On 15 September 2022, an attacker got into Uber's internal network using the corporate password of an external contractor. Uber believes the password was bought on the dark web after malware infected the contractor's personal device. The attacker then bombarded the contractor with two-factor login approval requests until one was accepted, a technique known as MFA fatigue. From that foothold, Uber says, the attacker accessed other employee accounts and gained elevated permissions to tools including G Suite and Slack. They posted a message to a company-wide Slack channel, reconfigured Uber's OpenDNS and reached its HackerOne bug bounty dashboard. Uber linked the attacker to the Lapsus$ group, said it found no evidence that production systems or sensitive user data were accessed, and rotated keys to many internal services. The attacker also claimed to have found admin credentials hard-coded in a PowerShell script, which Uber has not confirmed.
Key takeaways
- Uber says the attack started with a contractor's Uber password, likely bought on the dark web after malware infected the contractor's personal device.
- Repeated two-factor prompts wore the contractor down until one was accepted, giving the attacker a logged-in session.
- The attacker moved through other employee accounts to elevated access in G Suite, Slack, a finance invoicing tool and Uber's HackerOne dashboard, according to Uber.
- The attacker claimed to have found a PowerShell script with hard-coded admin credentials; Uber did not mention this, but it did rotate keys to many internal services.
- The identity lesson: MFA that can be approved with one tap does not stop a determined attacker, and secrets reachable from inside the network turn one login into wide access.
At a glance
| Organisation | Uber Technologies |
|---|---|
| When | 15 September 2022 (Thursday); Uber's security update on 19 September 2022 |
| Attacker | An individual Uber believes is affiliated with Lapsus$, who claimed to be 18 years old; Uber also linked the same actor to the Rockstar Games breach |
| Entry point | An external contractor's corporate password, likely bought after malware infected the contractor's personal device, plus MFA fatigue |
| Identities abused | The contractor's account and other employee accounts with elevated tool permissions; the attacker claimed hard-coded admin credentials in a PowerShell script (unconfirmed by Uber); Uber rotated keys to many internal services |
| Impact | Access to G Suite, Slack, a finance invoicing tool and HackerOne vulnerability reports; no evidence of access to production systems, user accounts or sensitive user databases, according to Uber |
| Category | NHI. Incident class: confirmed NHI breach (human entry, internal keys rotated; hard-coded credential use claimed by the attacker) |
What happened
Uber's security update, quoted by Help Net Security, said: "It is likely that the attacker purchased the contractor's Uber corporate password on the dark web, after the contractor's personal device had been infected with malware, exposing those credentials." The Register quoted what came next: "The attacker then repeatedly tried to log in to the contractor's Uber account. Each time, the contractor received a two-factor login approval request, which initially blocked access. Eventually, however, the contractor accepted one, and the attacker successfully logged in."
"From there, the attacker accessed several other employee accounts which ultimately gave the attacker elevated permissions to a number of tools, including G-Suite and Slack," Uber said, according to BleepingComputer. The attacker posted in a company-wide Slack channel and reconfigured OpenDNS so employees saw a graphic image on some internal sites. Uber confirmed the attacker downloaded some internal Slack messages, accessed information from a finance tool used to manage some invoices and reached its HackerOne bug bounty dashboard, adding that "any bug reports the attacker was able to access have been remediated."
Screenshots leaked during the incident appeared to show access to Uber's AWS account, its SentinelOne dashboard and VMware vSphere, according to The Register. The attacker also claimed to have found a PowerShell script containing hard-coded admin credentials on an internal share. The Register noted that Uber's update made no mention of that claim, so it remains unconfirmed.
Uber said it found no evidence that the attacker accessed "the production (i.e. public-facing) systems that power our apps; any user accounts; or the databases we use to store sensitive user information," or changed its codebase. It blocked or reset compromised employee accounts, disabled affected internal tools, "rotated keys (effectively resetting access) to many of our internal services," locked down its codebase, required employees to re-authenticate and strengthened its MFA policies. It worked with the FBI and US Department of Justice.
