Firefox supports blockers, NATS is great, Uber's MFA fatigue, OAuth2 drawn in cute shapes & an aging programmer

MFA Fatigue

The recent Uber security breach highlights the use of MFA fatigue as a potent attack vector. Jerod Santo explains that the attacker spammed the target with repeated multi-factor authentication requests until access was granted 1. This technique, combined with a previously purchased password from the dark web, allowed the attacker to bypass Uber's last line of defense.

The attacker disguised themselves as Uber IT and spammed the target with repeated multi-factor auth requests until they eventually authorized access.

--- Jerod Santo

Once inside, the attacker exploited vulnerabilities in Uber's intranet to further their access 1.

   

Intranet Flaws

Uber's intranet vulnerabilities played a crucial role in the security breach. After gaining access through MFA fatigue, the attacker scanned the network and discovered a PowerShell script containing admin credentials 1. This oversight allowed the attacker to escalate their privileges and navigate Uber's internal systems with ease.

Once they had access to Uber's intranet, they scanned the network until they found a PowerShell script with admin credentials, and at that point it was pretty much over easy peasy lemon squeezy.

--- Jerod Santo

This incident underscores the importance of securing internal networks and regularly auditing for potential vulnerabilities.