Cyber Security

Uber and LastPass breaches – is 2FA all it’s cracked as much as be? [Audio + Text] – Bare Safety


With Doug Aamoth and Paul Ducklin.

DOUG.  Uber hacked, extra on the LastPass breach, and Firefox 105.

All that, and extra, on the Bare Safety Podcast.

[MUSICAL MODEM]

Welcome to the podcast, everyone, I’m Doug Aamoth.

With me, as at all times, is Paul Ducklin…

[DRAMATIC VOICE] …the host of Safety SOS Week, a star-studded lineup of interviews with safety specialists working from 26-29 September 2022.


DUCK.  I just like the sound of that, Doug. [LAUGHS]


DOUG.  Sure!


DUCK.  Please be a part of us subsequent week, of us.

It’s the final week of September.

We selected that as a result of it’s the week main as much as Cybersecurity Consciousness Month – that’s not a coincidence.

So, 26, 27, 28, and 29 September 2022.

Every day there’s a 30-minute interview with one in every of 4 totally different specialists at Sophos.

We’ve acquired Fraser Howard, malware knowledgeable extraordinaire.

We’ve acquired Greg Rosenberg, who will clarify the challenges of detecting that somebody is in your community to begin with, so you possibly can head them off earlier than it goes fallacious.

There’s Peter Mackenzie from our Incident Response Crew, who will inform you some fascinating, scary, however very academic tales about attackers that he’s been despatched into bat in opposition to.

And we wrap all of it up with Craig Jones, who will inform you easy methods to arrange a SecOps workforce of your personal.

Craig is the Senior Director of Safety Operations *at Sophos itself*, Doug, so he does cybersecurity in a cybersecurity firm.

He’s a beautiful chap, and nicely value listening to.

The URL is: https://sophos.com/sosweek


DOUG.  Can’t wait… I will probably be there!

Please be a part of me, everybody – it will likely be a rollicking good time.

And talking of a rollicking good time, it’s time for our This Week in Tech Historical past phase.

One thing that’s close to and expensive to my coronary heart – this week, on 23 September 2008, the world’s first Android cellphone was launched.

It was known as the T-Cell G1, and it featured a 3.2-inch flip-out display screen that exposed a full {hardware} keyboard.

It additionally had a trackball and no commonplace headphone jack.

Early evaluations had been blended, however hopeful.

Because of Android’s comparatively open nature, G1 went on to promote one million handsets in six months, and at one level accounted for two-thirds of units on T-Cell’s 3G community.

I had a kind of units… it was one in every of my favourite telephones of all time.


DUCK.  Aaaaah, trackballs on telephones, eh?

Keep in mind the BlackBerries?

It was the factor, wasn’t it… that trackball was actually nice.


DOUG.  It was good for scrolling.


DUCK.  Then they went, “Out with transferring elements,” and it was an infrared sensor or one thing.


DOUG.  Sure.


DUCK.  How occasions change, Doug.


DOUG.  Sure… I miss it.


DUCK.  Such as you, I preferred these slide-out keyboards that the early telephones had.

There’s one thing reassuring about truly listening to the click-click-click.

I feel what I actually preferred about it’s that whenever you popped out the keyboard, it didn’t obscure half the display screen.


DOUG.  Precisely!


DUCK.  It wasn’t like half the e-mail you’re studying disappeared whenever you wished to answer.

Which I suppose we’ve simply acquired used to now… that’s the way in which of the world, I suppose.


DOUG.  That was a very long time in the past – less complicated occasions.

Let’s speak in regards to the Firefox 105 launch.

What’s new from a safety standpoint right here, Paul?


DUCK.  Happily, nothing that seems to be within the wild and nothing that charges a important degree of vulnerability.

However there are a couple of intriguing vulnerabilities.

One during which a person internet web page that’s break up right into a bunch of separate IFRAMES might have safety permission leakage between these elements.

So, you may need a less-privileged body from a subdomain in your web site, for instance, that isn’t supposed to have the ability to entry the webcam (as a result of this bug is about gadget permissions), but it appears as if you may truly have the ability to take action.

And one other comparable sounding bug, the place a subdomain of your web site – a weblog or a microsite or one thing like that – might truly mess with cookies within the mum or dad web site.

Oh, and an excellent previous “stack buffer overflow when initialising graphics”… only a reminder that reminiscence bugs are nonetheless an issue!

And naturally, there’s the standard “reminiscence security bugs mounted in Firefox 105”, and within the Prolonged Help Launch, which is 102.3.

