1 of 20

WELCOME TO CIS 55�LECTURE 4

Dive into:

Uber Hack (2022)

Recon Tools - OSINT, Maltego, Shodan, Censys

2 of 20

GREAT UBER HACK OF 2022

On Thursday, September 15th, 2022, Uber was hacked through a successful social engineering attempt followed by a privilege escalation attack on an internal network.
What Is Social Engineering?
Social engineering is the use of psychological manipulation to trick a user into giving away sensitive information. In this case, the hacker was able to convince an employee — through phishing or another type of social engineering attack and Multifactor Authentication Fatigue— to gain access to a single employee’s credentials. This gave the hacker access to Uber’s internal company network (by logging into the VPN using the employee’s credentials).
�

3 of 20

UBER 2022

What Is a Privilege Escalation Attack?
A Privilege Escalation is a process where a hacker with limited access to a system (or network) increases their permissions and access to the system. Since the hacker was on Uber’s internal network (via VPN), it was able to snoop around files shared by other employees. One file was a PowerShell script — typically used to automate Windows Servers (Computers) — containing administrative credentials for the Thycotic service.
Thycotic is a privileged access management (PAM) system used to manage secrets (such as passwords). Unfortunately for Uber, the admin user the hacker gained access to was able to extract secrets (passwords) for ALL OF UBER’s SERVICES. In other words, the hacker logged in to Uber’s systems using this admin account and stole the passwords for their services. This includes an array of services including “DA, DUO, Onelogin, AWS [Amazon Web Services], and GSuite [Google Suite]”.

4 of 20

UBER 2022

OneLogin is an Identity and Access Management System (IAM) used to provide Single-Sign On functionality for Uber employees.
As an example, SSO is used to allow an employee to use one set of credentials (username and password) to gain access to every application they use.
Amazon Web Services (AWS) contains an IAM service that controls who has access to each (Uber) service. In other words, the hacker was able to do whatever it wanted with Uber’s systems.

5 of 20

UBER 2022

The hacker was also able to compromise other information including but not limited to Uber’s Google Workspaces, Internal Financial Revenue Metrics Service (Avengers), Amazon Web Service Instances.

In other words, the data that Uber stores about you from its application is located on Amazon Database Services. With access to this service, it’s likely that your data (including the credit card information) has already been compromised.

This breach has caused to the company worth $65.5 BILLION (as of September 15th, 2022)

6 of 20

REMINDER: CVE

Weakness in computational logic
When exploited, results in negative impact to CIA
NIST maintains National Vulnerability Database: nvd.nist.gov
Uses CVSS: Common Vulnerability Scoring System

7 of 20

COURSE LOGISTICS

Lab 4 is due on Mar 1 (Friday)

Quiz 3 is today from 1pm till Sunday midnight

8 of 20

ELEMENTS OF PENETRATION TESTING

Planning and Scoping

Information gathering and vulnerability identification

Attacks and Exploits

Penetration Testing Tools

Reporting and Communication

9 of 20

RECONNAISSANCE

The goal is to find the most efficient way to attack the target to accomplish the goals of the assessment
Information gathering without engaging the target
One of the tools for the job:

Maltego CE
Community version of Maltego ships with Kali Linux

10 of 20

OSINT Recon - tools

Google Hacking: https://www.exploit-db.com/google-hacking-database

Data Recon:

How to use breach data - https://www.youtube.com/watch?v=UeI7wEdLPn8
Corporate Information - https://opencorporates.com/
Federal agencies: Paper’s example : https://fas.org/irp/doddir/army/atp2-22-9.pdf

Social Recon:

OSINT - https://osintframework.com/
OSINT CTF - https://resources.infosecinstitute.com/topic/trend-micro-osint-challenge/#gref
OSINT Curious - https://www.youtube.com/watch?v=zo_geMvcOg8
Photo Exif Data - https://exif.tools/

Communities to join:

OSINT Communities - https://www.reddit.com/r/OSINT/

11 of 20

Advanced Google Operators

12 of 20

MALTEGO

13 of 20

MALTEGO

Maltego is a comprehensive tool for graphical link analyses that offers real-time data mining and information gathering, as well as the representation of this information on a node-based graph, making patterns and multiple order connections between said information easily identifiable.
Maltego is software used for open-source intelligence and forensics
entity–relationship model.

14 of 20

SHODAN

Shodan scan the Internet, parsing banners for services and categorizing the data returned by each device, somewhat similar to other search engines
For example, one may enter:
telnet port:23 country:”US”
allows anyone to perform advanced recon on a target URL. This type of activity can potentially allow a malicious actor to gain a foothold and further compromise your website or network