Security News
The breach appeared to have compromised many of Uber's internal systems, and a person claiming responsibility for the hack sent images of email, cloud storage and code repositories to cybersecurity researchers and The New York Times. "They pretty much have full access to Uber," said Sam Curry, a security engineer at Yuga Labs who corresponded with the person who claimed to be responsible for the breach.
Uber suffered a cyberattack Thursday afternoon with a hacker gaining access to vulnerability reports and sharing screenshots of the company's internal systems, email dashboard, and Slack server. The New York Times, which first reported on the breach, said they spoke to the threat actor, who said they breached Uber after performing a social engineering attack on an employee and stealing their password.
Update: A Threat Actor claims to have completely compromised Uber - they have posted screenshots of their AWS instance, HackerOne administration panel, and more. Bug hunter Sam Curry claims to have heard from an Uber employee.
Ride hailing giant Uber disclosed Thursday it's responding to a cybersecurity incident involving a breach of its network and that it's in touch with law enforcement authorities.The hack is said to have forced the company to take its internal communications and engineering systems offline as it investigated the extent of the breach.
Microsoft says the Outlook email client will crash when opening and reading emails with tables such as Uber receipt emails. "When opening, replying, or forwarding some emails that include complex tables, Outlook stops responding," the company explains in a support document.
Security researchers from Onapsis - the security firm that specializes in security for SAP, Oracle, Salesforce, and other software-as-a-service platforms and that discovered the bugs - joined SAP in coordinating the release of a Threat Report describing the critical vulnerabilities onTuesday. As of Tuesday, Onapsis Research Labs had estimated that there were tens of thousands - approximately 40,000 - SAP customers running more than 10,000 potentially affected, internet-exposed SAP applications.
The easy-to-find bug has been hanging around for years, ready to take Uber's customers for a ride of a very different sort. According to Seekurity security researcher and bug-hunter Seif Elsallamy, the HTML-injection issue made it possible to tap into an internet-facing internal Uber API endpoint in order to send out email directly from Uber's email system; since the emails would be coming from an authentic sender, they wouldn't trigger normal email security filters like DMARC or DKIM. Obviously, the bug opened a gaping opportunity for cyberattackers to send out social-engineering emails to the ride-sharing giant's nearly 100 million users - perhaps a message asking them to "Verify" their account info or "Update" their credit-card information.
A vulnerability in Uber's email system allows just about anyone to send emails on behalf of Uber. The researcher who discovered this flaw warns this vulnerability can be abused by threat actors to email 57 million Uber users and drivers whose information was leaked in the 2016 data breach.
A vulnerability in Uber's email system allows just about anyone to send emails on behalf of Uber. The researcher who discovered this flaw warns this vulnerability can be abused by threat actors to email 57 million Uber users and drivers whose information was leaked in the 2016 data breach.
Chinese ride hailing app DiDi Chuxing was on Sunday removed from local app stores on on grounds that it did not comply with data protection laws. In its notice of its actions the CAC wrote: "The DiDi Travel App has serious violations of laws and regulations in collecting and using personal information."