and/ or unphishable 2FA. Also because the SMS phish was one of the first details leaked. Obviously access to the VPN shouldn't also be a full system compromise. There are many things to criticize here, we can point all of them out.

It is irrelevant though. If your whole multi-billion company folds like a wet towel when one user is compromised, the question isn't how that user is going to get pwned, it's when.

Relevant xkcd: https://xkcd.com/538/

If you really really want one user to control everything, maybe they should work on a desktop station with a guard at the door.

Re: Uber investigating breach of its computer systems

#302

Post by reissbaker »

Rafert wrote: post #228
reissbaker wrote: post #152

Earlier quoted context omitted.

I think the tradeoff between "the entire company is breached" vs "I lost my device while on vacation and I have a tight deadline" is probably best geared to help prevent the former than the latter. (Webauthn by design requires physical hardware tokens, not cloud storage.)

WebAuthn does not mandate any kind of form factor[1], external tokens use CTAP for USB/Bluetooth/NFC, Apple FaceID/TouchID and Windows Hello using proprietary interfaces with the built-in hardware. Blink-based browsers ships with a virtual authenticator for debugging[2] and there are a few more[3]. Apple and Google already announced cloud syncing earlier this year, using "passkey" as a friendlier term for end-users.…

You are correct, and I should have said "Webauthn is designed to rely on something you have" rather than saying "physical tokens," since the latter is confusing and could be taken to imply a form factor.

If you lose the things you have while on vacation, though, it will be inconvenient (which is what the OP seemed to be against, and what I meant to be responding to). I think for a corporate environment that inconvenience is a reasonable tradeoff.

Re: Uber investigating breach of its computer systems

#303

Post by pyrale »

cddotdotslash wrote: post #257
paxys wrote: post #79

Earlier quoted context omitted.

> at Uber, we got an “URGENT” email from IT security > saying to stop using Slack. Now anytime I request a How does an employee know if that message is legitimate or not? If you break into a secure system, mass-emailing all employees saying "URGENT: WE HAVE BEEN HACKED. PLEASE EMAIL YOUR PASSWORD AND SSN TO THIS ADDRESS IMMEDIATELY." is sure to get some percentage of success.

It does make me wonder whether we’re headed towards some kind of “breach via chaos” scenario. Clearly the attackers have the cell phone numbers of employees. Suppose they started mass texting conflicting information? It’d be noisy as hell, but take 1000s of employees getting a never ending stream of texts, purporting to be from their employer, saying “don’t use Slack,” “don’t use email,” “here’s a Zoom bridge for inc…

If you wait for an emergency to set up a continuity of operations plan and train your employees for it, then you won't get great results for that particular emergency.

Re: Uber investigating breach of its computer systems

#304

Post by _8j50 »

spydum wrote: post #280
_8j50 wrote: post #246

Earlier quoted context omitted.

So, on that, it is surprisingly difficult to get rid of hard coded credentials and funnily vendors like tychotic and hashicorp are supposed to prevent that by having some api thing that integrates with scripts. That said, tychotic,cyberark and pals that manage credentials almost always need domain admin. I think just moving to full AAD and azure key vault might be better but realistically this is the nature of the be…

the cute answer to all this is always: how do people think your service accesses the secret vault? its anlther credential. the real issues are tougher, like why does this one cred have access to all these other creds, and how or if they were auditing usage of that cred from authorized client devices.. but all of these problems take a lot of effort and care to solve. and as history has shown, you only have to mess up…

I agree but an api key for a PAM service will get you constrained access (ideally) to a specific resource instead of a kerberos ticket you can take with you as part of your ticket collection. It's supposed to be better but granting the resource permission like GCP does is probably better (but messier too).

Re: Uber investigating breach of its computer systems

#305

Post by vittygreen »

alldayeveryday wrote: post #296
vittygreen wrote: post #279

Earlier quoted context omitted.