Keep in mind that within the Prolonged Help Launch, the 2 numbers add collectively: 102+3 = 105.

So, the Prolonged Help Launch is all the things from the primary model quantity, plus three updates value of safety fixes, however with the function fixes held again.

So get it whereas it’s recent.


DOUG.  Please do!

Let’s transfer on to the story of the century, breathlessly reported: “Uber has been hacked.”

Wanting a little bit nearer at it… sure, it’s unhealthy, it’s embarrassing, however it might have been a lot, a lot worse.


DUCK.  Sure, Uber has come out with a observe up report, and evidently they’re suggesting {that a} hacking group like LAPSUS$ was accountable.

We’ve spoken about LAPSUS$ on the podcast earlier than.

It’s a form of a “let’s do it for the lulz” sort of factor, the place it doesn’t look as if they’re truly after promoting the info, though they may give it away at no cost or actually embarrass the corporate with it.

As I say, the embarrassment comes from the obvious extent of the breach, happily, moderately than its depth.

It looks like the attackers wished to wander round by means of the community as shortly as attainable, grabbing screenshots, saying, “Hey, look, right here’s me in all types of issues”…

…together with Slack workspaces; Uber’s risk safety software program (in previous language, the anti-virus); an AWS console; firm journey and bills.

There was a screenshot that I noticed printed that confirmed who’d put within the greatest T&E [travel and expenses] claims in latest occasions. [LAUGHTER]

We chortle, however there are worker names in there, in order that’s a nasty look as a result of it’s implying that the particular person might have gotten at worker knowledge.

A vSphere digital server console; Google workspaces; and the place the place it appears the hacker truly put within the “UBER HAS BEEN HACKED” in capital letters that made the headlines (it even made the Bare Safety headline).

Apparently that was posted to… (oh, expensive, Doug [LAUGHS] – it’s not humorous, but it’s)

…to Uber’s personal bug bounty service, which is a really embarrassing look.


DOUG.  It seems like somebody acquired a maintain of an Uber polo shirt and put it on, and sweet-talked their well past the reception desk saying, “Oh, my badge isn’t working,” or one thing, acquired into the headquarters after which simply began taking footage of stuff.

Then they wrote on the bulletin board within the worker break room that they’ve been hacked.

It seems like this particular person might have been an Preliminary Entry Dealer [jargon term for hacker who steals passwords and sells them on] in the event that they actually wished to.

They might have accomplished so many further unhealthy issues whereas they had been in there.

However they only took footage, and it was a humiliation to Uber.


DUCK.  Sure.

I feel the important thing element that we might add to your analogy of “getting by means of the primary safety checkpoint” is that, on the way in which in, it additionally appears that they had been capable of attain into the super-secure secret cupboard the place the access-all-areas passes are saved, and purloin one.


DOUG.  Sure. [LAUGHS]


DUCK.  In different phrases, they discovered a password in a PowerShell script, on an brazenly seen community share…

…in order that they solely wanted low degree entry, and that allowed them to get into what was basically the password supervisor for Uber’s networks.


DOUG.  Sure.

So it’s not that this wasn’t unavoidable.

If we get to the recommendation in your article right here, we’ve got a number of issues that Uber might have accomplished otherwise.

Beginning with: “Password managers and two-factor authentication will not be a panacea.”

Simply because you might have these… that’s a safety gate, however it’s not the end-all and be-all to retaining somebody out.


DUCK.  Completely.

We’ll be speaking in regards to the LastPass breach in a minute, the place evidently the attackers didn’t truly must hassle with the 2FA aspect of issues.

They simply waited till the consumer that they had been shadowing had gone by means of that train themselves, after which “borrowed their cross”.

So, certainly, 2FA doesn’t imply, “Oh, now I don’t have to fret about outsiders getting in.”

It does make that preliminary entry a bit more durable, and should make the social engineering extra sophisticated and extra prone to stand out.

However as you say, it’s a further safety gate.


DOUG.  And the following one, on the identical notice, is: “When you’re in, you possibly can’t simply let individuals wander round.”

Safety belongs all over the place within the community, not simply on the edge.


DUCK.  Do I hear you saying the phrases Zero Belief, Douglas?


DOUG.  [LAUGHS] I used to be going to…


DUCK.  I do know that seems like a little bit of a gross sales schpiel, and (shock, shock) Sophos has a Zero Belief Community Entry product.

However we’ve got that product as a result of I feel it’s one thing that’s demanded by the way in which that fashionable networks function, so that you simply solely get the entry you really need for the duty in hand.

