Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

Uber Was Breached and No One Knew! Shhhhh....

November 22, 2017

  • Blog
  • Archive
There is something deeply disturbing about the most recent, public, Uber breach. Come to think of it, there are multiple things disturbing about this breach. As a security professional, I am baffled by these events and not sure how to even prioritize the things they did wrong. There are so many of them, and every business should consider these as lessons learned and not make the same mistakes. Just like a child, hopefully they have learned not to touch a hot stove. They just plainly acted like irresponsible children. Let us look at the facts to understand my position of disgusted amazement:
  • The breach occurred in October 2016 and we are just finding out about it now - over a year later.
  • The breach contained details of 57 million riders worldwide.
  • The information included names, email addresses, and phone numbers – Personally Identifiable Information in the simplest form.
  • Approximately 600,000 driver’s licenses were exposed as well and Uber failed to notify any local or state governments of the compromise despite legal obligations to do so
  • The company paid a ransom of $100,000 to the hackers to delete the breached information and keep the incident quiet.
  • The company has chosen to go public now under new leadership since they were under privacy investigations at the time of the breach and choose to hide the incident.
  • The breach occurred due to a failure to secure credentials on a Github site used by engineers. This was then leveraged using stolen privileges to gain access to Amazon AWS instances that support Uber. An archive file was then compromised containing the data.
  • Uber maintains none of the stolen information has been used in any other attacks or incidents (for now).
  • Uber agreed to an FTC settlement three months ago over privacy concerns, without admitting wrongdoing, and before telling the agency about the breach – thus completely misleading the government!
Clearly, their new executive team gets it, but the former CEO and legal officers were clueless. This is just another case of privileges being used in a targeted attack, hackers demanding ransom for stolen information, and companies not being morally responsible for the stolen user data. I really cannot add more. The facts speak from themselves and everyone needs to secure privileges and be morally responsible in case the worst happens. Unfortunately, it is too late for Uber, Yahoo, and Equifax. Hopefully, we can fix these problems and not add any more companies to the list.

Morey J. Haber

Chief Technology Officer and Chief Information Security Officer at BeyondTrust

Morey J. Haber is Chief Technology Officer and Chief Information Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four Apress books: Privileged Attack Vectors (2 Editions), Asset Attack Vectors, and Identity Attack Vectors. In 2018, Bomgar acquired BeyondTrust and retained the BeyondTrust name. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. Morey currently oversees BeyondTrust strategy for privileged access management and remote access solutions. In 2004, he joined eEye as Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Webcasts | February 09, 2021

Customer Webinar: Remote Support 21.1 Released!

Webcasts | February 24, 2021

Your PAM 2021 Blueprint: Securing Privileged Accounts for On-Premises and Cloud Assets

Whitepapers

Evolving Privileged Identity Management (PIM) In The 'Next Normal'

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.