www.al.com
Open in
urlscan Pro
2600:141b:13::17d7:8228
Public Scan
URL:
https://www.al.com/news/2022/09/serious-data-breach-at-uber-spotlights-hacker-social-deception.html
Submission: On September 19 via api from CA — Scanned from CA
Submission: On September 19 via api from CA — Scanned from CA
Form analysis 1 forms found in the DOM
<form><input class="advtoprail__input js-bound" name="advtoprail__input" type="text" placeholder="Enter City and State or Zip Code" value=""><button id="" class="ds-button ds-button--primary ds-button--large "
aria-label="Submit"><span>Submit</span></button></form>Text Content
Skip to Article
* Search latest news
* Home
* Set Your EditionAlabamaLarge ChevronChevron that denotes content that can
open up.Large ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Main
Menu
* Birmingham
* Huntsville
* Mobile
* Montgomery
* Tuscaloosa
* Anniston/Gadsden
* Beaches
* Alabama
* Set Weather
* NewsLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To News
* Birmingham Real-Time News
* Huntsville Real-Time News
* Mobile Real-Time News
* Coronavirus
* Crime
* Education Lab
* Politics
* Religion
* BusinessLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Business
* Find a Local Business
* Latest Job News
* Career Advice
* OpinionLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Opinion
* AL.com Opinion
* Guest Opinion
* Submit a letter to the editor
* SportsLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Sports
* Alabama Football
* Auburn Football
* Alabama Basketball
* Auburn Basketball
* Alabama Crimson Tide Sports
* Auburn Tigers Sports
* Recruiting
* High School Sports
* SEC
* UAB
* USA
* Outdoors
* Pro SportsLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Pro
Sports
* NFL
* NBA
* MLB
* NHL
* Motorsports
* Sports Betting
* Life & CultureLarge ChevronChevron that denotes content that can open
up.Large ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Life &
Culture
* Movies
* Music
* Food & Drink
* Dining
* Restaurants
* Birmingham Magazine
* Comics & PuzzlesLarge ChevronChevron that denotes content that can open
up.Large ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Comics &
Puzzles
* Comics Kingdom
* Go Comics
* Puzzles Palace
* Puzzle Society
* Obituaries
* Submit an Obituary
* JobsLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Jobs
* Search Job Openings
* List a Job
* Job News
* Career Advice
* Autos
* Real EstateLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To Real
Estate
* Homes for Sale
* New Homes
* For Rent
* Foreclosures
* Commercial
* Real Estate News
* ResourcesLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To
Resources
* Home Buying
* Sell My Home
* Rental Living
* Home Ideas
* Mortgages and Loans
* I'm Moving
* ClassifiedsLarge ChevronChevron that denotes content that can open up.Large
ChevronChevron that denotes content that can open up.
* Large ChevronChevron that denotes content that can open up.Back To
Classifieds
* Obituaries
* Rentals
* Pets
* For Sale
* Garage Sales
* Fraud Prevention
* Place An Ad
* Manage Your Ad
* More Classifieds
* Email newsletters
* Mobile Apps
Set weather
Back To Main MenuClose
Customize Your Weather
Set Your Location:
Enter City and State or Zip Code
Submit
Alabama
* Birmingham
* Huntsville
* Mobile
* Montgomery
* Tuscaloosa
* Anniston/Gadsden
* Beaches
* Alabama
Contribute
Sign in
* Sign in
* Create account
* Newsletters
* Custom Alerts
* Help/FAQ
\
1. News
SERIOUS DATA BREACH AT UBER SPOTLIGHTS HACKER SOCIAL DECEPTION
* Published: Sep. 17, 2022, 12:25 p.m.
An Uber sign is displayed at the company's headquarters in San Francisco,
Monday, Sept. 12, 2022. Uber said Thursday, Sept. 15, that it reached out to law
enforcement after a hacker apparently breached its network. A security engineer
said the intruder provided evidence of obtaining access to crucial systems at
the ride-hailing service. (AP Photo/Jeff Chiu, File)AP Photo/Jeff Chiu, File
Signed-in readers now can bookmark stories to read later.
