Hardcoded credentials can introduce security risks
Hardcoded credentials can introduce security risks
![Developer Driven Security](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/63e39c33144cde0cd7ebdc92_632ae54a444b3b9ba2b5541a_dan-gold-kARZuSYMfrA-unsplash.webp)
![Developer Driven Security](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/63e39c33144cde4266ebdc93_632ae54a444b3b9ba2b5541a_dan-gold-kARZuSYMfrA-unsplash.webp)
Secure Code Warrior is deeply committed to helping educate the security and developer community on how to write code securely as well as mitigate the risk of vulnerabilities introduced through insecure code. As part of this goal, we will be utilizing the developing story of Uber’s recent security incident as an opportunity to discuss the importance of developer driven security and shifting left.
Security Incident at Uber
Uber released a statement about the cyber security incident on September 16th and they continue to update it. Readers should keep in mind this is an ongoing story. Let’s recap what we’ve learned through Uber’s announcement so far and other reputable posts in the security community.
The hacker started by socially engineering an Uber employee, after having found their What’sApp number. The attacker contacted them and started phishing for credentials by having the unsuspecting employee login to a fake Uber site and then capturing their username and password.
Uber accounts are protected via Multi-factor Authentication (MFA), meaning that apart from submitting a password, the user must present a second piece of evidence that confirms their identity. In most cases, this is a prompt sent to a mobile device.
After obtaining the credentials, the attacker initiated an MFA fatigue attack by continuously trying to login to the genuine Uber site, and overwhelming the employee with numerous push notifications on their device. Again, the attacker contacted the victim via WhatsApp. This time they allegedly pretended to be IT support and successfully convinced them to accept.
Hardcoded credentials
At the basis of Uber’s security breach was a successful phishing attack. Once inside, the intruder found network shares containing PowerShell scripts. One of these scripts contained an admin user’s hardcoded credentials, which led to the compromise of Uber internal services, such as AWS, G-Suite, and code repositories. The hacker also got access to Uber’s HackerOne account. According to Uber, however, “any bug reports the attacker was able to access have been remediated."
Curious to see what this vulnerability would look like in code? Try out our PowerShell challenge for free.
How common are these types of attacks?
Social engineering as an attack vector is difficult to defend against, as the human factor has always been considered the weakest part of cyber security. The Uber hack has clearly illustrated that MFA implementations can easily be circumvented. The key to preventing this is creating more awareness amongst employees about the workings of phishing attacks.
What caused the exposure of Uber’s internal services, however, are the admin’s username and password that were found in a PowerShell script. Hardcoding credentials is never a good thing, as they become readable to any developer, and basically anyone with access to the code.
But again, awareness is key! Developers with a security-centered mindset are more likely to spot vulnerabilities, and less likely to write them.
A two-pronged approach of general education on social engineering, and more specifically, proactive secure coding training, will reduce the number of vulnerabilities in a code base, and therefore prove to be critical in the fight against security threats.
Want to learn more about staying up to date with secure coding best practices? Check out Secure Code Coach. Here you can learn secure coding guidelines and tryout training exercises for free.
Resources to get you started
Trust Agent by Secure Code Warrior
Discover SCW Trust Agent, an innovative solution designed to enhance security by aligning developer secure code knowledge and skills with the work they commit. It provides comprehensive visibility and controls across an organization's entire code repository, analyzing each commit against developers' secure code profiles. With SCW Trust Agent, organizations can strengthen their security posture, optimize development lifecycles, and scale developer-driven security.
Resources to get you started
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
SCW Trust Agent - Visibility and Control to Scale Developer Driven Security
SCW Trust Agent, introduced by Secure Code Warrior, offers security leaders the visibility and control needed to scale developer-driven security within organizations. By connecting to code repositories, it assesses code commit metadata, inspects developers, programming languages used, and shipment timestamps to determine developers' security knowledge.
Hardcoded credentials can introduce security risks
![](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/63e39c33144cde0cd7ebdc92_632ae54a444b3b9ba2b5541a_dan-gold-kARZuSYMfrA-unsplash.webp)
Secure Code Warrior is deeply committed to helping educate the security and developer community on how to write code securely as well as mitigate the risk of vulnerabilities introduced through insecure code. As part of this goal, we will be utilizing the developing story of Uber’s recent security incident as an opportunity to discuss the importance of developer driven security and shifting left.
Security Incident at Uber
Uber released a statement about the cyber security incident on September 16th and they continue to update it. Readers should keep in mind this is an ongoing story. Let’s recap what we’ve learned through Uber’s announcement so far and other reputable posts in the security community.
The hacker started by socially engineering an Uber employee, after having found their What’sApp number. The attacker contacted them and started phishing for credentials by having the unsuspecting employee login to a fake Uber site and then capturing their username and password.
Uber accounts are protected via Multi-factor Authentication (MFA), meaning that apart from submitting a password, the user must present a second piece of evidence that confirms their identity. In most cases, this is a prompt sent to a mobile device.
After obtaining the credentials, the attacker initiated an MFA fatigue attack by continuously trying to login to the genuine Uber site, and overwhelming the employee with numerous push notifications on their device. Again, the attacker contacted the victim via WhatsApp. This time they allegedly pretended to be IT support and successfully convinced them to accept.
Hardcoded credentials
At the basis of Uber’s security breach was a successful phishing attack. Once inside, the intruder found network shares containing PowerShell scripts. One of these scripts contained an admin user’s hardcoded credentials, which led to the compromise of Uber internal services, such as AWS, G-Suite, and code repositories. The hacker also got access to Uber’s HackerOne account. According to Uber, however, “any bug reports the attacker was able to access have been remediated."
Curious to see what this vulnerability would look like in code? Try out our PowerShell challenge for free.
How common are these types of attacks?
Social engineering as an attack vector is difficult to defend against, as the human factor has always been considered the weakest part of cyber security. The Uber hack has clearly illustrated that MFA implementations can easily be circumvented. The key to preventing this is creating more awareness amongst employees about the workings of phishing attacks.
What caused the exposure of Uber’s internal services, however, are the admin’s username and password that were found in a PowerShell script. Hardcoding credentials is never a good thing, as they become readable to any developer, and basically anyone with access to the code.
But again, awareness is key! Developers with a security-centered mindset are more likely to spot vulnerabilities, and less likely to write them.
A two-pronged approach of general education on social engineering, and more specifically, proactive secure coding training, will reduce the number of vulnerabilities in a code base, and therefore prove to be critical in the fight against security threats.
Want to learn more about staying up to date with secure coding best practices? Check out Secure Code Coach. Here you can learn secure coding guidelines and tryout training exercises for free.
Resources to get you started
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
SCW Trust Agent - Visibility and Control to Scale Developer Driven Security
SCW Trust Agent, introduced by Secure Code Warrior, offers security leaders the visibility and control needed to scale developer-driven security within organizations. By connecting to code repositories, it assesses code commit metadata, inspects developers, programming languages used, and shipment timestamps to determine developers' security knowledge.
Trust Agent by Secure Code Warrior
Discover SCW Trust Agent, an innovative solution designed to enhance security by aligning developer secure code knowledge and skills with the work they commit. It provides comprehensive visibility and controls across an organization's entire code repository, analyzing each commit against developers' secure code profiles. With SCW Trust Agent, organizations can strengthen their security posture, optimize development lifecycles, and scale developer-driven security.