Uber's hacker, who claims to be 18 years old, says he hacked Uber for fun, using social engineering, might leak source code, and has access to its AWS account
The incident quickly widened from an intrusion claim to an operational response: Uber took internal systems offline to investigate, while reporting indicated the intruder had reached its HackerOne program and downloaded vulnerability reports. In Uber’s subsequent account, the initial foothold was a breached contractor account and the exposed bug reports had been remediated.
First-order effects
Uber must contain and investigate access across its internal systems, including the claimed AWS and source-code exposure, while restoring only the services it can validate.
The reported download of HackerOne vulnerability reports makes remediation more urgent because disclosed weaknesses may have become available to the intruder.
Second-order effects
Uber’s contractor-account controls and its access to externally operated security programs become part of the incident response, rather than separate vendor-management functions.
HackerOne bug reports shift from a defensive resource to a sensitive access target in this case, raising the operational cost of broad access to vulnerability disclosure data.
Third-order effects
The episode points to identity and third-party access becoming a primary security boundary for cloud-hosted software, alongside network defenses and source-code controls.
If companies continue to centralize internal tools, cloud accounts, and vulnerability programs behind employee and contractor identities, breach containment will increasingly depend on granular access segmentation.
The trend: Enterprise security is moving toward tighter identity-based controls as social engineering and third-party accounts can unlock multiple internal systems at once.
Apparently there was an internal network share that contained powershell scripts... “One of the powershell scripts contained the username and password for a admin user in Thycotic (PAM) Using this i was able to extract secrets for all services, DA, DUO, Onelogin, AWS, GSuite” htt…
An Uber employee told Fortune that when they open their work laptop, all internal websites displayed a picture of an “erect penis” with the text “FUCK YOU DUMB WANKERS.” https://fortune.com/...
old enough to remember three days ago when twitter was the only tech company with bad security https://www.washingtonpost.com/ ... https://t.co/UZE1YaXQKY
I can't dunk on this. I know a lot of people will, but I can't. I was raised in newsrooms, which is second only to LE for gallows humor. But lol at being told to stop. https://twitter.com/...
The Uber breach, which the hacker says began with social engineering of an employee, may be so thorough that it will be hard to kick the intruder out, experts said overnight. https://www.washingtonpost.com/ ...
NEW: An employee at Uber described scenes of chaos on Thursday night as the ride-hailing company's computer systems were commandeered in a devastating hack that buffeted staffers with obscene images. I wrote about inside the mayhem for @FortuneMagazine: https://fortune.com/...
Pour one out for the security response team at Uber. Hardcoded secrets in a powershell script got them powershellacked. Good practice is to assume intruders will seek out your internal scripts & do not leave secrets hard coded to help them elevate privilege & pivot like this. htt…
Second time in a week that I have heard of hardcoded PAM secrets giving an opportunistic attacker *all the access* to a global corp. Technology is wholly dependent upon proper implementation and process. It's easy to point fingers at a product, but often wrong. https://twitter.co…
If this screen shot is to be believed, the hacker who broke into Uber spammed the company's slack with a message about underpaid drivers.... https://twitter.com/...
As employee reactions poured in, including a Mr. Krabs meme, the “It's Happening” GIF and questions about whether it was a prank, someone wrote. “Sorry to be a stick in the mud, but I think IT would appreciate less memes while they handle the breach” https://www.washingtonpost.co…
The Uber hacker reportedly posted a message in the company's internal Slack, and employees thought it was joke and reacted with 🍿 and 🚨 emoji and GIFs on the post https://twitter.com/...