> series: anatomy_of_a_breach —— part: 165 —— target: uber_again —— method: mfa_fatigue + whatsapp_social_engineering —— attacker: lapsus$-linked_teenager<span class="cursor-blink">_</span>_
On 15 September 2022, Uber disclosed that an attacker had gained access to its internal systems. The attacker — an 18-year-old affiliated with the Lapsus$ group — had purchased stolen credentials on the dark web, then used MFA fatigue to bypass Uber's push-notification MFA. When the targeted employee initially resisted the repeated push notifications, the attacker contacted the employee via WhatsApp, impersonating Uber IT support and instructing them to approve the MFA prompt to stop the notifications. The employee complied.
Once inside Uber's VPN, the attacker discovered hardcoded administrative credentials in a PowerShell script on an internal network share — gaining access to Uber's privilege access management (PAM) system. From there, the attacker accessed Uber's Slack (where they posted a message announcing the breach), Google Workspace, AWS and GCP consoles, source code repositories, and — critically — Uber's HackerOne bug bounty dashboard, which contained reports of unpatched security vulnerabilities. The breach came five years after the 2016 breach that Uber had concealed — and that had resulted in the criminal conviction of Uber's former CSO.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Uber 2022 breach was the definitive case for upgrading from push-notification MFA to phishing-resistant alternatives. Cyber Essentials Danzell recommends number-matching push notifications (where the user must enter a code shown on the login screen), FIDO2 hardware keys, or passkeys — all of which resist MFA fatigue attacks. Our social engineering testing includes MFA fatigue assessment. Internal testing searches for hardcoded credentials. SOC in a Box monitors for MFA fatigue patterns and anomalous internal access. And UK Cyber Defence provides incident response when social engineering bypasses authentication.
<a href="/cyber-essentials">Cyber Essentials</a> recommends number-matching or FIDO2 MFA. <a href="/penetration-testing/social-engineering">Social engineering testing</a> includes MFA fatigue. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects fatigue patterns.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call