After serious breach, Uber says services operational

The ride-hailing service Uber said Friday that all its services are operational following what security professionals were calling a major data breach. It said there was no evidence the hacker got access to sensitive user data.

News 12 Staff

Sep 16, 2022, 8:35 PM

Updated 577 days ago

Share:

After serious breach, Uber says services operational
The ride-hailing service Uber said Friday that all its services are operational following what security professionals were calling a major data breach. It said there was no evidence the hacker got access to sensitive user data.
What appeared to be a lone hacker announced the breach on Thursday after apparently tricking an Uber employee into providing credentials.
Screenshots the hacker shared with security researchers indicate this person obtained full access to the cloud-based systems where Uber stores sensitive customer and financial data.
It is not known how much data the hacker stole or how long they were inside Uber's network. Two researchers who communicated directly with the person - who self-identified as an 18-year-old to one of them- said they appeared interested in publicity. There was no indication they destroyed data.
But files shared with the researchers and posted widely on Twitter and other social media indicated the hacker was able to access Uber's most crucial internal systems.
“It was really bad the access he had. It's awful,” said Corbin Leo, one of the researchers who chatted with the hacker online.
He said screenshots the person shared showed the intruder got access to systems stored on Amazon and Google cloud-based servers where Uber keeps source code, financial data and customer data such as driver's licenses.
“If he had keys to the kingdom he could start stopping services. He could delete stuff. He could download customer data, change people’s passwords,” said Leo, a researcher and head of business development at the security company Zellic.
Screenshots the hacker shared - many of which found their way online - showed they had accessed sensitive financial data and internal databases. Among them was one in which the hacker announced the breach on Uber's internal Slack collaboration ssytem.
Sam Curry, an engineer with Yuga Labs who also communicated with the hacker, said there was no indication that the hacker had done any damage or was interested in anything more than publicity. “My gut feeling is that it seems like they are out to get as much attention as possible.”
Curry said he spoke to several Uber employees Thursday who said they were “working to lock down everything internally” to restrict the hacker’s access. That included the San Francisco company’s Slack network, he said.
In a statement posted online Friday, Uber said “internal software tools that we took down as a precaution yesterday are coming back online.”
It said all its services - including Uber Eats and Uber Freight - were operational.
The company did not respond to questions from The Associated Press including about whether the hacker gained access to customer data and if that data was stored encrypted. The company said there was no evidence that the intruder accessed “sensitive user data” such as trip history.
Curry and Leo said the hacker did not indicate how much data was copied. Uber did not recommend any specific actions for its users, such as changing passwords.
The hacker alerted the researchers to the intrusion Thursday by using an internal Uber account on the company’s network used to post vulnerabilities identified through its bug-bounty program, which pays ethical hackers to ferret out network weaknesses.
After commenting on those posts, the hacker provided a Telegram account address. Curry and other researchers then engaged them in a separate conversation, where the intruder provided screenshots of various pages from Uber’s cloud providers to prove they broke in.
The AP attempted to contact the hacker at the Telegram account, but received no response.
Screenshots posted on Twitter appeared to confirm what the researchers said the hacker claimed: That they obtained privileged access to Uber’s most critical systems through social engineering. Effectively, the hacker discovered the password of an Uber employee. Then, posing as a fellow worker, the hacker bombarded the employee with text messages asking them to confirm that they had logged into their account. Ultimately, the employee caved and provided a two-factor authentication code the hacker used to log in.
Social engineering is a popular hacking strategy, as humans tend to be the weakest link in any network. Teenagers used it in 2020 to hack Twitter and it has more recently been used in hacks of the tech companies Twilio and Cloudflare.
Uber has been hacked before.
Its former chief security officer, Joseph Sullivan, is currently on trial for allegedly arranging to pay hackers $100,000 to cover up a 2016 high-tech heist in which the personal information of about 57 million customers and drivers was stolen.
(Copyright 2022 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed without permission.)
9/16/2022 3:59:31 PM (GMT -4:00)


More from News 12
1:56
Police: Student, 17, charged with multiple felonies for bringing unloaded gun and bullets to school

Police: Student, 17, charged with multiple felonies for bringing unloaded gun and bullets to school

2:29
Mostly sunny with highs near 70 for Tuesday; chance for rain by midweek

Mostly sunny with highs near 70 for Tuesday; chance for rain by midweek

2:23
State budget makes no change to foundation school aid; governor signals changes coming in 2026

State budget makes no change to foundation school aid; governor signals changes coming in 2026

1:43
Police: Several people hurt in Garden City bus crash

Police: Several people hurt in Garden City bus crash

1:32
Nassau Community College professors call on state to step in to help school survive

Nassau Community College professors call on state to step in to help school survive

0:58
Police: Man spray-painted antisemitic messages at homes, Jewish center in East Meadow

Police: Man spray-painted antisemitic messages at homes, Jewish center in East Meadow

1:56
State officials: More chemical drums could be buried beneath Bethpage baseball field

State officials: More chemical drums could be buried beneath Bethpage baseball field

1:33
Groundbreaking ceremony marks beginning of Jake's 58 Casino's $210M expansion project

Groundbreaking ceremony marks beginning of Jake's 58 Casino's $210M expansion project

1:32
Nassau residents deliver petition with more than 1,600 signatures against proposal to deputize residents

Nassau residents deliver petition with more than 1,600 signatures against proposal to deputize residents

Police: Driver arrested for fatal Brentwood hit-and-run

Police: Driver arrested for fatal Brentwood hit-and-run

0:26
Police: Central Islip business cited for violation after State Liquor Authority investigation

Police: Central Islip business cited for violation after State Liquor Authority investigation

1:39
Paws & Pals: Dogs up for adoption at Almost Home Animal Rescue

Paws & Pals: Dogs up for adoption at Almost Home Animal Rescue

4:39
Guide: Ways to help you identify and deal with work burnout

Guide: Ways to help you identify and deal with work burnout

1:49
Officials: Fire dispatcher's wife alerts him about blaze at their Centereach home

Officials: Fire dispatcher's wife alerts him about blaze at their Centereach home

0:32
State police: Trooper conducting traffic stop rear-ended on Meadowbrook State Parkway

State police: Trooper conducting traffic stop rear-ended on Meadowbrook State Parkway

0:52
Paws of War service dogs attend candlelight remembrance vigil in Farmingdale

Paws of War service dogs attend candlelight remembrance vigil in Farmingdale

2:04
CDC: Most women do not get a mammogram because of financial difficulties

CDC: Most women do not get a mammogram because of financial difficulties

0:38
'Pearls of Wisdom' tea event in Riverhead aims to empower young Black women

'Pearls of Wisdom' tea event in Riverhead aims to empower young Black women

0:52
Splish Splash hosts 8th annual Polar Plunge fundraiser for Special Olympics athletes

Splish Splash hosts 8th annual Polar Plunge fundraiser for Special Olympics athletes

0:24
Police: Car crashes onto guardrail, overturns on LIE in Brentwood; driver injured

Police: Car crashes onto guardrail, overturns on LIE in Brentwood; driver injured