Uber’s breach: MFA spam and a password in a script
A teenager got deep into Uber with stolen credentials, repeated MFA prompts and an admin password in a PowerShell file.
Last week Uber was breached, and the attacker posted about it in Uber’s own Slack. The chain, as reported:
- A contractor’s password, probably bought from a criminal market.
- Repeated MFA push prompts, plus a message on WhatsApp claiming to be Uber IT and asking to approve. Eventually it was approved.
- Inside the network, a file share with a PowerShell script containing admin credentials for the company’s password vault system.
From there, the keys to much of Uber.
Each step has a known fix:
- Number matching or security keys instead of simple “Approve” prompts.
- A clear rule: IT never asks you to approve a login by chat or phone.
- Search your shares and repos for passwords in scripts. There are tools that do this.
- Protect the vault with the strongest MFA and the fewest admins you have.
The attacker wasn’t sophisticated. The gaps were common. That should worry everyone a bit more than a fancy exploit would.