ESET Latinoamérica analizó el ataque con el que accedieron a una parte importante de los sistemas de Uber y la compañía debió interrumpir parte de su infraestructura mientras investiga lo que ocurrió. Una persona de 18 años asegura ser la responsable.
ESET, compañía líder en detección proactiva de amenazas, alerta que Uber confirmó que sufrió un incidente de seguridad y está investigando lo sucedido. Al parecer, la compañía fue víctima del acceso indebido a varios de sus sistemas y el atacante envió a investigadores y a medios como el New York Times (NYT), que dio a conocer la noticia, capturas de pantalla de correos, servicios de almacenamiento en la nube y repositorios de código para demostrar que había logrado acceder a los sistemas.
Según afirmó el atacante al medio, para acceder a los sistemas de Uber primero engañaron a través de ingeniería social a un empleado, lograron acceso a su VPN y luego escanearon la Intranet.
El investigador Sam Curry habría intercambiado mensajes con qui
en asegura ser el responsable del ataque. Éste le envió capturas para demostrar que habría logrado acceso completo a una parte importante y crítica de la infraestructura tecnológica de Uber, como son: acceso a cuentas de administrador, a los servidores de Amazon Web Service, el panel de HackerOne con el reporte de las vulnerabilidades, el canal de Slack, acceso a cuentas de administrador de vSphere y de Google Suite. Según Curry, parece que se trata de un compromiso total de sus sistemas.
Por otra parte, se solicitó a quienes trabajan en Uber no utilizar la plataforma de comunicación Slack, que luego fue puesta fuera de servicio.
Al parecer, había una red compartida que contenía scripts de powershell y uno de estos scripts contenía las credenciales de acceso para un usuario con permisos de administrador de una solución llamada PAM de thycotic que es utilizada para la gestión de accesos privilegiados. Y desde aquí habrían ingresado al resto de los servicios.
El día viernes Uber publicó información actualizada con respecto al incidente y puntualizó lo siguiente:
- Hasta el momento no hay evidencia de que los actores maliciosos hayan accedido a información sensible de usuarios y usuarias, como el historial de viajes.
- Todos los servicios a través de las apps, como Uber o Uber Eats, están operativos.
- La compañía reportó el incidente a las autoridades.
- Volvieron a estar operativas en la mañana del viernes herramientas de uso interno que fueron interrumpidas el día jueves por precaución.
Según informó el periodista de NYT, Kevin Roose, una persona que asegura ser la responsable del ataque a Uber se comunicó con el medio y dijo que tiene 18 años y que realizó el ataque porque la seguridad era débil. Vice reveló que el atacante dijo que primero robó credenciales de un colaborador de Uber. Luego, le envió al empleado en el transcurso de una hora varias notificaciones push para que acepte o rechace un intento de inicio de sesión. Y si bien el empleado de Uber no validó estos inicios de sesión, el atacante contactó al colaborador por WhatsApp diciendo que era un trabajador del área de TI de Uber y que para detener las notificaciones push debía aceptar.
Este no es el primer caso en el que atacantes logran acceder a la red de una compañía tras engañar a un empleado con ingeniería social. Desde ESET ya analizaron los casos de Twitter, en el ataque de ransomware a EA Sports y recientemente en el ataque al sidechain Ronin.
Hi there
Do you want to get backlinks from domains that have tons of ranking keywords?
https://www.monkeydigital.co/semrush-backlinks/
Cool website!
My name’s Eric, and I just found your site – atreveteyexplora.com – while surfing the net. You showed up at the top of the search results, so I checked you out. Looks like what you’re doing is pretty cool.
But if you don’t mind me asking – after someone like me stumbles across atreveteyexplora.com, what usually happens?
Is your site generating leads for your business?
I’m guessing some, but I also bet you’d like more… studies show that 7 out 10 who land on a site wind up leaving without a trace.
Not good.
Here’s a thought – what if there was an easy way for every visitor to “raise their hand” to get a phone call from you INSTANTLY… the second they hit your site and said, “call me now.”
You can –
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. It lets you know IMMEDIATELY – so that you can talk to that lead while they’re literally looking over your site.
CLICK HERE https://boostleadgeneration.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works.
Time is money when it comes to connecting with leads – the difference between contacting someone within 5 minutes versus 30 minutes later can be huge – like 100 times better!
That’s why we built out our new SMS Text With Lead feature… because once you’ve captured the visitor’s phone number, you can automatically start a text message (SMS) conversation.
