Hello, World!
Today we have what has to be one of the most embarrassing hacks of all time, so much so
that I had to dedicate an entire video to it.
So, Uber has just suffered a devastating hack, screenshots show the hacker gained what can
honestly be described as total access to Uber’s systems, which has led to over $2 Billion
dollars being wiped off of Uber’s valuation overnight.
Who could be behind such a feat, perhaps Chinese or Russian state sponsored hackers, or maybe
it’s a case of corporate sabotage?
No, it was an 18 year old hacker, a troll, interested in nothing more than causing a
bunch of havoc, just for the fun of it.
The story begins with our miscreant somehow obtaining an Uber employee’s phone number,
he then directed the employee to a fake Uber log in page, where he managed to grab their
credentials.
However Uber, like many of us, uses 2 factor authentication, so the employees ‘password
wasn’t enough to access Uber’s systems.
So our attacker used what’s called an “Multi Factor Authentication Fatigue Attack” - which
sounds kinda complex, but this is just a technical term for spamming 2FA notifications at someone’s
phone, until they become harassed enough to just accept the request.
And I’m not kidding, in the words of our hacker “I was spamming [the] employee with
push auth for over an hour, I then contacted him on WhatsApp and claimed to be from Uber
IT, [I] told him if he wants it to stop he must accept it”.
And accept it he did… allowing the miscreant to log in to Uber’s corporate VPN.
Where he started a scan for sensitive data, leading him to discovering a network share
which contained some PowerShell scripts, one of which contained a hardcoded username and
password for an admin user.
This high privilege account gave him access to seemingly all Uber’s services.
For example access to their google workspace admin console, and the petabyte of data Uber
stores on their google drive.
All the employee’s email accounts, Uber’s security dashboard, their financial data,
aws services, he then vandalised reports in Uber’s hackerone bug bounty program and
eventually found Uber’s slack workspaces - which is where he announced his presence.
Frustratingly though we only have a really low res screenshot of the message, it reads
“Hi, I announce I am a hacker” - not the most dramatic of entrances.
“Uber has suffered a data breach”.
He says he’s basically accessed everything, and… given he signs off with “#uberunderpaysdrivers”
- a lot of news outlets have been reporting this as some kind of hacktivisim, but I’m
just not convinced.
This one hashtag is the only evidence of that, and the guy just seems to be more of a troll
than anything else.
However, at first the employees saw this message as a bit of a joke, responding with emojis,
you can even see some sus emojis in there.
When it eventually became clear that this wasn’t an out of season April fools joke,
Uber tweeted “We are currently responding to a cybersecurity incident.
We are in touch with law enforcement and will post additional updates here as they become
available."
- notably they only put this out through their PR twitter account which has a few thousand
followers, rather than their main account with a million.
They eventually posted a follow up statement essentially saying everything’s fine, and
there’s no reason to worry.
Despite their statements coming across as very stoic you can just imagine the shit show
going on behind the scenes.
What makes this hack so embarrassing is firstly how preventable it was, an employee literally
gave an 18 year old the keys to the castle because they were annoyed by 2FA notification
spam.
And once inside, this 18 year old had access to everything.
Though luckily for Uber the miscreant seems to have been so preoccupied by having the
time of his life, rampaging through Uber’s systems, taking screenshots of sensitive information
that he didn’t give any thought to how this could be leveraged for monetary gain.
Uber was actually previously breached in 2016, hackers stole information on almost 60 million
drivers, and managed to extort Uber for $100,000 dollars to keep the whole thing a secret.
Whereas in this latest hack there was no ransom, and no attempted extortion, it was all done
for the lulz, in fact, just hours after the breach, the hacker was already talking with
journalists and researchers, bragging about how he managed to hack this billion dollar
company.
The implications for Uber thanks to this hack aren’t yet clear, what we do know is that
after this hack came to light, their share price fell by about 6.5 percent.
And although it did recover later on, it’s still slightly down, suggesting that investors
think a company that can be hacked by an 18 year old presents some extra risk for them.
The hacker’s identity is still currently unknown, as for whether he will eventually
be caught?
Well, knowing to send 2FA spam, and knowing how to stay hidden are 2 different things.
The guy is only 18 so realistically he can’t be that experienced, so there’s a good chance
this guy will end up in court a few months down the road.
The best pentesting teams trust PlexTrac - the cybersecurity reporting and collaboration
platform - helping them build better reports in half the time, aggregate findings from
all their tools, and maximize their reusable report content, like writeups and narratives.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement, whilst exponentially increasing ROI and time savings.
Ready to elevate your reporting, improve collaboration across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, sources can of course be found in the video description,
and I’ll see you in the next video, have a good one.