The Last Hunt of Social Engineering: Uber

A young hacker allegedly broke into Uber’s network last week using social engineering attacks. He gained access to a staff member’s Slack login and utilized it to inform Uber staff that there had been a data breach. Uber noticed this and within hours, it published additional facts quickly confirming the hack on Twitter. Uber asserts that no user data was compromised, and they informed law authorities, and that all of their services have been brought back up.

“Hi @here I announce I am a hacker and Uber has suffered a data breach” was the message that appeared in a channel on Uber’s Slack. After the message, the ride-share giant confirmed that it was responding to “a cybersecurity incident” in cooperation with law enforcement. An 18-year-old hacker reportedly took responsibility for the attack that hit the headlines and showed how significant users’ cyber security awareness has a role in defending the networks.

The Slack post included a number of Uber databases and cloud services that the cyber criminals claimed to have breached. Not only Slack, the company’s internal messaging service, but other internal systems were also inaccessible after the hack. Therefore, the hack did not only cause a data breach and a huge loss of reputation, business continuity was also severely damaged.

How did it happen?

A closer look at the incident will reveal that a familiar cause was behind the attack: Social engineering. Despite the huge security investments and the steps security teams took, cyber criminals have been able to breach the organizations’ computer networks by abusing the weakest part of the cyber security chain, the user.

The initial reaction from Uber after the incident seems to have been an effort to underestimate what had happened. The Uber spokesman said the attacker compromised a worker’s Slack account and that is how he was able to send a message to the Slack channel. However, it was just the tip of the iceberg. It appeared that the hacker was actually able to gain access to Uber source code, email, and other internal systems.

Although the incident is quite groundbreaking. The starting point of the attack is relatively simple. The attacker said that he had sent a text message to an Uber employee claiming to be a corporate information technology person. The worker was convinced to give his/her the password that allowed the hacker to gain access to the company’s networks. He targeted an individual employee and repeatedly sent him/her multifactor authentication login notifications. By doing this, the attacker made the employee think that there was a problem with log-in. Later, he contacted the same target on WhatsApp, pretending to be an Uber IT person and saying that the MFA notifications would stop once the target approved the login. A convincing scenario, isn’t it?

Social engineering has always been one of the strongest weapons of the cyber threat actors, and these types of attacks, which enable the attacker to gain a foothold, are on the rise. Attackers who executed the 2020 hack of Twitter also used social engineering to intrude into the company as well as the ones who breached Microsoft and Okta.

Phishing and spear phishing, two commonly used social engineering methods have continued to pose great risk to the organizations. Contacted by email, phone or messages including SMS, the targets are deceived to give sensitive, confidential and personal data (credit card details, passwords…) to the criminals who pose as legitimate institutions or people.

The phishing and social engineering tactics the hacker claimed to have used to breach the company are pretty similar to what a lot of red teamers, penetration testers have used to raise the cyber security awareness level of organizations. However, the recent huge hacks, including Uber, exhibit one more time that raising awareness does not necessarily mean maintaining awareness at a high level. The organizations’ employees should be trained frequently, and the level of awareness should be measured constantly. This is a non-stop engagement not a one-time effort.

How Keepnet Can Help You Against Social Engineering?

Keepnet’s Phishing Simulator is a cyber security program that allows organizations to send benign social engineering attacks that look real but are completely fake to their employees to test their users. Keepnet’s Phishing tests are designed to allow employees to detect phishing attacks and their variants and report them appropriately, and are also used to detect weak links and measure the effectiveness of security training programs.

The Phishing Simulation module is fully-integrated with our Awareness Educator to automatically place employees who are caught by our phishing simulations onto appropriate e-learning courses to improve their vigilance to genuine phishing attacks.

Different industries have utilized Keepnet Labs Phishing Simulator and Security Awareness Educator to achieve their specific goal to get protected from social engineering attacks.

Keepnet Labs focus on social engineering problem that many industries have been facing today, and provide a detailed step-by-step description of how their system is secured by Keepnet Labs security awareness modules.

Not the first, hopefully the last?

The last incident was not the first time that Uber’s data was stolen. In 2016, cyber criminals accessed 57 million driver and rider accounts and demanded Uber to pay $100,000 to delete their copy of the data. The company made the payment but kept the breach hidden for more than a year.