Salesforce will continue to work on security after the Uber hack

Salesforce co-CEO Marc Benioff said the cloud software company has a lot more cybersecurity work to do after an attack on Uber involving Salesforce’s Slack chat app.

Uber said on Monday that it believed a hacking group called Lapsus$ was behind last week’s cyberattack and noted that other victims of the group’s attacks this year included Cisco, Nvidia, Okta and Samsung. So does Microsoft said that Lapsus$ accessed one of his accounts.

According to Uber, the attacker likely bought a company contractor’s password on the dark web after a malware attack and the contractor accepted a request for two-factor authentication. The attacker downloaded some Slack messages and posted a note in a Slack channel that “many of you saw,” the ride-sharing company said.

Hackers often use so-called social engineering, which involves using trusted individuals rather than simply going after hardware and software.

“There is no finish line when it comes to security and social engineering,” Benioff said during a press conference at Salesforce’s Dreamforce conference in San Francisco on Tuesday. “There are things we will need to do to help our customers prevent these kinds of problems.”

Salesforce has seen its systems exploited in the past. In 2007, a hacker it is reported obtained email addresses stored in Salesforce and used them to stalk customers of Automatic Data Processing and other Salesforce customers. And in June, Salesforce’s Heroku unit said a hacker obtained account passwords and some source code.

“We’ve been through almost every possible situation,” Benioff said. “There’s a lot of things we have to do forever, and we’re going to keep working on it.”

Most of the company’s engineering team works on security and trust, said Brett Taylor, Salesforce’s other co-CEO. Taylor said trust was one of Salesforce’s original values ​​when the company was founded in 1999.

WATCHING: Salesforce was born during the 2001 recession, says chairman and co-CEO Marc Benioff