35 ms·

Uber Paid Hackers to Delete Stolen Data on 57M People

1720 points by coloneltcb 9y ago

booleanbetrayal 9y ago
At what point can we just let a company die? Is there even such a line to be crossed anymore? Personal data leaks and illegal cover-ups, Greyball, utter disregard for regulations, IP theft, a culture systemic harassment and sexism, etc etc etc. Uber just needs to die so that the rest of us can have some semblance of faith in the system left.
- codinghorror 9y ago
  The "success at any cost" mentality may have some costs, in retrospect
  - booleanbetrayal 9y ago
    Definitely cost me my personal data!
osrec 9y ago
I am amazed at the things Uber gets through and is still standing after...
- idibidiart 9y ago
  Money.
  - sunsetMurk 9y ago
    how does this stop being the case? money > all else.
    - idibidiart 9y ago
      Start communities that use solar/wind energy, grow their own food (maybe using this in urban areas: https://www.media.mit.edu/groups/open-agriculture-openag/overview/ https://www.media.mit.edu/groups/open-agriculture-openag/ove...), use WiFi mesh networking, maybe launch their own satellites (for inter-community links: https://newatlas.com/tubesat-personal-satellite/22211/ https://newatlas.com/tubesat-personal-satellite/22211/), build their own things with multi-material 3D printers (maybe even print semiconductor components, who knows...) and employ barter rather than artificially scarce magical paper or e-coins. Also, employ "DIY Bio" in ethical life enhancing way, open production (open source everything etc) The technology and paradigms exist today or will fully exist soon.
    - IanCal 9y ago
      Laws & strong enforcement, with an informed population. While money gives power, the concern is that it's concentrated in a small number of people. Voting is not, and can result in controls of essentially any level.
- wavefunction 9y ago
  Their investors are too big to fail (to recoup their investments by IPO offloading to the sucker public).
- dijit 9y ago
  Never underestimate the power of marketing. My mother for instance would use Uber over any ride-sharing system due to its insane exposure and the fact that these stories remain relatively unheard of in comparison.
  - cyberferret 9y ago
    My family and friends outside the tech industry have almost no clue about nearly all these scandals - especially the data breaches and the former CEO's indiscretions. About the only thing they hear is that some Uber drivers have assaulted passengers in the past, but they write that off against the fact that a lot of Taxi drivers have done the same in the past. It is a telling example that the pain point of a bad taxi service in a city is usually enough for them to conformance rationalise that Uber is still a better alternative, despite any of these issues.
  - user5994461 9y ago
    She used uber because the service is fantastic.
  - spike021 9y ago
    It's already way more common to use "Uber" as a verb, or even a noun, that doesn't necessarily even mean Uber the company itself. People have asked me before if I'm about "to uber" or "take an uber" someplace and they say it in an obvious way that implies "any ridesharing company" (or lyft in my case since most people know I only lyft nowadays). Uber just as a word for ride-sharing has become ingrained and won't be easy to get rid of, IMO.
    - ryacko 9y ago
      At this rate, Uber may be the first company to have a generic name and go out of business so soon afterward.
    - malydok 9y ago
      Same as `googling` will long remain the synonym for `searching the internet`.
- deleted 9y ago
  [deleted]
ipsum2 9y ago
> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection. This happened more than a year ago, and only now that they're planning on offering identity theft protection? That's ridiculous.
- iDemonix 9y ago
  Obviously because only now it's come to the public's attention.
- nathan_long 9y ago
  > Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection. "Sorry we left uranium in your house a year ago and didn't bother telling you. Here's a coupon for free cancer screenings."
stevenj 9y ago
Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same. I plan to never use Uber again.
- deleted 9y ago
  [deleted]
- rlabrecque 9y ago
  When I deactivated my account it was a huge pain, I had to reply to 2 emails, and in the end it took 5 days to complete. That alone annoyed me enough to never go back.
  - linkregister 9y ago
    The current deletion process is smooth and can be completed in-app.
    - adjkant 9y ago
      From the experience of two of my friends in the past month, they had that in-app system "error" and had to do the same emails and 5-day level delay.