Timeline
| Date | Event |
|---|---|
| 15 September 2022 | The attacker logs in with the contractor's credentials after MFA fatigue, moves to other employee accounts and posts in Uber's Slack. |
| 16 September 2022 | The attacker says they broke in for fun and may release source code, according to The Register; screenshots circulate. |
| 19 September 2022 | Uber publishes its security update, links the attacker to Lapsus$ and lists its containment steps. |
How it happened: the identity attack path
- Infostealer credentials. Malware on a contractor's personal device exposed their Uber corporate password, which Uber believes was sold on the dark web.
- MFA fatigue. Repeated two-factor push prompts led the contractor to approve one, giving the attacker a session.
- Lateral movement through accounts. The attacker accessed other employee accounts and gained elevated permissions to internal tools.
- Privileged access claimed. The attacker claimed hard-coded admin credentials in a PowerShell script; screenshots suggested access to cloud and security consoles.
- Visible disruption and data access. Slack messages, invoices and HackerOne vulnerability reports were accessed, and the attacker announced the breach in Slack.
Impact
- Confirmed by Uber: access to G Suite, Slack, a finance invoicing tool and HackerOne vulnerability reports; some Slack messages downloaded.
- Not found by Uber: access to production systems, user accounts, sensitive user databases or cloud-stored customer data, or code changes.
- Claimed, not confirmed: hard-coded admin credentials in a PowerShell script and wider access to cloud and security consoles.
- Response: keys to many internal services rotated, internal tools disabled and codebase locked.
What this means for NHI governance
The confirmed parts of this breach are about human identity: an infostealer, a reused corporate password and push MFA that could be approved with one tap. It belongs in an NHI database because of what Uber had to do afterwards and what the attacker said they found. Rotating keys to many internal services means those keys were within reach of the compromised accounts. And whether or not this particular script existed, hard-coded admin credentials on internal file shares are a common finding, and they turn any foothold into privileged access.
Two controls would have changed the outcome. Phishing-resistant MFA makes push fatigue impossible. And keeping privileged credentials in a vault with just-in-time access, not in scripts, means an attacker who reaches an internal share finds nothing usable. See our MFA Guide and Privileged Access Management Guide.
Recommendations
- Replace push approvals with phishing-resistant MFA. Use FIDO2 or number matching at minimum, and alert on repeated denied prompts. See the MFA Guide.
- Scan internal shares and scripts for secrets. Remove hard-coded credentials and move them into a vault with audited, just-in-time retrieval. See the Privileged Access Management Guide.
- Treat contractor access as third-party risk. Limit contractor accounts to what they need and require managed devices. See the Third-Party Access Guide.
- Know which keys a compromised account could reach. Map service keys to the people and tools that can read them, so rotation after an incident is targeted and fast.
- Protect vulnerability reports and security tooling. Bug bounty dashboards and security consoles are high-value targets and need strong, separate access controls.
Frequently asked questions
How was Uber hacked in 2022?
According to Uber, an attacker used a contractor's password, likely bought after malware infected the contractor's personal device, then sent repeated MFA prompts until one was accepted. The attacker then moved through other employee accounts into internal tools.
Did the Uber hacker find hard-coded passwords?
The attacker claimed to have found a PowerShell script with hard-coded admin credentials. Uber did not mention this in its update, so it is unconfirmed. Uber did rotate keys to many internal services.
Was Uber customer data stolen?
Uber said it found no evidence that the attacker accessed production systems, user accounts or the databases holding sensitive user information such as card numbers or trip history.
Related NHI Mgmt Group resources
Cisco Breach 2022: MFA Fatigue · Twilio Breach 2022 · MFA Guide · Privileged Access Management Guide · Third-Party Access Guide
How NHI Mgmt Group can help
Breaches that start with a person often become serious because of the machine credentials that person can reach. We help teams find secrets in scripts and shares, move privileged credentials into managed vaults and connect human access reviews to the keys behind them. See our NHI and AI agent security training.
References
- BleepingComputer: Uber links breach to Lapsus$ group, blames contractor for hack (19 September 2022)
- The Register: Uber explains how it was pwned this month, points finger at Lapsus$ gang (19 September 2022)
- Help Net Security: Uber says Lapsus$ gang is behind the recent breach (20 September 2022)