Uber disclosed additional details about the security breach, the company blames a threat actor allegedly affiliated with the LAPSUS$ hacking group.
“We believe that this attacker (or attackers) are affiliated with a hacking group called Lapsus$, which has been increasingly active over the last year or so. This group typically uses similar techniques to target technology companies, and in 2022 alone has breached Microsoft, Cisco, Samsung, Nvidia and Okta, among others.” reads a new update provided by the company early this week.
This week the leak of GTA6 gameplay videos made the headlines, it is the result of the data breach of the video game maker Rockstar Games. The 18-year-old hacker behind this attack, who goes online by the moniker Tea Pot, claims to have also hacked Uber.
UK police suspect that a 16-year-old from Oxford is one of the leaders of the popular Lapsus$ group.
Uber added that it is investigating the security breach with the help of several leading digital forensics firms.
“We will also take this opportunity to continue to strengthen our policies, practices, and technology to further protect Uber against future attacks.” continues the update.
The company explained that threat actors compromised the account of a Uber EXT contractor, they likely purchased the contractor’s credentials on the dark web. The attacker attempted to log in to the contractor’s Uber account multiple times. Each time, the contractor received a two-factor login approval request, and evidently, he finally accepted one of them, allowing the attacker successfully log in to the account.
“From there, the attacker accessed several other employee accounts which ultimately gave the attacker elevated permissions to a number of tools, including G-Suite and Slack. The attacker then posted a message to a company-wide Slack channel, which many of you saw, and reconfigured Uber’s OpenDNS to display a graphic image to employees on some internal sites.” concludes the update.
[출처 : SecurityAffairs / 9.20.]