Think about the possibilities – even if you don’t close a deal then and there, you can follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship.
Wouldn’t that be cool?
CLICK HERE https://boostleadgeneration.com to discover what Talk With Web Visitor can do for your business.
You could be converting up to 100X more leads today!
Eric
PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
You have customers waiting to talk with you right now… don’t keep them waiting.
CLICK HERE https://boostleadgeneration.com to try Talk With Web Visitor now.
If you’d like to unsubscribe click here http://boostleadgeneration.com/unsubscribe.aspx?d=atreveteyexplora.com
If you need a quick boost in the SERPs for atreveteyexplora.com, then this is the right strategy for you:
https://www.seo-treff.de/product/serp-booster/
Hello! How can I get to your office?
Your Site Has Been Hacked
PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE IMPORTANT DECISIONS!
We have hacked your website https://www.atreveteyexplora.com and extracted your databases.
How did this happen?
Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.
What does this mean?
We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your https://www.atreveteyexplora.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links that you have indexed in the search engines will be de-indexed based off of blackhat techniques that we used in the past to de-index our targets.
How do I stop this?
We are willing to refrain from destroying your site’s reputation for a small fee. The current fee is $3000 in bitcoins (0.14 BTC).
The amount(approximately): $3000 (0.14 BTC)
The Address Part 1: bc1qe4xvhksgapl3p76mm
The Address Part 2: fz7thdnmkeuxry08kjhcn
So, you have to manually copy + paste Part1 and Part2 in one string made of 42 characters with no space between the parts that start with «b» and end with «n» is the actually address where you should send the money to.
Once you have paid we will automatically get informed that it was your payment. Please note that you have to make payment within 72 hours after receiving this message or the database leak, e-mails dispatched, and de-index of your site WILL start!
How do I get Bitcoins?
You can easily buy bitcoins via several websites or even offline from a Bitcoin-ATM.
What if I don’t pay?
If you decide not to pay, we will start the attack at the indicated date and uphold it until you do, there’s no counter measure to this, you will only end up wasting more money trying to find a solution. We will completely destroy your reputation amongst google and your customers.
This is not a hoax, do not reply to this email, don’t try to reason or negotiate, we will not read any replies. Once you have paid we will stop what we were doing and you will never hear from us again!
Please note that Bitcoin is anonymous and no one will find out that you have complied.
We are a group of highly qualified ethical hackers who scan tens of thousands of sites every day for critical vulnerabilities and patch them for a small fee.
On your site atreveteyexplora.com – we have discovered 5 critical vulnerabilities, each of which can give attackers full access to your site, databases and the server as a whole.
Pay $3000 (0.15 BTC) by visiting this site where you will be able to copy our bitcoin (btc) address or scan the QR code with your device https://www.blockchain.com/explorer/addresses/btc/3FGsSijrVN3z828n7EuYiEbxUcSvuoExgY
And after payment within 12 hours we will fix all the vulnerabilities on your site and you can sleep peacefully without worrying about the safety of your site and server.
If we are hired by well-known corporations, then we charge from $50000 for our services, so you are lucky that we offer you the same service for $3000 (0.15 BTC)
Great new website! Submit it to our directory for a chance to get more clients. https://rb.gy/drluwb
Submit your new website to our directory and watch your client base grow. https://bit.ly/3mGUAhS
Are you struggling to get your website noticed by search engines? Our PPV traffic service can help kickstart your site’s popularity and boost your search engine rankings. Get started today and get more traffic for less! visit: http://www.tmast.xyz
Sick of paying exorbitant amounts for PPC advertising that doesn’t convert? Our PPV traffic service delivers real visitors to your site for a fraction of the cost of Google and Bing. Order now and get more traffic for less! http://getmorecustomers.tmast.xyz/
Submit your site https://www.atreveteyexplora.com/nacionales/uber-sufrio-ciberataque-y-lograron-acceso-a-sus-sistemas/ to our free business directory here: https://bit.ly/3oBT41j
Bid farewell to gambling your advertising funds, we promise tangible results! Take a look at our site here: https://bit.ly/45C9SWD
We provide Google reviews, trustpilot reviews, country targeted website visitors, social media services,
Website Traffic, SEO Services, Backlinks, Classified ADS, Social Followers etc.
If you are interested then please visit our website.
https://www.websboost.com/
Thanks
Webs Boost