After serious breach, Uber says services operational | Technology News

What seemed to be a lone hacker introduced the breach on Thursday after apparently tricking an Uber worker into offering credentials.

Screenshots the hacker shared with safety researchers point out this individual obtained full entry to the cloud-based methods the place Uber shops delicate buyer and monetary information.

It’s not identified how a lot information the hacker stole or how lengthy they had been inside Uber’s community. Two researchers who communicated instantly with the individual — who self-identified as an 18-year-old to one among them— mentioned they appeared considering publicity. There was no indication they destroyed information.

However recordsdata shared with the researchers and posted extensively on Twitter and different social media indicated the hacker was in a position to entry Uber’s most important inner methods.

“It was actually unhealthy the entry he had. It is terrible,” mentioned Corbin Leo, one of many researchers who chatted with the hacker on-line.

He mentioned screenshots the individual shared confirmed the intruder acquired entry to methods saved on Amazon and Google cloud-based servers the place Uber retains supply code, monetary information and buyer information reminiscent of driver’s licenses.

“If he had keys to the dominion he may begin stopping companies. He may delete stuff. He may obtain buyer information, change individuals’s passwords,” mentioned Leo, a researcher and head of enterprise improvement on the safety firm Zellic.

Screenshots the hacker shared — lots of which discovered their means on-line — confirmed they’d accessed delicate monetary information and inner databases. Amongst them was one by which the hacker introduced the breach on Uber’s inner Slack collaboration ssytem.

Sam Curry, an engineer with Yuga Labs who additionally communicated with the hacker, mentioned there was no indication that the hacker had carried out any harm or was considering something greater than publicity. “My intestine feeling is that it looks as if they’re out to get as a lot consideration as attainable.”

Curry mentioned he spoke to a number of Uber workers Thursday who mentioned they had been “working to lock down every thing internally” to limit the hacker’s entry. That included the San Francisco firm’s Slack community, he mentioned.

In a statement posted online Friday, Uber mentioned “inner software program instruments that we took down as a precaution yesterday are coming again on-line.”

It mentioned all its companies — together with Uber Eats and Uber Freight — had been operational.

The corporate didn’t reply to questions from The Related Press together with about whether or not the hacker gained entry to buyer information and if that information was saved encrypted. The corporate mentioned there was no proof that the intruder accessed “delicate consumer information” reminiscent of journey historical past.

Curry and Leo mentioned the hacker didn’t point out how a lot information was copied. Uber didn’t advocate any particular actions for its customers, reminiscent of altering passwords.

The hacker alerted the researchers to the intrusion Thursday by utilizing an inner Uber account on the corporate’s community used to post vulnerabilities identified through its bug-bounty program, which pays moral hackers to ferret out community weaknesses.

After commenting on these posts, the hacker supplied a Telegram account tackle. Curry and different researchers then engaged them in a separate dialog, the place the intruder supplied screenshots of assorted pages from Uber’s cloud suppliers to show they broke in.

The AP tried to contact the hacker on the Telegram account, however acquired no response.

Screenshots posted on Twitter appeared to substantiate what the researchers mentioned the hacker claimed: That they obtained privileged entry to Uber’s most important methods by way of social engineering. Successfully, the hacker found the password of an Uber worker. Then, posing as a fellow employee, the hacker bombarded the worker with textual content messages asking them to substantiate that they’d logged into their account. Finally, the worker caved and supplied a two-factor authentication code the hacker used to log in.

Social engineering is a well-liked hacking technique, as people are usually the weakest hyperlink in any community. Youngsters used it in 2020 to hack Twitter and it has extra not too long ago been utilized in hacks of the tech firms Twilio and Cloudflare.

Uber has been hacked earlier than.

Its former chief safety officer, Joseph Sullivan, is at the moment on trial for allegedly arranging to pay hackers $100,000 to cowl up a 2016 high-tech heist by which the private info of about 57 million prospects and drivers was stolen.