Hardcoded credentials can introduce security risks

Published Sep 21, 2022
by Laura Verheyde
cASE sTUDY

Hardcoded credentials can introduce security risks

Published Sep 21, 2022
by Laura Verheyde
View Resource
View Resource
Developer Driven Security
Developer Driven Security

Secure Code Warrior is deeply committed to helping educate the security and developer community on how to write code securely as well as mitigate the risk of vulnerabilities introduced through insecure code. As part of this goal, we will be utilizing the developing story of Uber’s recent security incident as an opportunity to discuss the importance of developer driven security and shifting left.

Security Incident at Uber

Uber released a statement about the cyber security incident on September 16th and they continue to update it. Readers should keep in mind this is an ongoing story. Let’s recap what we’ve learned through Uber’s announcement so far and other reputable posts in the security community. 

The hacker started by socially engineering an Uber employee, after having found their What’sApp number. The attacker contacted them and started phishing for credentials by having the unsuspecting employee login to a fake Uber site and then capturing their username and password. 

Uber accounts are protected via Multi-factor Authentication (MFA), meaning that apart from submitting a password, the user must present a second piece of evidence that confirms their identity. In most cases, this is a prompt sent to a mobile device. 

After obtaining the credentials, the attacker initiated an MFA fatigue attack by continuously trying to login to the genuine Uber site, and overwhelming the employee with numerous push notifications on their device. Again, the attacker contacted the victim via WhatsApp. This time they allegedly pretended to be IT support and successfully convinced them to accept.

Hardcoded credentials

At the basis of Uber’s security breach was a successful phishing attack. Once inside, the intruder found network shares containing PowerShell scripts. One of these scripts contained an admin user’s hardcoded credentials, which led to the compromise of Uber internal services, such as AWS, G-Suite, and code repositories. The hacker also got access to Uber’s HackerOne account. According to Uber, however, “any bug reports the attacker was able to access have been remediated."

Curious to see what this vulnerability would look like in code? Try out our PowerShell challenge for free.

How common are these types of attacks?

Social engineering as an attack vector is difficult to defend against, as the human factor has always been considered the weakest part of cyber security. The Uber hack has clearly illustrated that MFA implementations can easily be circumvented. The key to preventing this is creating more awareness amongst employees about the workings of phishing attacks. 

What caused the exposure of Uber’s internal services, however, are the admin’s username and password that were found in a PowerShell script. Hardcoding credentials is never a good thing, as they become readable to any developer, and basically anyone with access to the code. 

But again, awareness is key! Developers with a security-centered mindset are more likely to spot vulnerabilities, and less likely to write them.

A two-pronged approach of general education on social engineering, and more specifically, proactive secure coding training, will reduce the number of vulnerabilities in a code base, and therefore prove to be critical in the fight against security threats.

Want to learn more about staying up to date with secure coding best practices? Check out Secure Code Coach. Here you can learn secure coding guidelines and tryout training exercises for free.  
View Resource
View Resource

Author

Laura Verheyde

Laura Verheyde is a software developer at Secure Code Warrior focused on researching vulnerabilities and creating content for Missions and Coding labs.

Want more?

Dive into onto our latest secure coding insights on the blog.

Our extensive resource library aims to empower the human approach to secure coding upskilling.

View Blog
Want more?

Get the latest research on developer-driven security

Our extensive resource library is full of helpful resources from whitepapers to webinars to get you started with developer-driven secure coding. Explore it now.

Resource Hub

Hardcoded credentials can introduce security risks

Published Jan 22, 2024
By Laura Verheyde

Secure Code Warrior is deeply committed to helping educate the security and developer community on how to write code securely as well as mitigate the risk of vulnerabilities introduced through insecure code. As part of this goal, we will be utilizing the developing story of Uber’s recent security incident as an opportunity to discuss the importance of developer driven security and shifting left.

Security Incident at Uber

Uber released a statement about the cyber security incident on September 16th and they continue to update it. Readers should keep in mind this is an ongoing story. Let’s recap what we’ve learned through Uber’s announcement so far and other reputable posts in the security community. 

The hacker started by socially engineering an Uber employee, after having found their What’sApp number. The attacker contacted them and started phishing for credentials by having the unsuspecting employee login to a fake Uber site and then capturing their username and password. 

Uber accounts are protected via Multi-factor Authentication (MFA), meaning that apart from submitting a password, the user must present a second piece of evidence that confirms their identity. In most cases, this is a prompt sent to a mobile device. 

After obtaining the credentials, the attacker initiated an MFA fatigue attack by continuously trying to login to the genuine Uber site, and overwhelming the employee with numerous push notifications on their device. Again, the attacker contacted the victim via WhatsApp. This time they allegedly pretended to be IT support and successfully convinced them to accept.

Hardcoded credentials

At the basis of Uber’s security breach was a successful phishing attack. Once inside, the intruder found network shares containing PowerShell scripts. One of these scripts contained an admin user’s hardcoded credentials, which led to the compromise of Uber internal services, such as AWS, G-Suite, and code repositories. The hacker also got access to Uber’s HackerOne account. According to Uber, however, “any bug reports the attacker was able to access have been remediated."

Curious to see what this vulnerability would look like in code? Try out our PowerShell challenge for free.

How common are these types of attacks?

Social engineering as an attack vector is difficult to defend against, as the human factor has always been considered the weakest part of cyber security. The Uber hack has clearly illustrated that MFA implementations can easily be circumvented. The key to preventing this is creating more awareness amongst employees about the workings of phishing attacks. 

What caused the exposure of Uber’s internal services, however, are the admin’s username and password that were found in a PowerShell script. Hardcoding credentials is never a good thing, as they become readable to any developer, and basically anyone with access to the code. 

But again, awareness is key! Developers with a security-centered mindset are more likely to spot vulnerabilities, and less likely to write them.

A two-pronged approach of general education on social engineering, and more specifically, proactive secure coding training, will reduce the number of vulnerabilities in a code base, and therefore prove to be critical in the fight against security threats.

Want to learn more about staying up to date with secure coding best practices? Check out Secure Code Coach. Here you can learn secure coding guidelines and tryout training exercises for free.  

We would like your permission to send you information on our products and/or related secure coding topics. We’ll always treat your personal details with the utmost care and will never sell them to other companies for marketing purposes.

To submit the form, please enable 'Analytics' cookies. Feel free to disable them again once you're done.