Anatomy of a Breach

Anatomy of a Breach: Uber Breached Again — A Teenager, MFA Fatigue, and Full Internal Access

> series: anatomy_of_a_breach —— part: 165 —— target: uber_again —— method: mfa_fatigue + whatsapp_social_engineering —— attacker: lapsus$-linked_teenager<span class="cursor-blink">_</span>_

Hedgehog Security 30 September 2022 13 min read

Uber. Again. A teenager. MFA fatigue. Full access to Slack, source code, and bug bounty reports.

On 15 September 2022, Uber disclosed that an attacker had gained access to its internal systems. The attacker — an 18-year-old affiliated with the Lapsus$ group — had purchased stolen credentials on the dark web, then used MFA fatigue to bypass Uber's push-notification MFA. When the targeted employee initially resisted the repeated push notifications, the attacker contacted the employee via WhatsApp, impersonating Uber IT support and instructing them to approve the MFA prompt to stop the notifications. The employee complied.

Once inside Uber's VPN, the attacker discovered hardcoded administrative credentials in a PowerShell script on an internal network share — gaining access to Uber's privilege access management (PAM) system. From there, the attacker accessed Uber's Slack (where they posted a message announcing the breach), Google Workspace, AWS and GCP consoles, source code repositories, and — critically — Uber's HackerOne bug bounty dashboard, which contained reports of unpatched security vulnerabilities. The breach came five years after the 2016 breach that Uber had concealed — and that had resulted in the criminal conviction of Uber's former CSO.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Push spam until they approve. Then call them pretending to be IT.

MFA Fatigue: The Lapsus$ Playbook
The attacker used the same MFA fatigue technique documented in the <a href="/blog/anatomy-of-a-breach-lapsus">Lapsus$ breach</a> (#159) — bombarding the target with push notifications. When fatigue alone failed, the attacker escalated to social engineering via WhatsApp. <a href="/cyber-essentials">Cyber Essentials Danzell</a> recommends number-matching or FIDO2 MFA, which cannot be fatigued. Our <a href="/penetration-testing/social-engineering">social engineering assessments</a> include MFA fatigue simulation.
Hardcoded Credentials in Scripts
Administrative credentials stored in plaintext in a PowerShell script on a network share gave the attacker access to the PAM system — and from there, to everything. Our <a href="/penetration-testing/infrastructure">internal penetration testing</a> specifically searches for hardcoded credentials in scripts, configuration files, and network shares.
Bug Bounty Reports Accessed
The attacker accessed Uber's HackerOne dashboard — containing detailed reports of security vulnerabilities, some potentially unpatched. Access to bug bounty reports gives an attacker a roadmap of known weaknesses. <a href="/penetration-testing/infrastructure">Our testing</a> assesses access controls on security-sensitive internal systems.
Uber's Third Major Breach
The 2016 cover-up (CSO convicted), the 2022 MFA fatigue attack — Uber has now appeared multiple times in this series. Like <a href="/blog/anatomy-of-a-breach-t-mobile-us-2021">T-Mobile</a>, repeated breaches indicate systemic security governance failures. <a href="https://www.socinabox.co.uk">SOC in a Box</a> provides the continuous monitoring that detects breaches as they occur.

Push-notification MFA is not enough. Upgrade to phishing-resistant MFA.

The Uber 2022 breach was the definitive case for upgrading from push-notification MFA to phishing-resistant alternatives. Cyber Essentials Danzell recommends number-matching push notifications (where the user must enter a code shown on the login screen), FIDO2 hardware keys, or passkeys — all of which resist MFA fatigue attacks. Our social engineering testing includes MFA fatigue assessment. Internal testing searches for hardcoded credentials. SOC in a Box monitors for MFA fatigue patterns and anomalous internal access. And UK Cyber Defence provides incident response when social engineering bypasses authentication.


Uber was breached through MFA fatigue — again. Is your MFA phishing-resistant?

<a href="/cyber-essentials">Cyber Essentials</a> recommends number-matching or FIDO2 MFA. <a href="/penetration-testing/social-engineering">Social engineering testing</a> includes MFA fatigue. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects fatigue patterns.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles