Black Hat Ethical Hacking
Uber hacked, internal systems breached and vulnerability reports stolen

Uber hacked, internal systems breached and vulnerability reports stolenPost Views: 216 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Uber suffered a cyberattack Thursday afternoon with a hacker gaining access to vulnerability reports and sharing screenshots of the company’s internal systems, email dashboard, and Slack server.The screenshots shared by the hacker and seen by BleepingComputer show what appears to be full access to many critical Uber IT systems, including the company’s security software and Windows domain.

Other systems the hacker accessed include the company’s Amazon Web Services console, VMware ESXi virtual machines, Google Workspace email admin dashboard, and Slack server, to which the hacker posted messages.

Uber has since confirmed the attack, tweeting that they are in touch with law enforcement and will post additional information as it becomes available.

“We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available,” tweeted the Uber Communications account.

The New York Times, which first reported on the breach, said they spoke to the threat actor, who said they breached Uber after performing a social engineering attack on an employee and stealing their password.

The threat actor then gained access to the company’s internal systems using the stolen credentials.

Social engineering has become a very popular tactic in recent attacks against well-known companies, including Twitter, MailChimp, Robinhood, and Okta.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course HackerOne vulnerability reports exposedWhile it’s possible that the threat actor stole data and source code from Uber during this attack, they also had access to what could be an even more valuable asset.

According to Yuga Labs security engineer Sam Curry, the hacker also had access to the company’s HackerOne bug bounty program, where they commented on all of the company’s bug bounty tickets.
https://www.bleepstatic.com/images/news/security/attacks/u/uber/comment-bug-bounty-ticket.jpg
___________________________
@hacking_Attack
@Hacking_Video

he commandline
> zonetransfer – Scan multiple domains by fetching records via DNS zone transfer

positional arguments:
{aws,azure,bind,cloudflare,digitalocean,file,single,zonetransfer}

options:
-h, –help                      Show this help message and exit
–out OUT                    Output file (default: results) – use ‘stdout’ to stream out
–out-format {csv,json}
–resolver RESOLVER Provide a custom DNS resolver (or multiple seperated by commas)
–parallelism PARALLELISM
Number of domains to test in parallel – too high and you may see odd DNS results (default: 30)
–disable-probable    Do not check for probable conditions
–enable-unlikely       Check for more conditions, but with a high false positive rate
–signature SIGNATURE
Only scan with this signature (multiple accepted)
–exclude-signature EXCLUDE_SIGNATURE
Do not scan with this signature (multiple accepted)
–pipeline                     Exit Non-Zero on detection (used to fail a pipeline)
-v, –verbose                -v for verbose, -vv for extra verbose
–nocolour                   Turns off coloured text

aws:
Scan multiple domains by fetching them from AWS Route53

–aws-access-key-id AWS_ACCESS_KEY_ID
Optional
–aws-access-key-secret AWS_ACCESS_KEY_SECRET
Optional

azure:
Scan multiple domains by fetching them from Azure DNS services

–az-subscription-id AZ_SUBSCRIPTION_ID
Required
–az-tenant-id AZ_TENANT_ID
Required
–az-client-id AZ_CLIENT_ID
Required
–az-client-secret AZ_CLIENT_SECRET
Required

bind:
Read domains from a dns BIND zone file, or path to multiple

–bind-zone-file BIND_ZONE_FILE
Required

cloudflare:
Scan multiple domains by fetching them from Cloudflare

–cloudflare-token CLOUDFLARE_TOKEN
Required

digitalocean:
Scan multiple domains by fetching them from Digital Ocean

–do-api-key DO_API_KEY
Required
–do-domains DO_DOMAINS
Optional

file:
Read domains from a file (or folder of files), one per line

–filename FILENAME Required

single:
Scan a single domain by providing a domain on the commandline

–domain DOMAIN    Required

zonetransfer:
Scan multiple domains by fetching records via DNS zone transfer

–zonetransfer-nameserver ZONETRANSFER_NAMESERVER
Required
–zonetransfer-domain ZONETRANSFER_DOMAIN
Required
Clone the repo from here: GitHub Link
Trending: Write up: Find hidden and encrypted secrets from any website https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/fuxploider-300x150.png Offensive Security Tool: fuxploiderSeptember 9, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/ZenBuster-300x150.png Recon Tool: ZenBusterSeptember 2, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/CrossLinked-300x150.png Recon Tool: CrossLinkedAugust 26, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/WEF-WiFi-Exploitation-Framework-300x150.png Offensive Security Tool: WEF (WiFi Exploitation Framework)August 25, 2022
Reading Time: 2 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Offensive Security Tool: dnsReaper first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

