Attacker Apparently Did not Must Breach a Single System to Pwn Uber

Questions are swirling round Uber’s inside safety practices after an 18-year-old hacker gained what seems to have been full administrative entry to essential components of the corporate’s IT infrastructure utilizing an worker’s VPN credentials as an preliminary entry vector.

Quite a few screenshots that the alleged attacker posted on-line recommend the intruder didn’t should breach a single inside system to primarily pwn the ride-sharing big’s IT area nearly completely.

To this point, Uber has not disclosed particulars of the incident past saying that the corporate is responding to it and dealing with legislation enforcement to research the breach. So, not less than some of what’s being is reported in regards to the incident relies on a New York Instances report from Sept. 15 during which the teenager claimed to have gained entry to Uber’s inside networks utilizing credentials obtained from an worker through social engineering. The attacker used that entry to maneuver laterally throughout Uber’s inside area to different essential programs, together with its electronic mail, cloud storage, and code repository environments.

Since then, he has posted quite a few display screen photographs of inside programs at Uber to verify the entry he had obtained on it and the way it was obtained.

The screenshots present the hacker gained full administrative entry to Uber’s AWS, Google Cloud, VMware vSphere, and Home windows environments — in addition to to a full database of vulnerabilities in its platform that safety researchers have found and disclosed to the corporate through a bug bounty program managed by HackerOne. The interior information the attacker accessed seems to incorporate Uber gross sales metrics, data on Slack, and even data from the corporate’s endpoint detection and response (EDR) platform.

In a tweet thread that some safety researchers reposted, Twitter consumer Corben Leo posted claims from the alleged hacker that he used the socially engineered credentials to entry Uber’s VPN and scan the corporate’s intranet. The hacker described discovering an Uber community share that contained PowerShell scripts with privileged admin credentials. “One of many PowerShell scripts contained the username and password for an admin consumer in Thycotic (PAM). Utilizing this I used to be capable of extract secrets and techniques for all providers, DA, Duo, OneLogin, AWS, GSuite,” the attacker claimed.

For now, the attacker’s motivations will not be very clear. Usually, it is fairly obvious, however the one factor that hacker has completed up to now is make a whole lot of noise, famous that Uber drivers ought to be paid extra, and shared screenshots proving entry.

“They appeared actually younger and possibly even a little bit sloppy. A few of their screenshots had open chat home windows and a ton of metadata,” says Sam Curry, a safety engineer at Yuga Labs who has reviewed the screenshots,

Pure-Play Social Engineering

Invincible Safety Group (ISG), a Dubai-based safety providers agency, claimed that its researchers had obtained an inventory of administrative credentials that the menace actor had gathered. “They appear to be robust passwords, which confirms that it was certainly a social-engineering assault that acquired him entry to Uber’s inside community,” ISG tweeted.

Curry tells Darkish Studying that the attacker seems to have gained preliminary entry from compromising one worker’s login data and social engineering that particular person’s VPN two-factor authentication 2FA immediate.

“As soon as that they had VPN entry, they found a community drive with ‘keys to the dominion,’ which allowed them to entry [Uber’s] cloud internet hosting as root on each Google Cloud Platform and Amazon Internet Companies,” Curry notes. “This implies they in all probability had entry to each cloud deployment, which is probably going nearly all of Uber’s operating functions and cloud storage.”

One important reality is that the worker who was initially compromised labored in incident response, he notes, including that usually such staff have entry to many extra instruments inside Uber’s atmosphere than common staff. 

“Having this stage of entry, and moreover the entry they discovered within the PowerShell script, implies that they in all probability didn’t have too many limitations to do no matter they wished inside Uber,” Curry says.

In a collection of tweets, impartial safety researcher Invoice Demirkapi mentioned the attacker seems to have gained persistent MFA entry to the compromised account at Uber “by socially engineering the sufferer into accepting a immediate that allowed the attacker to register their very own machine for MFA.”

“The truth that the attackers seem to have compromised an IR workforce member’s account is worrisome,” Demirkapi tweeted. “EDRs can bake in ‘backdoors’ for IR, comparable to permitting IR groups to ‘shell into’ worker machines (if enabled), probably widening the attacker’s entry.”

Bug Bounty Knowledge Entry is “Problematic”

The obvious proven fact that the attacker gained entry to Uber vulnerability information submitted through its bug bounty program can also be problematic, safety consultants say. 

Curry says he discovered of the entry after the hacker posted a remark about Uber being hacked on the corporate’s bug bounty tickets. Curry had beforehand found and submitted a vulnerability to Uber, which if exploited would have permitted entry to its code repositories. That bug was addressed, but it surely’s unclear how most of the different vulnerabilities which were disclosed to the corporate have been mounted, what number of of them have been unpatched, and what stage of entry these vulnerabilities might present if exploited. The state of affairs might develop into considerably worse if the hacker sells the vulnerability information to others.

“Bug bounty packages are an vital layer in mature safety packages,” says Shira Shamban, CEO at Solvo. “A principal implication right here is that the hacker now is aware of about different vulnerabilities inside the Uber IT atmosphere and may use them to arrange backdoors for future use, which is unsettling.”

Vulnerability and pen-testing instruments are vital in enabling firms to higher assess and enhance the safety postures, says Amit Bareket, CEO and co-founder of Perimeter 81. “Nonetheless, if the right safety measures aren’t put in place, these instruments can flip into double-sided swords, enabling unhealthy actors to benefit from the delicate data they could comprise,” he says. 

Corporations ought to concentrate on this and ensure such reviews are protected and saved in encrypted kind to keep away from being misused for malicious intent, Bareket notes.

The newest incident is unlikely to do a lot to enhance Uber’s already considerably dinged fame for safety. In October 2016, the corporate skilled an information breach that uncovered delicate data on some 57 million riders. However as an alternative of exposing the breach because it was required to, the firm paid $100,000 to the safety researchers that reported the breach in what was considered as an try and pay them off. In 2018, the corporate settled a lawsuit over the incident for $148 million. It arrived at comparable however a lot smaller settlements in lawsuits over the incidents within the UK and the Netherlands.