    - euyyn 9y ago
      Why bother? I just deleted the app and forgot about it. Is there something I should know?
      - kelnos 9y ago
        IIRC you can't remove all payment methods from the app, so just deleting the app will leave your credit card information in their hands. Also all your previous ride data will still be on their servers. Both of these things could be lost in a data breach, and presumably account deletion deletes this data.
        9y ago
gncb 9y ago
lol
- deusofnull 9y ago
  lol
  - kgraves 9y ago
    L O L
    - tmccrmck 9y ago
      Can you guys not do this, please? HN isn't Reddit. We try to maintain some semblance of effort and thoughtfulness into posting here.
jtchang 9y ago
"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.
- mewmew 9y ago
  This would have been interesting if GDPR was applied. https://www.gdpr.associates/data-breach-penalties/ https://www.gdpr.associates/data-breach-penalties/ "There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher. The Parliament had requested for fines to reach €100 million or 5% of the company’s global annual turnover. The agreed fines are the compromise that was reached."
  - Scoundreller 9y ago
    > The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. Why do big firms get off easier than the smaller firms?
    - will4274 9y ago
      That's not necessarily the case. Consider two firms one that has $1 billion in revenue and one that has $100 million in revenue. You'd argue that the bigger firm is getting off easier with a $20 million fine vs the smaller firm's $10 million because the fine is 2% instead of 10%. OTOH, consider that the bigger firm is made up of a collection of 10 services, each earning $100 million. The breach is only in one business unit - is the global revenue a fair metric if the breach is not global? It will be interesting to see how this is enforced against giant corporations when (inevitably) some small piece of data is missed on some small service in a business unit nobody at the c level has ever heard of.
    - dannyw 9y ago
sehugg 9y ago
At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers $100,000 to delete the data and keep the breach quiet.
- Rotten194 9y ago
  Only $100k? They really should have tried for more... not that I support stealing PII.
  - trosi 9y ago
    They agreed to pay and nobody heard about it for a long time. I'd say they asked for the right amount
wheelzr 9y ago
Credit Monitoring is the shittiest way to resolve these issues. I've stopped using any credit card numbers for anything ditial. I can change paypal passwords weekly If I'm that paranoid.
wheelzr 9y ago
Credit card numbers are a bug.
rickcnagy 9y ago
> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. Don't check secrets into VCS, folks!
- claudiulodro 9y ago
  I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authentication-in-your-organization/ https://help.github.com/articles/requiring-two-factor-authen...
  - lhorie 9y ago
    Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake. One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and an investigation was conducted. It definitely inspires more confidence in leadership seeing that the CEO will not tolerate unethical behavior.
    - perfmode 9y ago
      its possible and even likely that this happened post hack.
      - lhorie 9y ago
        True, I just wanted to shed some light into the current state of affairs in here.
Theodores 9y ago
I wish I was a fly on the wall at Transport for London. Or to be at that meeting TfL will be having with Uber, when Uber are going to magically prove themselves to be a 'fit and proper' company. At some point after some British chat about the weather someone on the TfL side of the table might ask: 'So, that data breach...'
ProAm 9y ago
If the FTC doesn't act on this they are toothless. Uber's blatant disregard to anything accountable or respectable is astounding: "In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014. After last year’s cyberattack, the company was negotiating with the FTC on a privacy settlement even as it haggled with the hackers on containing the breach, Uber said. The company finally agreed to the FTC settlement three months ago, without admitting wrongdoing and before telling the agency about last year’s attack."
- gorbachev 9y ago
  One would hope the next settlement would have more teeth. If I was running the FTC, I would not settle this time, because it's blatantly obvious Uber was acting in bad faith last time around.
- mannykannot 9y ago
  I hope the earlier agreement contains language that allows it to be voided, and put all the original violations back on the table. If there is no such term, this is one relatively straightforward way to improve the handling of these matters in future (if a company was unaware of other breaches at the time and appeared to act in good faith, the FTC could always choose to let the original agreement stand.)
justinzollars 9y ago
I woke up an Silicon Valley has really become an Evil place. What ever happened to our mantra (really Google's but it reflected the whole valley) "Don't be evil"? We really need to change.