eepingComputer has reached out to Uber with further questions about the attack but has not heard back at this time.
Trending: GIFShell attack creates reverse shell using Microsoft Teams GIFs
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-1-2-300x150.png Microsoft Teams stores auth tokens as cleartext in Windows, Linux, MacsSeptember 15, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-1-1-300x150.png Zero-day in WPGateway WordPress plugin actively exploited in thousands WordPress sitesSeptember 14, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/intro-1656368006-300x150.jpg A new Browser-in-the-Browser attack led hackers steal Steam accountsSeptember 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-1-300x150.png Blind SSRF vulnerability in WordPress Core feature could enable DDoS attacksSeptember 12, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Uber hacked, internal systems breached and vulnerability reports stolen first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Recording on site
https://www.reddit.com/r/redteamsec/comments/xfo1ek/recording_on_site/

As a pentester, I sometimes have to go on site to look for physical / social vulnerabilities. I'm currently using a gopro and just started experimenting with a voice recorder (Philips DVT2810). However, the go pro isn't very stealthy. The voice recorder is invisible in my pocket, but wasn't picking up conversations the way I hoped and is lacking video evidence of course. What do you use to record when it needs to be stealthy? submitted by /u/Amtrox (https://www.reddit.com/user/Amtrox)
[link] (https://www.reddit.com/r/redteamsec/comments/xfo1ek/recording_on_site/) [comments] (https://www.reddit.com/r/redteamsec/comments/xfo1ek/recording_on_site/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
U.S. Seizes Cryptocurrency Worth $30 Million Stolen by North Korean Hackers.

https://cdn-images-1.medium.com/max/800/0*jnoQi8DED0nbikda.jpg
Online money transfer, digital money, non-fungible tokens, you may have heard about them many times.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Your First Bug (Burp Suite)

Cc: InsidePHD

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to extract ipa from Jailbroken iOS device

https://cdn-images-1.medium.com/max/960/1*QHf0WBJVqoST447tnXGO4Q.png
Okay, This is another how-to blog.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Freebies (WiFi) can be unsafe!

https://cdn-images-1.medium.com/max/1024/1*K-B1k_AUhfa85UjMINY8cQ.jpeg
The use of free public WiFi and hotspots implies security hazards. Public Wi-Fi is an extremely intriguing target for hackers and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Uber Was Hacked. Here’s What Happened.

https://cdn-images-1.medium.com/max/2600/1*YpjsMc3e-RJZNmJfDC-kJw.jpeg
On Thursday September 15th, 2022, Uber was hacked through a successful social engineering attempt followed by a privilege escalation…

Continue reading on ILLUMINATION »

___________________________
@hacking_Attack
@Hacking_Video

Your First Bug (Burp Suite)

Cc: InsidePHDContinue reading on System Weakness »
Read more...

hacking: security in practice
Uber hacked, internal systems breached and vulnerability reports stolen

https://external-preview.redd.it/_EgmfoPDJIXI_xeXLpDGvzjcqM766YuDf2KfRKLc8rc.jpg?width=640&crop=smart&auto=webp&s=ce69c5cd036f99d72996acb068c93c258d3b0264 submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Have Coop been breached?

Does anyone know the if scandinavian supermarket chain, Coop have been breached?

This morning they sent out a request to chance user password, as some customers have experienced un-authorized acces to their accounts,so I guess its fair to assume?

submitted by /u/Flozkel
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Best hacking stories

Tell your best story about hacking I'm really curious, it can be your favorite story about a group of cybercriminals or even an ethical hacker who successfully stopped cybercriminals I'll take anything. Personal anecdotes too of course.

submitted by /u/M1noruT
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
cc anonymous

how i can get the anonymous course of cc? does anyone have the pdf?

submitted by /u/corona_rex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

XLL_Phishing - XLL Phishing Tradecraft
http://www.kitploit.com/2022/09/xllphishing-xll-phishing-tradecraft.html

___________________________
@hacking_Attack
@Hacking_Video