Uber Breach

Uber Breach

Product Serial: F-2022-09-16a

TLP:CLEAR

In this flash report, ZeroFox Intelligence shares details on the Uber breach that have been made public by the alleged attacker.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 11:00 AM (EDT) on September 16, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Uber notified the public of an ongoing cybersecurity incident late on September 15, 2022, via Twitter. While Uber itself has not provided much detail, the alleged attacker appeared to share details and screenshots with those who reached out through Telegram. For the duration of their access, the attacker posted messages to internal messaging systems and online services announcing the breach. Later, several images began circulating online as proof of their access.

Key Findings

• Initial access to a breach disclosed by Uber on September 15, 2022, was gained through social engineering.
• Administrative credentials stored in a network-accessible script allowed the additional discovery of even more sensitive credentials.
• While the depth and breadth of the breach is yet to be determined, screenshots posted on social media indicate that the attacker may have had access to over 1 Petabyte of data.