- dictum 9y ago
  It all started when Google banned all software that can not be used for Evil: http://wonko.com/post/jsmin-isnt-welcome-on-google-code http://wonko.com/post/jsmin-isnt-welcome-on-google-code
  - halflings 9y ago
    People keep bringing this link up every time, but obscure the actual reason that was done: it puts the developers depending on the library in legal jeopardy. Licenses like "Do Whatever The Fuck You Want To" [0] are in the same boat. Redhat also stopped including JSMin for the same reason. [1] [0] https://en.wikipedia.org/wiki/WTFPL https://en.wikipedia.org/wiki/WTFPL [1] https://bugzilla.redhat.com/show_bug.cgi?id=455507 https://bugzilla.redhat.com/show_bug.cgi?id=455507
    - dictum 9y ago
      Thanks, but my comment was entirely in jest.
- 659087 9y ago
  > What ever happened to our mantra (really Google's but it reflected the whole valley) "Don't be evil"? The kool-aid wore off and everyone realized it never had any meaning to begin with.
  - quickthrower2 9y ago
    "Don't be evil" - a command not a mantra.
vthallam 9y ago
> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection This got to be a running joke now. Companies lose the data and offer credit/theft protection than facing the consequences. If Equifax could get away with the giant breach, I am sure Uber will not even feel the heat. smh.
- Jach 9y ago
  It'd be nice if I could register for 2FA with all the various agencies. Commenters have suggested paying a fee to 'freeze' credit activities but the process to 'unfreeze' them requires no new information than what's already in most of these leaks...
- theDoug 9y ago
  I moved to the US in April was and shocked by the Equifax breach, but more surprised to hear from a coworker how often these “free credit/identity monitoring for a year” situations occur. One co-worker is covered by no less than four groups who failed to look out for him earlier, all for trusting companies to not screw up PII or remember that data is a liability.
  - vthallam 9y ago
    Yeah, this happens a lot here. I mean the cheapest and most effective way for companies to get away.
sthomas1618 9y ago
"Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company." Seems to suggest they committed AWS credentials into source control?
- chadbennett 9y ago
  81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches or data leaks. Most organizations believe that 2FA and SSO are the answer but this proves that 2FA/SSO are not enough.
  - tabeth 9y ago
    Do you believe this kind of thing is simply unavoidable? I wonder if this could've been avoided by simply making it impossible to access data without being connected to a VPN in addition to having some sort of physical device connected to your computer.
    - cdoxsey 9y ago
      For amazon you can use IAM roles tied to specific EC2 instances, then no credentials are ever stored, you simply make S3 API calls in your code and as long as the machine you're making them from has access to the bucket you can get to the data.
    - ajsharp 9y ago
      It's entirely avoidable. Just don't commit secrets to source control. Ever.
      - tabeth 9y ago
        This is good advice, but even if you don't, it's possible that someone else on your team will.
NelsonMinar 9y ago
It never fucking ends with this company, does it?
- chris_wot 9y ago
  No, it does not. Tough luck if you are a drive, btw. You'll be made redundant to self-driving cars soon.
SubiculumCode 9y ago
I think its time that Uber starts paying a real and deathly penalty for their pattern of behaviors.
ksk 9y ago
If companies hiring the "best and brightest" can't keep your data secure, what hope is there for the average non-tech company? Low tech lock-and-key solutions don't seem so bad now. If only they could scale...
GameOfTrolls 9y ago
If there was ever a company that I'd like to watch die in a fire, it would be Uber.
madamelic 9y ago
Yep. About that time my Uber account was 'hacked' and someone kept requesting rides in Florida and I had to cancel them as fast as they made them. I emailed Uber support and they got back to my 3 days later. Then someone proceeded to try to gain access to every account I had with that email and password (yeah, yeah, I know). The next worse was someone getting into my DigitalOcean account and launching an instance. It has finally settled down, I occasionally get alerts from people trying to break into something but lots of 2FA and no shared passwords anymore. I am not sure if this was Uber's fault or another site's but the timeframe of Oct 2016 lines up.
