Documented incidentDisclosed 2022-09-16UberEngineering postmortem

MFA fatigue against a contractor gives an attacker access to Uber's internal tools (2022)

An attacker likely bought a contractor's corporate password on the dark web after malware infected the contractor's personal device, then repeatedly sent two-factor approval requests until the contractor accepted one.

What happened

  • The attacker reached internal tools including G-Suite, Slack, OpenDNS and the HackerOne dashboard and downloaded some internal Slack messages.Security update
  • Uber reported no breach of production systems or user data, disabled the compromised accounts, rotated service keys and strengthened MFA policies.Security update

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Use phishing- and fatigue-resistant MFANumber matching, passkeys or hardware keys prevent approval-prompt spam from being accepted blindly.
  • Treat contractor access as high riskRequire managed devices, rate-limit and alert on repeated MFA prompts, and limit what contractor accounts can reach.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern