How one contractor's stolen password reached Uber

About this series

The incident that bypassed the front door

In September 2022, an attacker gained access to Uber's internal systems. The breach did not start with a complex hack of a firewall. Instead, it started with a single stolen password belonging to an external contractor. The attacker likely bought these credentials on the dark web, where they had been harvested by 'info-stealer' malware on the contractor's personal device.

Once the attacker had the password, they faced a second hurdle: Multi-factor authentication (MFA) (show definition). Uber used push notifications, where a user simply taps 'Approve' on their phone to log in. The attacker spent hours triggering these prompts, sending them to the contractor's phone over and over again. This is a tactic known as 'push fatigue.'

The Slack impersonation

To finish the job, the attacker contacted the contractor on Slack, pretending to be from Uber's IT department. They told the contractor that the repeated prompts were part of a system fix and that they needed to approve one to stop the alerts. The contractor, tired of the notifications and believing the IT story, finally tapped 'Approve.'

This highlights the human element of security. Even the best technology can be bypassed if an employee is pressured or tricked. Verification of identity before approving any security prompt is a vital practice for every team.

Hard-coded secrets: The key to the kingdom

Once inside the internal network, the attacker found a massive weakness. They discovered a network share that contained PowerShell scripts. These scripts were designed to help manage the network, but they contained 'hard-coded' administrator credentials. This meant the usernames and passwords for the entire system were written in plain text inside the code.

Using these credentials, the attacker reached Uber's cloud systems, messaging tools, and financial software. This is a common failure in many businesses: once an attacker gets past the first layer of security, the internal systems are often unprotected.

How to prevent push fatigue and secret leaks

1. Switch from simple push-approval MFA to number matching. This requires the user to type a code shown on the screen, which prevents accidental approvals.
2. Use a password manager for all employees and contractors to prevent them from saving corporate passwords in insecure browsers.
3. Train your team to never approve an MFA prompt they did not personally trigger, even if someone claiming to be IT asks them to.
4. Scan your internal network and shared drives for scripts or documents that contain plain-text passwords.

Checklist for identity and access

• Number matching is enabled for all MFA accounts
• Contractors are required to use managed devices or security keys
• We have scanned shared folders for files containing 'password' or 'admin'
• Team members know the official process for IT support requests
• Administrator accounts are only used when absolutely necessary

The lesson for mid-sized businesses

The Uber breach shows that security is a chain. The attacker found the weakest link—a contractor's personal security—and then exploited common internal mistakes. For a mid-sized business, the takeaway is clear: protect your employees from fatigue, secure your internal secrets, and never trust a login prompt you didn't ask for.