- asabjorn 9y ago
  In the disclosure it says that the attack included names, email addresses and phone numbers. It did not contain any passwords or social security numbers, so your passwords must have been compromised in some other way.
  - shallot_router 9y ago
    It's not related to this particular breach, but given this and Uber's other issues, it's not out of the realm of possibility that at some point they had a more serious breach involving loss of password hashes or interception of credentials at login. (But in all likelihood the poster's account was just compromised through the usual means, otherwise there would be more reports of hacked accounts.)
    - asabjorn 9y ago
      The article states that this disclosure came out of an board commissioned investigation into the activities of Sullivan’s security team. Do you think that other more serious breaches discovered by this investigation is hidden, or is this more of a general sentiment around how you perceive Uber?
      - kenbaylor 9y ago
        Oh there's more. Much more.
keyle 9y ago
"For $100K we will delete the information, Scouts honor!" ...
bogomipz 9y ago
The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for? If it was paid to hackers it's unlikely that finance cut a check. I'm imagining this was paid in bitcoin or similar. How was this able to be approved? I'm guessing someone created a fake invoice? Wouldn't that constitute fraud?
- tedunangst 9y ago
  Who needs to approve it? How would you know they didn't?
  - bogomipz 9y ago
    Generally your finance department needs approve purchases beyond a certain dollar amount. This is pretty standard stuff. If they got it approved as such don't you think the CEO would have been informed that there was line item from Security for ransom? The article states the CEO didn't find out about the hack until a month after.
    - tedunangst 9y ago
      I doubt the CEO of Uber is informed of every $100K transaction.
- xyzzy_plugh 9y ago
  IIRC Uber has had a very large bug bounty program with substantial payouts. It seems possible this was billed under the guise of a bounty.
  - dantiberian 9y ago
    Yes, this is spot-on, the just published New York Times article details this: https://www.nytimes.com/2017/11/21/technology/uber-hack.html https://www.nytimes.com/2017/11/21/technology/uber-hack.html
- quickthrower2 9y ago
michaelbuckbee 9y ago
IANAL but I did some basic visualization work as part of a story on US state data breach regulations. What may be Uber's undoing is that they must have the drivers license numbers for all of their drivers on file and that is considered PII by 45 states (nevermind that they also missed their reporting deadline). And if you're interested, a gif of the data: https://imgur.com/Rm32MeC https://imgur.com/Rm32MeC
ejcx 9y ago
I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story. I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the cover up.
- kenbaylor 9y ago
  Regarding Joe's previous behaviour: https://www.theverge.com/2016/7/10/12127638/uber-ergo-investigation-lawsuit-fraud-travis-kalanick https://www.theverge.com/2016/7/10/12127638/uber-ergo-invest... https://lawyerist.com/ubers-secret-encrypted-far-reaching-investigation-opposing-counsel/ https://lawyerist.com/ubers-secret-encrypted-far-reaching-in... A lot more will likely leak out now. Iceberg tip located.
tibbon 9y ago
I'm getting sick of this stuff. As a user of Uber (or Equifax), would I have any case if I tried to sue them for mishandling private data (I live in Massachusetts)? http://www.mass.gov/ago/doing-business-in-massachusetts/privacy-and-data-security/standards-for-the-protection-of-personal.html http://www.mass.gov/ago/doing-business-in-massachusetts/priv...
- omeid2 9y ago
  Maybe if you can organize a class lawsuit.
moomin 9y ago
At this point if the next headline is “Uber sold nuclear submarine secrets to China whilst kicking puppies” I won’t bat an eyelid.
yawz 9y ago
> Uber paid hackers $100,000 to delete stolen data and keep quiet Really? Really? Come on!!!
chadbennett 9y ago
Another breach that 2FA and SSO didn't stop. 81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches. Most organizations believe that 2FA and SSO are the answer but this proves they are not enough.
revelation 9y ago
Well I hope Uber asked for the hard drive shredder receipt this time around.
harry8 9y ago
Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known. The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will resign, those who take the job would actually take an interest and have the ability to do so. An idea whose time has come.
