AP

Hacker claims to breach Uber, security researcher says

Sep 15, 2022, 10:00 AM | Updated: 11:06 pm

FILE - An Uber sign is displayed at the company's headquarters in San Francisco, Monday, Sept. 12, ...

FILE - An Uber sign is displayed at the company's headquarters in San Francisco, Monday, Sept. 12, 2022. Uber said Thursday, Sept. 15, that it reached out to law enforcement after a hacker apparently breached its network. A security engineer said the intruder provided evidence of obtaining access to crucial systems at the ride-hailing service. (AP Photo/Jeff Chiu, File)

(AP Photo/Jeff Chiu, File)

Uber said Thursday that it reached out to law enforcement after a hacker apparently breached its network. A security engineer said the intruder provided evidence of obtaining access to crucial systems at the ride-hailing service.

There was no indication that Uber’s fleet of vehicles or its operation was in any way affected.

“It seems like they’ve compromised a lot of stuff,” said Sam Curry, an engineer with Yuga Labs who communicated with the hacker. That includes complete access to the Amazon and Google-hosted cloud environments where Uber stores its source code and customer data, he said.

Curry said he spoke to several Uber employees who said they were “working to lock down everything internally” to restrict the hacker’s access. That included the San Francisco company’s Slack internal messaging network, he said.

He said there was no indication that the hacker had done any damage or was interested in anything more than publicity. “My gut feeling is that it seems like they are out to get as much attention as possible.”

The hacker had alerted Curry and other security researchers to the intrusion on Thursday evening by using an internal Uber account to comment on vulnerabilities they had previously identified on the company’s network through its bug-bounty program, which pays ethical hackers to ferret out network weaknesses.

The hacker provided a Telegram account address and Curry and other researchers then engaged them in a separate conversation, sharing screenshots of various pages from Uber’s cloud providers to prove they broke in.

The Associated Press attempted to contact the hacker at the Telegram account where Curry and the other researchers chatted with them. But no one responded.

The New York Times reported that the person who claimed responsibility for the hack said they gained access through social engineering: They sent a text message to an Uber worker claiming to be a company tech employee and persuaded the worker to hand over a password that gave them access to the network.

The Times said the hacker reported being 18 years old and saying they broke in because the company had weak security.

One screenshot posted on Twitter and confirmed by researchers shows a chat with the hacker in which they say they obtained the credentials of an administrative user through social engineering.

Social engineering is a popular hacking strategy, as humans tend to be the weakest link in any network. Teenagers used a similar ploy in 2020 to hack Twitter

Uber said via email that it was “currently responding to a cybersecurity incident. We are in touch with law enforcement.” It said it would provide updates on its Uber Comms twitter feed.

The company has been hacked before.

Its former chief security officer, Joseph Sullivan, is currently on trial on allegations he arranged to pay hackers $100,000 to cover up a 2016 high-tech heist in which the personal information of about 57 million customers and drivers was stolen.

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

AP

moore redmond washington...

Associated Press

U.S. Supreme Court rules against Redmond couple challenging foreign income tax

The court ruled in the case of Charles and Kathleen Moore, of Redmond, Washington after they previously challenged a $15,000 tax bill.

4 days ago

Image:The New York Giants' Willie Mays poses for a photo during baseball spring training in 1972. M...

Associated Press

Willie Mays, Giants’ electrifying ‘Say Hey Kid,’ dies at 93

Willie Mays, whose singular combination of talent, drive and exuberance made him one of baseball’s greatest players, has died. He was 93.

5 days ago

Image: This photo provided by the Washington Department of Ecology shows a derailed BNSF train on t...

Associated Press

Judge orders BNSF to pay Washington tribe nearly $400M for trespassing with oil trains

BNSF Railway must pay the sum to a Native American tribe in Washington after it ran 100-car trains with crude oil on the tribe's reservation.

6 days ago

Photo: In this photo provided by Tieanna Joseph Cade, an amusement park ride is shown stuck with 30...

Associated Press

Crews rescue 28 people trapped upside down high on Oregon amusement park ride

Emergency crews in Oregon rescued 28 people after they were stuck dangling upside down high on a ride at a century-old amusement park.

7 days ago

juneteenth shooting texas...

Associated Press

2 killed and 6 wounded in shooting during a Juneteenth celebration in a Texas park

A shooting in a Texas park left two people dead and six wounded, including two children, on Saturday, authorities said.

8 days ago

Photo: Israeli soldiers drive a tank near the Israeli-Gaza border, in southern Israel, Wednesday, J...

Jack Jeffery, The Associated Press

8 Israeli soldiers killed in southern Gaza in deadliest attack on Israeli forces in months

An explosion in Gaza killed eight Israeli soldiers, the military said Saturday, making it the deadliest attack on Israeli forces in months.

8 days ago

Hacker claims to breach Uber, security researcher says