Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

101–110 of 327 posts

Re: Uber investigating breach of its computer systems

#101

Post by pdntspa »

cyral wrote: post #96
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

I sure hope WebAuthn is easier to implement than that site is making it look like. I know nothing about how it works, but the sample code (Under "Example: Parsing the authenticator data") that requires parsing slices of bytes out of the response and then constructing some object with magic numbers looks really hacky. Maybe it is supposed to be exposed at a low level like that so wrappers can be made around it, but if…

How would one slice a byte array without magic numbers? Or without constants representing said magic numbers?

Re: Uber investigating breach of its computer systems

#102

Post by _8j50 »

staticassertion wrote: post #90
_8j50 wrote: post #87

Earlier quoted context omitted.

It's good to have but in the real world that wouldn't have stopped a determined attacker. They could have social engineered them to run code on their PC

So an entire class of attacks would have been removed and the attacker would have moved to another class of attacks. As for running code in the environment there are many, many ways to deal with that. Obviously it's an easier environment to audit, but it's also much easier to control.

Yes, I don't disagree with anything you said. I am not saying MFA may not have at least slowed down the threat actor but the focus here should be how easy lateral movement was. Like you said there are many ways to get in. If the network share was treated the same as internet facing stuff though, that sounds like a deeper issue many orgs face but I am surprised that a fairly new org like Uber is not doing that already.

Re: Uber investigating breach of its computer systems

#103

Post by indymike »

fjfbsufhdvfy wrote: post #35

Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?

It may be easier for a smaller company to be secure. Usually people are the weakest link.

Re: Uber investigating breach of its computer systems

#104

Post by cyral »

pdntspa wrote: post #101
cyral wrote: post #96

Earlier quoted context omitted.

I sure hope WebAuthn is easier to implement than that site is making it look like. I know nothing about how it works, but the sample code (Under "Example: Parsing the authenticator data") that requires parsing slices of bytes out of the response and then constructing some object with magic numbers looks really hacky. Maybe it is supposed to be exposed at a low level like that so wrappers can be made around it, but if…

How would one slice a byte array without magic numbers? Or without constants representing said magic numbers?

By having an API that abstracts the details away, like any other browser API. I would expect something like attestationObject.getPublicKey() versus whatever is going on in that demo.

I believe it was some part of oauth or saml (again not an expert here) where developers were making a common mistake by not verifying everything in the spec, leading to an easy bypass if you knew how it worked. Having devs implement a complex spec relating to authentication is a recipe for disaster.

Re: Uber investigating breach of its computer systems

#105

Post by monocasa »

cyral wrote: post #96
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

I sure hope WebAuthn is easier to implement than that site is making it look like. I know nothing about how it works, but the sample code (Under "Example: Parsing the authenticator data") that requires parsing slices of bytes out of the response and then constructing some object with magic numbers looks really hacky. Maybe it is supposed to be exposed at a low level like that so wrappers can be made around it, but if…

For the most part, none of that matters client side. The web client side is mainly just a passthrough to your backend that'll do the actual processing of those binary blobs other than for example code.

Re: Uber investigating breach of its computer systems

#106

Post by raverbashing »

sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

So, where does it end?

Cybersecurity has been playing those silly games of "increasing security" and some 80% of recommendations were frankly BS

"longer passwords" yes. "password has to have symbols, numbers and be rotated every 3 mo" no

2FA yes, but not SMS, but not OTP because people get fished, blah blah blah

Not to forget the "put everything in a password manager" then you lose or forget your "extra safe random password" and are SOL

Meanwhile there are still incompetent people around that think asking for Mother's Maiden Name should be a security question

So where does it end?

Re: Uber investigating breach of its computer systems

#107

Post by insanitybit »

_8j50 wrote: post #98

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…

Because auth to the VPN should have required a device cert and/ or unphishable 2FA. Also because the SMS phish was one of the first details leaked. Obviously access to the VPN shouldn't also be a full system compromise. There are many things to criticize here, we can point all of them out.

Re: Uber investigating breach of its computer systems

#108

Post by cyral »

monocasa wrote: post #105
cyral wrote: post #96

Earlier quoted context omitted.

I sure hope WebAuthn is easier to implement than that site is making it look like. I know nothing about how it works, but the sample code (Under "Example: Parsing the authenticator data") that requires parsing slices of bytes out of the response and then constructing some object with magic numbers looks really hacky. Maybe it is supposed to be exposed at a low level like that so wrappers can be made around it, but if…

For the most part, none of that matters client side. The web client side is mainly just a passthrough to your backend that'll do the actual processing of those binary blobs other than for example code.

I see, if all that is server side then it makes a lot more sense as I assume backend libraries will get created to handle this for various languages. Bookmarking it to check it out later when I have time to read it all, hopefully it isn't as daunting as it looks.

Re: Uber investigating breach of its computer systems

#109

Post by cyral »

spoils19 wrote: post #80
Undertow_ wrote: post #53

Earlier quoted context omitted.

everyone is susceptible to it,,, everyone

We don't run internal honeypots and no one has ever been caught in our company, so I disagree. And yes, a reply may be "That you know of...", but considering that we run weekly audits and nothing has leaked, I can be 100% sure of it.

Do you really know for sure though? That is what keeps me up at night. The irony is that one of the leaked screenshots is of an internal security auditing/monitoring tool.

Re: Uber investigating breach of its computer systems

#110

Post by philliphaydon »

_8j50 wrote: post #98

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…

There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…
Post reply on HN