- ian0 9y ago
  How to implement though? You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats. Also never underestimate just how disorganised large organisations are, incompetence at addressing issues is systemic and goes far beyond data protection. What seems like malice is sometimes just plain stupidity. It has to be backed by some sort of regulatory framework. Just like a fire code or employment rights. But crafted in a way that it doesnt end up like PCI, ratings agencies or financial auditors. IE creating an industry that sells compliance and not actual security. Perhaps something light, like mandetory minimum bug-bounty schemes for all companies, where fines (or more) are imposed for not addressing issues and an independant regulator works with larger companies to resolve issues (or penalise the company severely if they deliberately wont).
  - harry8 9y ago
    No, don't get hung up on unnecessary details. The reasonable company director should have known X and when found out was bound to report it. Person Y did not report it, should have known as it was their job to know and there aren't extenuating circumstances. Guilty. 6 months. Next case. "I don't know anything about this company I accept 7 figure sums to oversee as a director." Should never be any kind of legal defence. If senior management and directors have something personally at risk you'll see vastly improved behavior. Right now we're selecting for the opposite and seeing the inevitable results. There is a story like this about directors and management cover ups every single day
    - 9y ago
halflings 9y ago
They stored AWS storage credentials in clear, in a (private) Github repo... This is so baffling coming from one of the largest tech companies in the world. Among other things, this shows that they do not have proper access policies to user data (e.g anybody working at Uber can get access to any user's data), which in my opinion is a larger issue than this individual hacking case.
- the_cat_kittles 9y ago
  as the size of the company grows past a certain size, especially these "move fast and break things" idiots, i feel like the likelihood of this goes up. there are more and more people, someone is bound to do something stupid.
  - halflings 9y ago
    The fact that this is a big company is exactly why strict access policies are necessary! I might trust a handful of administrators, or a limited set of engineers whose data access is audited, but I sure as hell would not trust thousands of engineers with my private data. Other tech companies (e.g Google) safely silo PII data, and any access has to be audited. I cannot wait before GDPR is implemented in Europe... at least companies will be seriously fined if they want to cut corners on privacy and data protection.
- x0x0 9y ago
  We already knew that -- viz Uber showing off their ability to track famous users at a party. see https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view-uber-allegedly-stalked-users-for-party-goers-viewing-pleasure/ https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view... https://www.cnet.com/news/god-view-under-spotlight-as-uber-investigation-intensifies/ https://www.cnet.com/news/god-view-under-spotlight-as-uber-i... and https://www.cnet.com/news/uber-lawsuit-alleges-startup-tracked-celebs-politicians/ https://www.cnet.com/news/uber-lawsuit-alleges-startup-track...
  - halflings 9y ago
tabeth 9y ago
Wouldn't the easy solution to this class of problems be to require some sort of physical device to be connected to your machine in order to access certain sets of data? Assuming the device itself couldn't be spoofed, wouldn't that solve this once and for all?
leroy_masochist 9y ago
> Joe Sullivan, the outgoing security chief, spearheaded the response to the hack last year, a spokesman told Bloomberg. Sullivan, a onetime federal prosecutor who joined Uber in 2015 from Facebook Inc.... Why on earth would a software-based company like Uber that stores a boatload of confidential employee and customer information on its servers put a non-technical person of any sort, lawyer or not, in charge of its security team?
- moxious 9y ago
  Put a lawyer in charge when your strategy is to defend lawsuits against issues and mitigate the fallout of issues, rather than to, you know, prevent the security issues
- dba7dba 9y ago
  Welcome to lobbying ver, 2.0. Instead of giving cash bribe, bribe with cushy jobs with high salary and no real responsibility, since no one would expect a lawyer to understand what even to delegate to members of IT security team.
