Uber launches infosec hiring spree after attributing breach to LAPSUS$

Getty Photos

Uber has embarked on a choosing spree for security staff in the wake of its information breach final week and has also unveiled new information about who was powering the attack.

On Friday final 7 days, various open positions appeared on LinkedIn just just one day just after the experience-hailing tech giant verified the breach to the general public. 

Roles that are nonetheless open for purposes contain senior security incident commander to direct incident reaction, security engineer and security engineering supervisor at the firm’s danger detection division, and senior security engineers throughout purposes security, business security, and investigations. 

“Hey bear in mind those roles we did not enable you hire for? I secured funding.” pic.twitter.com/HGLdbvf9pV

— Frank McGovern (@FrankMcG) September 19, 2022

The positions opened for candidates the day after the attack was verified and exhibits Uber’s commitment to tightening its security following the breach.

In an update to shoppers on Monday, Uber also confirmed various other specifics about who was guiding the attack and how the cyber criminals had been ready to efficiently breach the organization. 

Uber attributed the attack to the LAPSUS$ hacking group which arrived to prominence in early 2022, saying prosperous attacks on significant organizations such as Microsoft, Okta, Nvidia, Samsung, and T-Cell.

The group has been described as both “competent and incompetent at the exact same time” by professionals and is thought to be operate by younger cyber criminals in Portugal, Brazil, and the UK whose ages vary involving 16 and 21.

Not like many rising cyber criminal organisations, LAPSUS$ does not operate on a ransomware design and in the circumstance of the Uber hack, the enterprise said the team managed to attain accessibility to a contractor’s account by spamming multi-factor authentication (MFA) prompts.

Uber thought the contractor’s product had been contaminated with malware, making it possible for hackers to steal credentials and market them to LAPSUS$ on the dark web. 

From there, the attackers repeatedly tried to get access to the contractor’s account utilizing the stolen credentials, and the repeated tries would have shipped a annoying variety of prompts to the contractor’s phone.

The contractor finally approved one particular of the prompts permitting the attackers full obtain to their account.

This is a known attack process in the field and depends on sending so many prompts that the focus on results in being annoyed with all the notifications and accepts a person to make them quit. 

LAPSUS$ is also known for possessing deployed these kinds of tactics in the previous, stating they choose to have them out although the goal sleeps to maximise success.

“From there, the attacker accessed numerous other employee accounts which in the long run gave the attacker elevated permissions to a quantity of applications, which include G Suite and Slack,” stated Uber. 

“The attacker then posted a concept to a business-huge Slack channel, which quite a few of you saw, and reconfigured Uber’s OpenDNS to display a graphic impression to staff on some interior internet sites.”

Uber reported the attackers were in a position to accessibility and down load Slack messages – the content material of which was not specified – and down load facts from its finance team’s bill administration device.

LAPSUS$ also accessed Uber’s HackerOne dashboard. HackerOne is a security bug and vulnerability reporting system, although the only stories available to the hackers have been pertaining to vulnerabilities that had by now been remediated, Uber claimed.

The corporation verified nothing else was afflicted, like its code foundation or any of its public-facing apps or technologies.

Uber also verified that LAPSUS$ was unable to obtain any purchaser facts saved by its cloud providers, like AWS’ S3.

“We’re operating with several primary digital forensics corporations as aspect of the investigation,” reported Uber, which also claimed the investigation is even now ongoing. 

“We will also get this possibility to continue on to improve our procedures, practices, and technology to further more protect Uber versus long run attacks.”

The Rockstar website link

Uber also uncovered that it thought LAPSUS$ was the hacking team at the rear of the current breach of Rockstar Video games – the developers of popular movie sport franchises these kinds of as Grand Theft Car and Red Useless Redemption.

The studio announced around the weekend that it had fallen sufferer to a considerable information breach which concerned the leaking of footage from the company’s pre-alpha variation of the impending Grand Theft Automobile VI game.

“We a short while ago endured a network intrusion in which an unauthorised third party illegally accessed and downloaded confidential facts from our systems, such as early improvement footage for the next Grand Theft Vehicle [game],” said Rockstar Games.

Uber explained it is operating with the FBI and US Justice Division to look into the incident additional. It is unclear if the authorities are also investigating the incident at Rockstar Video games, far too.

Some sections of this post are sourced from:
www.itpro.co.uk