Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

161–170 of 327 posts

Re: Uber investigating breach of its computer systems

#161

Post by reissbaker »

junon wrote: post #151
vayne wrote: post #150

Earlier quoted context omitted.

Quoted post unavailable.

You clearly don't understand how SE can be used even if Yubikey or WebAuthn are used here. Perhaps you'd like to explain instead of insult someone you know nothing about (which violates HN guidelines).

I mean, "social engineering" is pretty broad; saying MFA can't stop social engineering is like saying password managers can't stop hacking, or HTTPS can't stop spying. I mean, sure... but Webauthn would have in fact stopped this type of social engineering attack (which was a fake login page). And scanning internal networks for hardcoded secrets would have stopped this type of privilege escalation afterwards.

Security is never absolute, but we're not talking about a nation-state/APT attack here; current reports seem to indicate this was a bored 18 year old acting alone.

Re: Uber investigating breach of its computer systems

#162

Post by _Adam »

_8j50 wrote: post #98

Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…

The powershell script is a minor part of the screw up. The real issues are multitude...

1) hardcoding actual production credentials in a script at all. Seriously what the fuck.

2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security.

The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assume the VPN is wide open and secure everything accordingly. Defense in depth not eggshells.

Re: Uber investigating breach of its computer systems

#163

Post by lbriner »

dx034 wrote: post #145
cddotdotslash wrote: post #8

They could be fake, of course, but this thread[1] of screenshots is pretty bad... internal tools, Slack Admin, Google Workspace admin, an AWS account showing admin permissions. [1] https://twitter.com/Savitar0x01/status/1570580235716014081

And as other people have already written, that's the main issue. Not that someone got compromised, but that passwords for admin accounts to all those services were stored on a network share.

What happens is that as a company scales to this sort of size, all kinds of shortcuts are made, all kinds of compromise decisions are made because there is still little non-financial cost for getting it wrong.

Imagine deciding to add some extra floors to your office made from cardboard because, "we are scaling too quickly to build them out of concrete". Wouldn't happen. Why? The legal and marketing fallout would be fatal.

In the corporate world, especially in ones at the extreme levels of inefficiency/size/etc. it is easy just to blame the previous job holder, the previous culture, "we have made improvements since then" etc. as if that makes it alright.

tbf, we also see this in Healthcare and Government so I think it is Human Nature rather than corporate greed.

Re: Uber investigating breach of its computer systems

#164

Post by _Adam »

hotpotamus wrote: post #45
fjfbsufhdvfy wrote: post #35

Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?

You know, the longer I'm at this, I see more and more effort thrown at developing security and one thing remains the same - you've got a user sitting at a machine with network access and the ability to execute code, and sometimes you can trick that user into executing code. I guess the bigger the company, the more users which means more targets/chances. For decades I've been told that security through obscurity is no…

The best approach is to assume there's a renegade employee constantly trying to screw the company over. Granularity of permissions should be set to minimize the blast radius to the absolute minimum they need to do their job.

Re: Uber investigating breach of its computer systems

#165

Post by icare_1er »

fjfbsufhdvfy wrote: post #35

Seeing these huge companies with practically infinite resources get owned one after another sure makes me wonder if we even have any chance at all to do this correctly in our small business. Perhaps they just don't care about security?

Being big means more money and resources, yes, but this also means having more employees, and more assets, ie. a much bigger attack surface.

Believe it or not, it's much easier to successfully phish a big company where you have unlimited pool of emails to tap into.

Re: Uber investigating breach of its computer systems

#166

Post by rsynnott »

j1elo wrote: post #148
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

> I just lost the purse with my phone, or my device broke, or got stolen, or whatever, and need the damn TOTP code to telework _right now_.

So, wait for a new authenticator device to be shipped to you. Like, if the work laptop broke, you'd presumably have to wait on a replacement for that, too...

Re: Uber investigating breach of its computer systems

#167

Post by icare_1er »

kaesar14 wrote: post #31

Forgive me for being frank, but how do people seriously fall for phishing scams? How do you work at a company like Uber and do something like click on a link in an email to claim a gift card? It’s insane to me.

It can be much more subtle than that and I have seen people like you fall for it (or for other social-engineerings attacks) more than once...

Re: Uber investigating breach of its computer systems

#168

Post by heavenlyblue »

helpfulclippy wrote: post #74
kaesar14 wrote: post #31

Forgive me for being frank, but how do people seriously fall for phishing scams? How do you work at a company like Uber and do something like click on a link in an email to claim a gift card? It’s insane to me.

First, people have fundamental drives that can override logical reason. Gift cards probably aren't your button. Maybe your buttons aren't even ones that are easily poked at by e-mail, I dunno. But EVERYONE has buttons somewhere that make them exploitable, and a lot of them ARE e-mail accessible... maybe as easy as offering free money, which is a pretty common one, and it's why marketers have been obsessed with it for…

> careless click

Careless click is not enough to compromise someone unless they are also running software that is not up to date. For example, how do you compromise someone if password login is disabled in all of the systems?

Re: Uber investigating breach of its computer systems

#169

Post by mango7283 »

lamontcg wrote: post #76
beardedwizard wrote: post #59

Earlier quoted context omitted.

What is your alternative? Should we do nothing instead? Should all SWEs quit because they can't stop writing security bugs?

Should doctors quit and find another field because people keep on breaking their legs?

If doctors not only had to treat broken legs but also somehow prevent people breaking them in the first place...

Re: Uber investigating breach of its computer systems

#170

Post by aeyes »

chinathrow wrote: post #130
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

How do you recover if you lose access to your device?

create a second account or use the root account?
Post reply on HN