By locking out your company and chat mediums you can search and purge evidence or artifacts in hopes to not expose further corruption or others involved in the past one. While treating it as a real threat to feds and public. In the org cover up they hired the attackers as employees with modified NDAs as per the testimony given on the 14th. So with that info I wouldn't put it past them as will as the ftc passing gig w…

> In the org cover up they hired the attackers as employees with modified NDAs as per the testimony given on the 14th. Do you have citation for this?

https://www.courthousenews.com/fired-uber-attorney-testifies... Sorry hired as part of their bug bounty program which is part of where that case is important as it could lead to the death of bug bounty programs potentially

Re: Uber investigating breach of its computer systems

#306

Post by twistedpair »

dx034 wrote: post #145
cddotdotslash wrote: post #8

They could be fake, of course, but this thread[1] of screenshots is pretty bad... internal tools, Slack Admin, Google Workspace admin, an AWS account showing admin permissions. [1] https://twitter.com/Savitar0x01/status/1570580235716014081

And as other people have already written, that's the main issue. Not that someone got compromised, but that passwords for admin accounts to all those services were stored on a network share.

I'm still confused. Why did people have username/password logins to the AWS console? Either require SSO login, or require HW tokens to get in as an AWS user. Then it doesn't matter if someone finds the password file, it's useless.

Re: Uber investigating breach of its computer systems

#307

Post by bmitc »

traceroute66 wrote: post #159
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> So if your workplace is letting you authenticate with SMS codes There's an old saying in photography, "the best camera is the one you have with you". IMHO its very much the same thing with 2FA. Any 2FA is better than no 2FA. Sure some 2FA options are more secure than others, but by the same token, there's also a scary number of websites out there that have zero 2FA options. Others make it inordinately difficult to…

> Ironically there's no 2FA option for HN either. ;-)

You can't even delete comments or your account on Hacker News, so it's not like it takes privacy or security seriously.

Re: Uber investigating breach of its computer systems

#308

Post by junon »

wglb wrote: post #298
junon wrote: post #147

Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at…

> Yubikeys were phased out early on What security team on earth would be against these?

Wasn't their decision. Was finance's. Blame them.

Re: Uber investigating breach of its computer systems

#309

Post by philliphaydon »

bwoodruff wrote: post #277
philliphaydon wrote: post #133

Earlier quoted context omitted.

That doesn't have anything to do with MFA. If for some reason your 1Password masterpass is compromised, the hacker has access to your passwords and your MFA tokens. If you use 1Password and say Authy (Assuming your Authy pass isn't in 1Password) or Google Authenticator. Then all services with MFA wont be compromised if the 1Password masterpass is...

Hi there! Not quite. An attacker would need either your account password AND an already authorized device, OR they would need both your account password AND Secret Key. If you have 2FA enabled for your 1Password account, and the attacker doesn't have one of your authorized devices, they would also need your second factor (TOTP or hardware key). Additionally our Principal Security Architect, Jeff Goldberg, wrote some…

So you're banking on the idea that in order to login to 1Password you need an authorized device as your layer of security.

Re: Uber investigating breach of its computer systems

#310

Post by lovich »

traceroute66 wrote: post #281
happyopossum wrote: post #212

Earlier quoted context omitted.

The answer there, clearly, is to not have an individual be a potential SPOF. If failure of that kind of support costs millions of dollars, you absolutely need to have the ‘walked in front of a bus’ scenarios worked out.

> The answer there, clearly, is to not have an individual be a potential SPOF. If failure of that kind of support costs millions of dollars, you absolutely need to have the ‘walked in front of a bus’ scenarios worked out. I'm not going to post details in public, but suffice to say, you are over-simplistic and don't understand the context. Sticking with my example of dealers, let's just say people like dealers are not…

> Sticking with my example of dealers, let's just say people like dealers are not employed in great numbers in all but the largest financial organisation. Let's also say that there are certain events and certain times of day when the entire dealing desk is, shall we say, "busy and stressed out". There is little scope for a colleague to step in at those times, because everyone is franticly busy on the phones with their own workload.

That just sounds like optimizing for efficiency over redundancy, which is a trade off you can make, but not one that is required. Financial organizations could hire more dealers so you don’t have “little scope” for others to help out. Or they could staff an IT group that is open 24/7 ready to help these traders instantly.

Post reply on HN