And, if you consider it, that doesn’t simply profit the corporate that’s dividing up its community.

It’s additionally good for customers, as a result of it means they will’t make unlucky blunders regardless that they assume they’re attempting to do the suitable factor.


DOUG.  And we additionally discuss: “Common cybersecurity measurement and testing”.

In the event you’re not in a position to do this in-house, contemplate hiring it out, since you want eyes on this across the clock.


DUCK.  Sure.

Two cliches, if I’ll, Doug?


DOUG.  You might. [LAUGHS]


DUCK.  Cybersecurity is a journey, not a vacation spot.

You regularly should revisit to ensure [A] that you simply did accurately what you meant, and [B] that what you deliberate to do yesterday remains to be a legitimate and helpful defence right this moment.

And the thought of getting any person that will help you evaluate what’s occurring, significantly whenever you assume one thing unhealthy has simply occurred, is it signifies that you don’t find yourself with safety incidents being main distractions to your common IT and Safety Operations workforce.

Distractions might truly be intentionally seeded by the crooks to behave as a distraction for the assault that they’ve acquired deliberate for later…


DOUG.  After which lastly, we spherical ited out with a few suggestions to your workers: “Arrange a cyber safety hotline to your workers to report incidents”, and belief them that will help you out by reporting such incidents.


DUCK.  Sure.

Lots of people have determined that individuals are the most important downside.

I feel that’s the fallacious approach to take a look at it.

Individuals are, actually, top-of-the-line methods that you could discover issues that you simply didn’t anticipate.

It’s at all times the issues that you simply didn’t anticipate that can catch you out, as a result of for those who had anticipated them, you’ll in all probability have prevented them within the first place!

Take the purpose of turning everybody in your organisation into eyes and ears to your personal safety workforce.


DOUG.  Excellent!

And we’ve acquired extra Uber protection.

Paul, you and Chester Wisniewski did a fantastic minisode, S3 Ep100.5.

Pure thunder, if I’ll.

It’s known as: Uber breach – An knowledgeable speaks.

You’ll be able to hear Paul and Chet speaking about this explicit breach in a little bit bit extra depth:


DUCK.  I feel a very powerful factor that got here out of that minisode of the podcast is what you alluded to earlier, “What if this had been an Preliminary Entry Dealer?”

In different phrases, in the event that they went in particularly to get the passwords and acquired out quietly.

This type of broad-but-shallow assault is definitely surprisingly widespread, and in lots of circumstances, as you instructed, the issue is that you simply don’t realise it’s occurred.

These crooks exit of their method to hold as quiet as attainable, and the thought is that they take all these entry passwords, entry tokens, info they’ve acquired…

…and promote it on the darkweb for different crooks who need to do very particular issues in particular elements of your community.


DOUG.  All proper, we are going to keep on the breach prepare, however we’re simply going to modify vehicles on the prepare.

We’re going to stroll throughout and watch out to not fall out onto the platform… however we’re going to get into the LastPass automotive.

They’ve acquired a publish mortem out.

They nonetheless don’t understand how the criminals acquired in, however a minimum of they admitted it.

And it looks like it wasn’t essentially for the lulz… thus comparable however totally different to the Uber breach.


DUCK.  Certainly, evidently this one, you may say, was deeper however narrower.

I feel the report is an efficient instance of easy methods to present info that’s truly helpful after an assault.

As you say, they appear to have come out with info that makes it clear what they assume occurred.

They admitted to the “recognized unknowns”.

For instance, they mentioned, “It appears as if the crooks implanted malware that was capable of masquerade as a developer who had already logged in with their password and 2FA code.”

They figured that out, however they don’t understand how that implant occurred within the first place, and so they had been respectable sufficient to say they didn’t know.

And I feel that’s fairly good, moderately than simply going, “Oh, nicely, we’ve positively mounted all the issues and this gained’t occur once more.”

If I had been a LastPass consumer, it will make me extra inclined to imagine the opposite issues that I’ve to depend on them to state…

…specifically that the event community the place their code was stolen is separate from their different networks, in order that the attackers weren’t capable of attain out and get issues like buyer knowledge or password hashes.

And I’m additionally inclined to just accept LastPass’s clarification (as a result of they’re capable of justify it) that even when the crooks *had* been capable of leap from the developer community to the cloud storage elements of the community, and even when that they had been capable of run off with password hashes, it will have been very tough for them to do something with it.

As a result of LastPass merely doesn’t know your grasp password.

And so they have a little bit diagram that explains why they imagine that to be the case.

