Uber Blames LAPSUS$ Hacking Group for Recent Security Breach

Uber on Monday disclosed more details related to the security incident^[1]
that happened last week, pinning the attack on a threat actor it
believes is affiliated to the notorious LAPSUS$ hacking group.

“This group typically uses similar techniques to target
technology companies, and in 2022 alone has breached Microsoft,
Cisco, Samsung, NVIDIA, and Okta, among others,” the San
Francisco-based company said^[2]
in an update.

The financially-motivated extortionist gang was dealt a huge
blow in March 2022 when the City of London Police moved to arrest^[3]
seven suspected LAPSUS$ gang members aged between 16 and 21. Weeks
later, two of them were charged for their actions.

The hacker behind the Uber breach, an 18-year-old teenager who
goes by the moniker Tea Pot, has also claimed responsibility for
breaking into video game maker Rockstar Games^[4]
over the weekend.

Uber said it’s working with “several leading digital forensics
firms” as the company’s investigation into the incident continues,
in addition to coordinating with the U.S. Federal Bureau of
Investigation (FBI) and the Justice Department on the matter.

As for how the attack unfolded, the ridesharing firm said an
“EXT contractor” had their personal device compromised with malware
and their corporate account credentials stolen and sold on the dark
web, corroborating an earlier report from Group-IB.

The Singapore-headquartered company, the previous week, noted
that at least two of Uber’s employees located in Brazil and
Indonesia were infected with Raccoon and Vidar information
stealers^[5].

“The attacker then repeatedly tried to log in to the
contractor’s Uber account,” the company said. “Each time, the
contractor received a two-factor login approval request, which
initially blocked access. Eventually, however, the contractor
accepted one, and the attacker successfully logged in.”

Upon gaining a foothold, the miscreant is said to have accessed
other employee accounts, thereby equipping the malicious party with
elevated permissions to “several internal systems” such as Google
Workspace and Slack.

The company further said it took a number of steps as part of
its incident response measures, including disabling impacted tools,
rotating keys to the services, locking down codebase, and also
blocking compromised employee accounts from accessing Uber systems
or alternatively issuing a password reset for those accounts.

Uber didn’t disclose how many employee accounts were potentially
compromised, but it reiterated that no unauthorized code changes
were made and that there was no evidence the hacker had access to
production systems that support its customer-facing apps.

That said, the alleged teen hacker is said to have downloaded
some unspecified number of internal Slack messages and information
from an in-house tool used by its finance team to manage certain
invoices.

Uber also confirmed that the attacker accessed HackerOne bug
reports, but noted that “any bug reports the attacker was able to
access have been remediated.”

“There is only one solution to making push-based [multi-factor
authentication] more resilient and that is to train your employees,
who use push-based MFA, about the common types of attacks against
it, how to detect those attacks, and how to mitigate and report
them if they occur,” Roger Grimes, data-driven defense evangelist
at KnowBe4, said in a statement.

Chris Clements, vice president of solutions architecture at
Cerberus Sentinel, said it’s crucial for organizations to realize
that MFA is not a “silver bullet” and that not all factors are
created equal.

While there has been a shift from SMS-based authentication to an
app-based approach to mitigate risks associated with SIM swapping attacks^[6], the attack against
Uber^[7]
and Cisco^[8]
highlights that security controls once considered infallible are
being bypassed by other means.

The fact that threat actors are banking on attack paths such as
adversary-in-the-middle (AiTM^[9]) proxy toolkits and MFA
fatigue (aka prompt bombing) to trick an unsuspecting employee into
inadvertently handing over MFA codes or authorizing an access
request signals the need to adopt phishing-resistant methods.

“To prevent similar attacks, organizations should move to more
secure versions of MFA approval such as number matching that
minimize the risk of a user blindly approving an authentication
verification prompt,” Clements said.

“The reality is that if an attacker only needs to compromise a
single user to cause significant damage, sooner or later you are
going to have significant damage,” Clements added, underscoring
strong authentication mechanisms “should be one of many in-depth
defensive controls to prevent compromise.”