- eropple 9y ago
  Security, as far as a corporate entity is concerned, is fundamentally a way to reduce business and legal risk. A lawyer at the top, making those decisions with the input of technologists, seems like it should be reasonable when things are working correctly. This isn't a failure of skillset or knowledge, it's a failure of ethics and leadership. (Which should, to be clear, be punished far more severely than skill-related incompetence.)
chakalakasp 9y ago
Man, I don't know if Uber is evil or if most tech companies are evil and Uber just doesn't drop the kind of money on PR strategery that an evil company need to drop in order to seem normal. But either way, holy cow does that company come off as toxic. They've completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers (to the point that the CEO of Apple had to have a Come To Jesus talk with the CEO of Uber) or how their employees feel like they are getting screwed or, now, how they are concealing massive data breaches. It's like how I imagine Uber would be if it was run by Magneto instead of Tony Stark.
- necessity 9y ago
  You're watching too much CNN.
- edgarvaldes 9y ago
  >and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers I don't think the average Joe is up to date with this news, or even care about.
  - wingworks 9y ago
    Nope, they don't know. My non-tech friends are all using Uber / UberEats with no clue about the company, and the CEO. They just see an easy to use app to get what they want quickly.
    - wallace_f 9y ago
      Speaking of politics, media influence and tech, a fair number of average joes have a terrible opinion of Musk/Tesla/SpaceX; but these same people are unaware, or maybe vaguely aware the US Gov spent >10billion, just in direct financial losses, bailing out GM. If everyone in the country was told "write a check to GM for $50 or go to jail," and conservative media wasn't berating Tesla/Musk, public opinion would be a lot different... Take it all with some healthy skepticism.
chis 9y ago
Why was this only worth 100K? How did they verify info was deleted? And how does this show up on an expense report at the end of the year?
- cube00 9y ago
  Security Penetration Testing
  - Strom 9y ago
    What would be the tax implications of this in USA? I imagine there isn't a bill given by another entity, but this is rather a bitcoin/cash transaction. In my country this would mean this payout would be hit with all the taxes [1], pretty much doubling the cost. -- [1] Income tax, unemployment insurance, healthcare, and maybe even pension. All going to the benefit of the country as there is no identifiable human on the receiving end.
- dilyevsky 9y ago
  > Why was this only worth 100K? Gotta be careful dealing with company like Uber. At some price point they might just hire hitmen to kill you instead.
partycoder 9y ago
And how exactly did they verify that the hackers actually deleted the data?
hwu2whag 9y ago
Even if this was the correct way to handle such an incident, how can you be sure that once you've paid the hackers they actually destroy the data?
pcarolan 9y ago
I don't know, paying off the hackers might have been the best call. It prevented my data from being exposed into the wild vs notifying authorities which would have all but guaranteed a leak. If the objective was to protect Ubers' customers, mission accomplished. Should they have covered it up and not disclosed it? No, but this is as a tough call ethically.
seanmccann 9y ago
In about 2014 I noticed that the logged in API request, on Uber's website, included full driver info nested under the ride JSON object. It included the drivers full address, license, phone numbers, etc. They patched it a few months later, but it was the worst data leak I've seen.
yalogin 9y ago
This is exactly why the CEO should lead by example. If the CEO himself does shady stuff all the time and in fact encourages it, its normal and even expected that the hack is covered up.
developuh 9y ago
How should a startup or a company in this situation handle it properly ? Should they come out clean to their users ?
rdxm 9y ago
if the board had any self-respect they would shutter the shit-show that is uber and walk away. and yeah, that's walking away from a truckload of dough, but really, how can any board memeber look themselves in the mirror at this point? the business model is a joke, the culture is toxic, and basically its a failed experiment. i've been back channel spanked by yc moderators on this topic for some of my snarky comments on uber, but all i have to do is wait a week or two for the next shoe to drop and then, well, there you have it.. uber is the poster-child for why the broader US loathes the valley. i would love to see real innovation and advancement become a reality out of SV soon and return the storied past to a real thing. but. as long as entities like uber and theranos, etc, etc are allowed to persist that will never happen...
eeZah7Ux 9y ago
The journalist speculated about "evidence that the files were actually deleted" referring to the "hackers" deleting their copies of the extracted data. Really? Evidence of deletion?
londons_explore 9y ago
If these 'hackers' were white hat and signed a contract saying they responsibly handled and deleted the data, and then uber checked the access logs of the data and verified that nobody else accessed it, then IMO it is not a data breach. It was a potential breach. A white hat hacker you have an agreement with on how the data should be handled is the same as an employee who has access to the same data, where you also have an agreement on the employees use of the data. You might say "Ooh, but can you trust the hacker not to keep a copy of the data!?!", but it's exactly the same as saying "Can you trust the employee not to copy the data?". I don't think a company would announce a data breach just because the database administrator had access to a backup tape...