So, I feel, if I had been a Final Go consumer, that I’d be inclined to imagine them.


DOUG.  I *am* a Final Go consumer, and I discovered this to be extra reassuring than not.

I wasn’t too apprehensive about this earlier than, and now I’m barely much less apprehensive, and definitely not apprehensive sufficient to dump it wholesale, change all my passwords, and that sort of stuff.

So I believed it was fairly good.


DUCK.  Certainly, one of many considerations that individuals got here out with once we first reported on this breach is, “Effectively, the crooks acquired into the supply code management system. In the event that they had been capable of obtain all this mental property, what in the event that they had been capable of add some sneaky and unauthorised modifications on the identical time?”

Possibly they ran off with the code so they may promote the mental property, so industrial espionage was their major car…

…however what if there was a provide chain assault as nicely?

And LastPass did try to reply that query by saying, “We’ve reviewed supply code modifications and so far as we will see, the attackers weren’t capable of, or didn’t, make any.”

Additionally, they clarify how even when the crooks had made modifications, there are checks and balances that forestall these modifications simply flowing mechanically into the software program that you simply may obtain, or that their very own cloud providers may use.

In different phrases, they’ve a bodily separation between the developer community and the manufacturing community, and a full-and-proper code evaluate and testing course of is required every time for one thing basically to leap throughout that hole.

I discovered that reassuring.

They’ve taken precautions that make it much less probably {that a} provide chain assault within the improvement community might attain prospects.

And so they seem to have gone out of their method to confirm that no such modifications had been made anyway.


DOUG.  Alright, there’s extra on that on nakedsecurity.sophos.com, together with a hyperlink to the LastPass briefing itself.

Allow us to now flip to one in every of our listeners!

Bare Safety Podcast listener Jonas writes in…

…and that is an oldie-but-a-goodie.

I wouldn’t have believed this myself – I’ve heard this story earlier than in several contexts, and I truly witnessed this as I used to be working as a pc technician again within the early 2000s.

This can be a actual downside, and it occurs.

Jonas writes:

“In within the early Nineteen Nineties, our pc classroom had plenty of Apple Macintosh Classics with the three.5-inch floppy drives.

In these days, whenever you wanted to put in issues, you probably did so with a bunch of disks – Insert disk 1; Insert disk 2; and so forth.

Effectively, one in every of my classmates took the set up directions too actually.

She began with the primary diskette, and after some time the set up course of instructed her to ‘Please insert disk 2’, and he or she did.”

Simply let that sit there for a little bit bit…


DUCK.  [LAUGHS A BIT TOO LOUDLY] We shouldn’t chortle, eh?

The directions might have been clearer!


DOUG.  Jonas continues:

“When retelling the story, she mentioned, ‘The second disk was a bit more durable to get in, however I managed to power it in. Nevertheless it nonetheless saved asking for the second disk.’

So she didn’t perceive why it nonetheless wanted disk 2 when she had already inserted disk 1 *and* disk 2… and it was fairly laborious to get the 2 disks out.

And even then, the floppy drive by no means labored once more on that Mac anyway.

It wanted to get replaced, however the entire class discovered you wanted to take away the earlier disk earlier than inserting the following one.”


DUCK.  Effectively, there you might have it!


DOUG.  I at all times keep in mind my days as a technician at CompUSA.

We had a counter.

Folks would lug their desktop computer systems in, put the desktop up on the counter, and inform us what was fallacious.

I noticed a buyer are available in and instantly noticed a diskette wedged within the 3.5-inch floppy drive, and I believed. “Oh my God. I’ve heard this story. I’ve examine it on the web and I’m lastly experiencing it in actual life.”

It didn’t get all the way in which in, however they managed to midway jam a second diskette into the floppy drive, and so they couldn’t get it out.

So we needed to open the case of the pc, disconnect and unscrew the floppy drive, pull the floppy drive out of the entrance of the pc, after which it took a few us to dislodge that diskette.

And, after all, the disk drive had to get replaced…

Thanks very a lot, Jonas, for sending that in.

In case you have an fascinating story, remark or query you’d wish to submit, we’d like to learn it on the podcast.

You’ll be able to e mail suggestions@sophos.com, you possibly can touch upon any one in every of our articles, or you possibly can hit us up on social: @NakedSecurity.

That’s our present for right this moment.

Thanks very a lot for listening.

For Paul Ducklin, I’m Doug Aamoth, reminding you till subsequent time to…


BOTH.  Keep safe!

[MUSICAL MODEM]

What's your reaction?

Leave A Reply

Your email address will not be published.