Uber hacker, who claims to be 18 years old, says he hacked Uber for fun, using social engineering, might leak source code, and has access to Uber's AWS account
The company said in a tweet it was “responding to a cybersecurity incident” — SAN FRANCISCO — Uber's computer systems …
Washington Post
Context & Ripple Effects
Uber’s incident moved beyond an initial systems investigation when reporting indicated the intruder had accessed its HackerOne bug-bounty environment and downloaded vulnerability reports. The reported social-engineering route also aligns with Uber’s later account that a contractor account was compromised and the exposed reports were remediated in its post-incident response.
The claimed AWS access and threatened source-code release make the breach consequential not only for internal operations but for the security material and development environment tied to Uber’s services. Uber had already taken internal systems offline amid reports of broad access to its network.
First-order effects
Uber must contain and investigate access across its internal systems while assessing whether its AWS environment, source code, and vulnerability reports were exposed.
Uber’s security and engineering teams face immediate remediation work on the downloaded bug-bounty reports, since those reports can identify previously reported weaknesses.
Second-order effects
Uber’s contractors and access-management processes come under scrutiny because the later company account attributes the entry point to a breached contractor account.
Disclosure of source code or vulnerability reports would give attackers more actionable detail about Uber’s systems, raising the urgency of patching and credential review beyond restoring offline tools.
Third-order effects
The incident points to identity and third-party access becoming a central security boundary for companies whose operational systems and cloud environments are tightly connected.
If similar breaches continue to pair social engineering with access to code and vulnerability data, software-delivery controls will need to treat internal security programs as high-value production assets.
The trend: Social-engineering breaches are increasingly turning a single compromised identity into access to cloud, code, and security-management systems.
Apparently there was an internal network share that contained powershell scripts... “One of the powershell scripts contained the username and password for a admin user in Thycotic (PAM) Using this i was able to extract secrets for all services, DA, DUO, Onelogin, AWS, GSuite” htt…
From another Uber employee: Instead of doing anything, a good portion of the staff was interacting and mocking the hacker thinking someone was playing a joke. After being told to stop going on slack, people kept going on for the jokes. lmao
As employee reactions poured in, including a Mr. Krabs meme, the “It's Happening” GIF and questions about whether it was a prank, someone wrote. “Sorry to be a stick in the mud, but I think IT would appreciate less memes while they handle the breach” https://www.washingtonpost.co…
Pour one out for the security response team at Uber. Hardcoded secrets in a powershell script got them powershellacked. Good practice is to assume intruders will seek out your internal scripts & do not leave secrets hard coded to help them elevate privilege & pivot like this. htt…
Second time in a week that I have heard of hardcoded PAM secrets giving an opportunistic attacker *all the access* to a global corp. Technology is wholly dependent upon proper implementation and process. It's easy to point fingers at a product, but often wrong. https://twitter.co…
If this screen shot is to be believed, the hacker who broke into Uber spammed the company's slack with a message about underpaid drivers.... https://twitter.com/...
The Uber hacker reportedly posted a message in the company's internal Slack, and employees thought it was joke and reacted with 🍿 and 🚨 emoji and GIFs on the post https://twitter.com/...