NEW!
By
* Frank Bajak | AP Technology Writer
The ride-hailing service Uber said Friday that all its services were operational
following what security professionals are calling a major data breach, claiming
there was no evidence the hacker got access to sensitive user data.
But the breach, apparently by a lone hacker, put the spotlight on an
increasingly effective break-in routine involving social engineering: The hacker
apparently gained access posing as a colleague, tricking an Uber employee into
surrendering their credentials.
They were then able to locate passwords on the network that got them the level
of privileged access reserved for system administrators.
The potential damage was serious: Screenshots the hacker shared with security
researchers indicate they obtained full access to the cloud-based systems where
Uber stores sensitive customer and financial data.
It is not known how much data the hacker stole or how long they were inside
Uber’s network. Two researchers who communicated directly with the person — who
self-identified as an 18-year-old to one of them — said they appeared interested
in publicity. There was no indication they destroyed data.
But files shared with the researchers and posted widely on Twitter and other
social media indicated the hacker was able to access Uber’s most crucial
internal systems.
“It was really bad the access he had. It’s awful,” said Corben Leo, one of the
researchers who chatted with the hacker online.
The cybersecurity community’s online reaction — Uber also suffered a serious
2016 breach — was harsh.
The hack “wasn’t sophisticated or complicated and clearly hinged on multiple big
systemic security culture and engineering failures,” tweeted Lesley Carhart,
incident response director of Dragos Inc., which specializes in an
industrial-control systems.
Leo said screenshots the hacker shared showed the intruder got access to systems
stored on Amazon and Google cloud-based servers where Uber keeps source code,
financial data and customer data such as driver’s licenses.
“If he had keys to the kingdom he could start stopping services. He could delete
stuff. He could download customer data, change people’s passwords,” said Leo, a
researcher and head of business development at the security company Zellic.
Screenshots the hacker shared — many of which found their way online — showed
sensitive financial data and internal databases accessed. Also widely
circulating online: The hacker announcing the breach Thursday on Uber’s internal
Slack collaboration system.
Leo, along with Sam Curry, an engineer with Yuga Labs who also communicated with
the hacker, said there was no indication that the hacker had done any damage or
was interested in anything more than publicity.
“It’s pretty clear he’s a young hacker because he wants what 99% of what young
hackers want, which is fame,” Leo said.
Curry said he spoke to several Uber employees Thursday who said they were
“working to lock down everything internally” to restrict the hacker’s access.
That included the San Francisco company’s Slack network, he said.
In a statement posted online Friday, Uber said “internal software tools that we
took down as a precaution yesterday are coming back online.”
It said all its services — including Uber Eats and Uber Freight — were
operational and that it had notified law enforcement. The FBI said via email
that it is “aware of the cyber incident involving Uber, and our assistance to
the company is ongoing.”
Uber said there was no evidence that the intruder accessed “sensitive user data”
such as trip history but did not respond to questions from The Associated Press
including about whether data was stored encrypted.
Curry and Leo said the hacker did not indicate how much data was copied. Uber
did not recommend any specific actions for its users, such as changing
passwords.
The hacker alerted the researchers to the intrusion Thursday by using an
internal Uber account on the company’s network used to post vulnerabilities
identified through its bug-bounty program, which pays ethical hackers to ferret
out network weaknesses.
After commenting on those posts, the hacker provided a Telegram account address.
Curry and other researchers then engaged them in a separate conversation, where
the intruder provided the screenshots as proof.
The AP attempted to contact the hacker at the Telegram account, but received no
response.
Screenshots posted online appeared to confirm what the researchers said the
hacker claimed: That they obtained privileged access to Uber’s most critical
systems through social engineering.
The apparent scenario:
The hacker first obtained the password of an Uber employee, likely through
phishing. The hacker then bombarded the employee with push notifications asking
they confirm a remote log-in to their account. When the employee did not
respond, the hacker reached out via WhatsApp, posing as a fellow worker from the
IT department and expressing urgency. Ultimately, the employee caved and
confirmed with a mouse click.
Social engineering is a popular hacking strategy, as humans tend to be the
weakest link in any network. Teenagers used it in 2020 to hack Twitter and it
has more recently been used in hacks of the tech companies Twilio and
Cloudflare, said Rachel Tobac, CEO of SocialProof Security, which specializes in
training workers not to fall victim to social engineering.
“The hard truth is that most orgs in the world could be hacked in the exact way
Uber was just hacked,” Tobac tweeted. In an interview, she said “even super tech
savvy people fall for social engineering methods every day.”
“Attackers are getting better at by-passing or hi-jacking MFA (multi-factor
authentication),” said Ryan Sherstobitoff, a senior threat analyst at
SecurityScorecard.
That’s why many security professionals advocate the use of so-called FIDO
physical security keys for user authentication. Adoption of such hardware has
been spotty among tech companies, however.
The hack also highlighted the need for real-time monitoring in cloud-based
systems to better detect intruders, said Tom Kellermann of Contrast Security.
“Much more attention must be paid to protecting clouds from within” because a
single master key can typically unlock all their doors.
Some experts questioned how much cybersecurity has improved at Uber since it was
hacked in 2016.
Its former chief security officer, Joseph Sullivan, is currently on trial for
allegedly arranging to pay hackers $100,000 to cover up that high-tech heist,
when the personal information of about 57 million customers and drivers was
stolen.
Note to readers: if you purchase something through one of our affiliate links we
may earn a commission.
Recommended for You
Global News Wired
These Trees Are Spreading North in Alaska. That’s Not GoodGlobal News Wired
Undo
Coaches poll has new No. 1 team after weekend blowouts atop rankingsAL.com
Undo
Stair Lifts
New Shaftless Stair Lifts Take Only Hours To Install (See How Much They
Cost)Stair Lifts
Undo
Florida woman sues McDonald’s over alleged chemicals in coffee from DothanAL.com
Undo
Maxfinc
Experts Warn - CA Dollar Can Be Gone After ThisMaxfinc
Undo
Auburn quarterback T.J. Finley arrested on charge of attempting to elude
policeAL.com
Undo
by Taboolaby Taboola
Sponsored LinksSponsored Links
Promoted LinksPromoted Links
Ad
Unmute
DISCLAIMER
Registration on or use of this site constitutes acceptance of our User
Agreement, Privacy Policy and Cookie Statement, and Your California Privacy
Rights (User Agreement updated 1/1/21. Privacy Policy and Cookie Statement
updated 7/1/2022).
Cookies Settings
© 2022 Advance Local Media LLC. All rights reserved (About Us).
The material on this site may not be reproduced, distributed, transmitted,
cached or otherwise used, except with the prior written permission of Advance
Local.
Community Rules apply to all content you upload or otherwise submit to this
site.
Ad Choices
COOKIE INFORMATION
We process user data to deliver (and measure the delivery of) content or
advertisements, generate insights and reports to understand service usage,
and/or access or store information on devices for that purpose. Please see below
to learn why we process data and exercise your preferences for processing,
and/or see our partners. If you are unable to change these cookies settings,
your detected location is outside of the region that is able to do so.
Continue to Site
COOKIE CATEGORIES
STRICTLY NECESSARY COOKIES
Always Active
Strictly Necessary Cookies
These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.
PERFORMANCE COOKIES
Always Active
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.
FUNCTIONAL COOKIES
Always Active
Functional Cookies
These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then
some or all of these services may not function properly.
TARGETING COOKIES
Always Active
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.
OTHER COOKIES
Always Active
Other Cookies
These cookies may be set through our site by us or our partners. These are
cookies that may allow us to count visits and traffic sources so we can measure
and improve the performance of our site. If you do not allow these cookies we
will not know when you have visited our site, and will not be able to monitor
its performance.
Confirm My Choices
Back Button
Back
PERFORMANCE COOKIES
Vendor Search Search Icon Filter Icon
Clear Filters
Information storage and access
Apply
Consent Leg.Interest
All Consent Allowed
Select All Vendors
Select All Vendors
All Consent Allowed
Confirm My Choices