Everything Is Just Dandy!

Uber was breached to its core, purportedly by an 18-year-old. Here’s what’s known

Ars Technica – All content
Dan Goodin

Uber app being used on a smartphone

Enlarge / The Uber ride-sharing app is seen on a mobile phone.

Uber employees on Thursday discovered that huge swaths of their internal network had been hacked by someone who announced the feat on the company Slack channel. The intruder, who sent screenshots documenting the hack to The New York Times and security researchers, claimed to be 18 years old and was unusually forthcoming about how the breach occurred and just how far it reached, according to the news outlet, which broke the story.

It didn’t take long for independent researchers, including Bill Demirkapi of Microsoft, to confirm the NYT coverage and conclude that the intruder likely gained initial access by contacting an Uber employee over WhatsApp.

After successfully obtaining the employees’ account password, the hacker tricked the employee into approving a push notification for multi-factor authentication. The intruder then uncovered administrative credentials that gave access to some of Uber’s crown-jewel network resources. Uber responded by shutting down parts of its internal network while it investigates the extent of the breach.

It’s not yet clear precisely what data the hacker had access to or what other actions the hacker took. Uber stores a dizzying array of data on its users, so it’s possible private addresses and the hourly comings and goings of hundreds of millions of people were accessible or accessed.

Here’s what’s known so far.

How did the hacker get in?

According to the NYT, the above-linked tweet thread from Demirkapi and other researchers, the hacker socially engineered an Uber employee after somehow discovering the employee’s WhatsApp number. In direct messages, the intruder instructed the employee to log into a fake Uber site, which quickly grabbed the entered credentials in real time and used them to log into the genuine Uber site.

Uber had MFA, short for multi-factor authentication, in place in the form of an app that prompts the employee to push a button on a smartphone when logging in. To bypass this protection, the hacker repeatedly entered the credentials into the real site. The employee, apparently confused or fatigued, eventually pushed the button. With that the attacker was in.

After rifling around, the attacker discovered powershell scripts that an admin had stored that automated the process of logging in to various sensitive network enclaves. The scripts included the credentials needed.

What happened next?

The attacker reportedly sent company-wide texts on Uber Slack channels, announcing the feat.

“I announce I am a hacker and Uber has suffered a data breach,” one message read, according to the NYT. Screenshots proceeded to provide evidence the individual had access to assets including Uber’s Amazon Web Services and G Suite accounts and code repositories.

It remains unclear what other data the hacker had access to and whether the hacker copied or shared any of it with the world at large.

What do we know about the hacker?

Not much. The person claims to be 18 years old and took to Uber Slack channels to complain that Uber drivers are underpaid. This, and the fact that the intruder took no steps to conceal the breach, suggest that the breach is likely not motivated by financial gain from ransomware, extortion, or espionage. The identity of the individual remains unknown so far.

What is Uber doing now?

The company has acknowledged the breach and is investigating.

Did an 18-year-old really access the crown jewels of one of the world’s most sensitive companies? How can this be?

It’s too soon to say for sure, but the scenario seems plausible, even likely. Phishing attacks remain one of the most effective forms of network intrusion. Why bother with expensive and complex zero-day exploits when there are much easier ways to trespass?

What’s more, phishing attacks over the past few months have grown increasingly sophisticated. Witness this attack that recently breached Twilio and has targeted many more companies. The phishing page automatically relayed entered usernames and passwords to the attackers over the messaging service Telegram, and the attacker entered those into the real site. When a user entered a one-time password generated by an authenticator app the attackers simply entered that as well. In the event an account was protected by an app such as Duo Security, the attackers would gain access as soon as the employee complied.

Does this mean MFA using one-time passwords or pushes are useless?

This sort of MFA will protect users in the event their password is compromised through a database breach. But as has been demonstrated repeatedly, they are woefully inadequate in stopping phishing attacks. So far, only forms of MFA that are phishing resistant are those that are compliant with an industry standard known as FIDO2. It remains the MFA gold standard.

Many organizations and cultures, continue to believe that their members are too smart to fall for phishing attacks. They like the convenience of authenticator apps as compared to FIDO2 forms of MFA, which require possession of a phone or physical key. These types of breaches will remain a fact of life until this mindset changes.