{"id":22923,"date":"2022-12-13T01:29:17","date_gmt":"2022-12-13T01:29:17","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/13\/uber-has-been-hacked-yet-again-with-code-and-employee-data-released-online\/"},"modified":"2022-12-13T01:29:17","modified_gmt":"2022-12-13T01:29:17","slug":"uber-has-been-hacked-yet-again-with-code-and-employee-data-released-online","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/13\/uber-has-been-hacked-yet-again-with-code-and-employee-data-released-online\/","title":{"rendered":"Uber has been hacked yet again with code and employee data released online"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Uber Technologies Inc. has suffered yet another data breach, with a hacker sharing the stolen data on BreachForums, the successor forum for the now-shuttered<\/a> RaidForums.<\/p>\n

The unimaginative hacker goes by the name of \u201cUberLeak\u201d with a post on BreachForums that reads \u201chacked by autistic fisherman Arion and scammed all LAPSUS$ members.\u201d Lapsus$ is an infamous<\/a> hacking<\/a> group,<\/a> but aside from the forum post, there is no indication of any link to the group.<\/p>\n

The leaked data includes numerous archives claiming to be source code associated with the mobile device management platforms used by Uber, the company\u2019s food delivery service Uber Eats and third-party vendor services. No Uber user information was found in the stolen data versus internal code and Uber corporate data. However, the stolen data did include the details of 77,000 Uber employees.<\/p>\n

\u201cGiven that the data is now publicly accessible, as opposed to being sold to a single party, anyone could use it to launch targeted phishing attacks against Uber employees,\u201d Paul Bischoff, privacy advocate at tech research site Comparitech Ltd.<\/a>, told SiliconANGLE. \u201cThese attacks could trick Uber staff into giving up login credentials, leading to further, more consequential attacks. Even if only a handful of employees out of the 77,000 affected were to fall victim to a phishing scam, it could be detrimental to Uber and its customers.\u201d<\/p>\n

A spokesperson for Uber told Bleeping Computer<\/a> that the \u201cfiles\u00a0are related to an incident at a third-party vendor and are unrelated to our security incident in September.\u201d The security incident in September was reported at the time<\/a> as involving a hacker breaching internal systems and leaving messages that they had accessed critical information.<\/p>\n

Uber pointed to a security notice from IT asset management software company Teqtivity Inc. The breach notification statement<\/a> states that a malicious third party was able to again to the company\u2019s Amazon Web Services Inc. backup server that housed Teqtivity code and data files related to customers.<\/p>\n

The number of times Uber has hacked and\/or suffered data breaches is notable as they are difficult to count. To say that Uber was breached yet again is to say the sun rises in the east. Companies have shut down<\/a> for far less than Uber\u2019s ongoing and appallingly bad cybersecurity, but every time they seemingly get a free pass.<\/p>\n

Among nearly countless Uber data breaches, its most infamous data breach occurred in 2016<\/a>. It wasn\u2019t even the theft of 57 million personally identifiable information customer records that most will remember the data breach for as opposed to that former Uber Chief Security Officer Joe Sullivan covered it up.<\/p>\n

Sullivan was found guilty of\u00a0obstruction of justice and \u201cmisprision\u201d or concealment of a felony in October<\/a>. As noted when he was found guilty, Sullivan had previously played\u00a0a pivotal role in responding to U.S. Federal Trade Commission inquiries about Uber\u2019s cybersecurity practices following an earlier breach in 2014.<\/p>\n

\u201cUnfortunately due to historical events, Uber will not only continue to be a target but will also be under a microscope when it comes to security incidents,\u201d Erich Kron, security awareness advocate at security awareness training company KnowBe4 Inc.<\/a>, explained. \u201cIf this is indeed data collected from a third party, it does serve to remind organizations that any time other parties have access to information, it can potentially be an issue.\u201d<\/p>\n

Stephan Chenette, co-founder and chief technology officer at real-time cybersecurity readiness company AttackIQ Inc.<\/a> noted that \u201cbesides the high-profile breach that occurred three months ago that caused the company\u2019s internal databases to be hacked, Uber also faced other significant attacks in the past, such as a massive data breach in 2016 that exposed the data of about 57 million customers and drivers.\u201d<\/p>\n

\u201cThe failed protection of a third-party vendor in the most recent attack reveals that companies everywhere must better prioritize their cybersecurity measures,\u201d Chenette added.<\/p>\n

Photo: Automobileitalia\/Flickr<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n