- TheSpiceIsLife 9y ago
  Would a more correct term be "data security consultant"?
- xyzzy_plugh 9y ago
  If this was the case, why the secrecy? Why did staff get fired? If it is as you describe, do you think the public would understand and react differently?
- pserwylo 9y ago
  What you have described makes sense only if they were originally hired as penetration testers. I think an external hack of this nature, even if done by white hat hackers, should rightfully be treated differently. Having said that, you raise an interesting point, because if this money was paid as a bug bounty, then perhaps the lines would be blurred again. I guess the difference is that a bug bounty would have more clearly defined parameters about how far the hack should go. Logging into AWS using credentials that were found lying around, then continuing on to download data, seems like it is beyond the realm of reasonable bug-bounty hunting and responsible disclosure.
- openasocket 9y ago
  In what world is stealing information and then holding it for ransom 'white hat'? > You might say "Ooh, but can you trust the hacker not to keep a copy of the data!?!", but it's exactly the same as saying "Can you trust the employee not to copy the data?". I trust someone I vetted and hired a hell of a lot more than the person who just extorted $100K from me.
tptacek 9y ago
Amazon's access control and authorization system is the current most important broken thing in the industry. The Joe Sullivan details are the lurid stuff that propels news story copy, but the important takeaway is that almost nobody, including companies with serious investments in security, can safely get a large-scale dev team deploying onto AWS. This story keeps getting re-told, and has been for something like 5 years now. It's a problem, and it needs to get fixed, decisively.
- cddotdotslash 9y ago
  Full disclosure: I'm the founder of CloudSploit[1] which aims to reduce these risks. You're definitely on to something here. While I wouldn't call AWS security "broken," it is next to impossible to implement it correctly in any medium to large size business. There are 30+ services that AWS provides, each with an infinite number of security controls, JSON-based policies, etc. Cross-service access is even worse. Almost every service has some form of sub control that extends or complements the main security tool (IAM). KMS has key policies, ECR has registry policies, SNS has delivery policies, etc. S3 has perhaps the most confusing permission policy in existence, which has led to scores of high profile hacks this year alone. There are 12+ public regions now, with more coming every few months, each fully enabled, yet segregated within the UI and API (which makes detecting attackers who have embedded themselves in unused regions more difficult). All it takes is literally one typo in a single user's policy and leaked credentials and you're environment is completely compromised. Recovery is next to impossible without basically starting from scratch because you'll never find every tiny hole the attacker left as a backdoor for later without combing through GB of CloudTrail logs. Now take all that, put it in an organization with 500+ engineers and you can see how easy it is for this to happen. Think you're safe by putting each team in their own account? Well AWS supports cross account role provisioning and engineers can easily set that up within their accounts. The spider web of issues is endless. [1] https://cloudsploit.com https://cloudsploit.com
  - aptwebapps 9y ago
    > While I wouldn't call AWS security "broken," ... That doesn't match with the rest of your comment. At all. What would you call broken, then?
foobaw 9y ago
So was the stolen data deleted? This could've easily just been part of a "bug county," no? Except when you actually steal data, you're not eligible to bounty. This means the hackers had decent leverage and negotiation skills (maybe Uber could've scared them with lawyers, etc).
jimjimjim 9y ago
Someone needs to start a Top 10 Evil Corp web site. maybe a yearly most evil corp awards. because it looks like uber is relentlessly bad.
