Uber on Thursday stated it’s investigating a cybersecurity incident following reviews that the ride-hailing firm had been hacked.
“We’re at the moment responding to a cybersecurity incident,” Uber stated in a press release on Twitter. “We’re in contact with regulation enforcement and can submit extra updates right here as they grow to be out there.”
A hacker gained management over Uber’s inner techniques after compromising the Slack account of an worker, based on the New York Occasions, which says it communicated with the attacker straight. Slack, a office messaging service, is utilized by many tech firms and startups for on a regular basis communications. Uber has now disabled its Slack, based on a number of reviews.
Shares of Uber declined 5% Friday on information of the hack.
After compromising Uber’s inner Slack in a so-called social engineering assault, the hacker then went on to entry different inner databases, the Occasions reported. In a single Slack message, the hacker is alleged to have written: “I announce I’m a hacker and Uber has suffered a knowledge breach.”
A separate report, from the Washington Submit, stated the alleged attacker advised the newspaper that they had breached Uber for enjoyable and will leak the corporate’s supply code in a matter of months.
Uber stated it’s “at the moment responding to a cybersecurity incident” after reviews {that a} hacker compromised its techniques.
Rafael Henrique | Sopa Photographs | Lightrocket | Getty Photographs
Staff initially thought the assault to be a joke and responded to Slack messages from the alleged hacker with emojis and GIFs, the Submit reported, citing two individuals accustomed to the matter.
Screenshots shared on Twitter counsel the hacker additionally managed to take over Uber’s Amazon Net Companies and Google Cloud accounts, and gained entry to inner monetary knowledge.
CNBC was unable to independently confirm the knowledge. Uber declined to remark past its assertion posted on Twitter.
Whereas it is not solely clear but how Uber’s techniques have been compromised, cybersecurity researchers stated preliminary reviews point out the hacker eschewed subtle hacking methods in favor of social engineering. That is the place criminals prey on individuals’s credulity and inexperience to realize entry to company accounts and delicate knowledge.
“This can be a fairly low-bar to entry assault,” stated Ian McShane, vp of technique at cybersecurity agency Arctic Wolf. “Given the entry they declare to have gained, I am shocked the attacker did not try and ransom or extort, it seems to be like they did it ‘for the lulz’.”
“It is proof as soon as once more that always the weakest hyperlink in your safety defenses is the human,” McShane added.
Sam Curry, a self-described “bug bounty hunter” stated he’d been involved with the alleged Uber hacker and claimed that the worker focused was concerned in incident response. Curry stated which means the hacker possible had “elevated entry to start with.” Bug bounties are rewards supplied by firms to hackers for the invention of software program vulnerabilities.
“From my understanding, the attacker had keys to the dominion after acquiring an inner file with credentials to almost every little thing,” he added. Curry works for crypto startup Yuga Labs as a safety engineer and says he spoke with the hacker by way of Telegram, an instantaneous messaging platform.
Information of the assault comes as Uber’s former safety chief, Joe Sullivan, is standing trial over a 2016 breach wherein the data of 57 million customers and drivers have been stolen. In 2017, the corporate admitted to concealing the assault and, the next yr, paid $148 million in a settlement with 50 U.S. states and Washington, D.C.
Uber has tried to scrub up its picture within the wake of the exit of Travis Kalanick in 2017, the controversial former CEO who based the corporate in 2009. However scandals and controversies from Kalanick’s tumultuous tenure proceed to hang-out the agency.
In July, The Guardian reported on the leak of 1000’s of paperwork which detailed how Uber pushed into cities world wide, even when it meant breaking native legal guidelines. In a single occasion, former CEO Travis Kalanick stated that “violence ensures success” after being confronted by different executives about issues for the protection of Uber drivers despatched to a protest in France.
In response to The Guardian’s reporting on the time, Uber stated the occasions have been associated to “previous habits” and “not in keeping with our current values.”