- joveian 9y ago
  Not quite what you are looking for but the International Labor Rights Forum does a great job of trying to change some of the worst of the worst practices around the world (unfortunately, Uber is unlikely to make a top ten list). https://ilrf.org/ https://ilrf.org/
deleted 9y ago
[deleted]
anigbrowl 9y ago
And people wonder why I keep saying that Uber needs to have its business license yanked or suffer some similarly drastic sanction or they'll just keep right on doing it and others will follow the same strategy. I mean, how often does a firm have to breach the trust of (just about) everyone it deals with before it's time to punish it in some meaningful way?
petarb 9y ago
Moral of the story, use two factor auth on GitHub and AWS to prevent unauthorized access.
kenbaylor 9y ago
And just for an FYI: California law SB1386 requires mandatory breach notification when drivers license data is stolen.... which this team knew very very well. So this was willful. Expect many more exits.
dantiberian 9y ago
From https://www.nytimes.com/2017/11/21/technology/uber-hack.html https://www.nytimes.com/2017/11/21/technology/uber-hack.html > Two hackers had stolen data about the company’s riders and drivers — including phone numbers, email addresses and names — from a third-party server, putting the personal data of more than 57 million people at risk. The hackers approached Uber and demanded $100,000 to delete their copy of the data [...]. > Uber acquiesced to the demands. Under the orders of Travis Kalanick, who was then its chief executive, and Joe Sullivan, the chief security officer, the company paid the ransom. > Then Uber went further. The company tracked down the hackers and pushed them to sign nondisclosure agreements [...]. To further conceal the damage, Uber executives also made it appear as if the payout had been part of a “bug bounty” [...].
ravirajx7 9y ago
Paying hackers good move or bad move? Or Little bit of PR as well that they can pay if they got hacked again?
gimmeminusnow2 9y ago
I feel like uber, google and facebook have competition who steal and violate peoples privacy the most.. Please, do not use these corporations services.
cmurf 9y ago
I thought it was illegal to conceal breaches. Certainly there should be disclosure requirements for publicly traded companies.
gok 9y ago
So was it bad to have paid the ransom?
aaroninsf 9y ago
"Delete" can't even lolz
sebleon 9y ago
Meh, Uber is one of the good guys, compared to other American multinationals. For starters, Chiquita Bananas intimidated farmers and union leaders with AK 47s and hired militias in Colombia [1]. [1] https://en.m.wikipedia.org/wiki/United_Fruit_Company#Aiding_and_abetting_a_terrorist_organization https://en.m.wikipedia.org/wiki/United_Fruit_Company#Aiding_...
Nicholas7900 9y ago
Some times, i don't code programs. I know that's a typical of someone perceived as a hacker, but my techniques have always been a typical. For instance, it might surprise readers to know that all of the widely publicized hacks I was involved in - let's call that the "Adrian Classic" period :p - were done using a web browser and Notepad, on dialup, on Windows 98. If you stop to think about it, this is really a true meta-hack. People who ask to learn how to hack are generally told to install Linux, learn how to code, and experiment with various hacking tools. Much how network administrators learning to secure their systems tend to get the same certifications, read many of the same books. This results in activity that's really more like jousting than hacking - a predefined pattern of attack taking place against a predefined pattern of defense. When i started Hacking, I learnt how to code, I learned to read code, and I learned how programmers thought, which assumptions they tended to make, and what mistakes their common training tended to cause them to make in common across completely different systems. One example of this is writing access code with the assumption that if failure = no then access = yes. On many systems, I found that by simply removing a username or password field, access would be automatically granted - because there had been no username or password failure, since there had been none to fail, so access was granted. Because my methods were and are unorthodox, they are rarely detected by intrusion detection systems. They don't resemble common attacks because they aren't common attacks. I often make them up on the spot. Which is why the question "teach me to hack" is so frustrating. This is particularly emphasized by a meme pic I got a Google Alert for this morning: I always give readers free Access to reach me for all kinds of Hacking Issues though : compositehacks@gmail.com
yeukhon 9y ago
How can they be sure the hackers didn’t have another copy?
jedberg 9y ago
Something about this is sitting right with me. I know Joe (the ousted CISO). I’ve known him for almost 15 years, and worked with him professionally in the past. This is not like him. He was the most ethical lawyer I ever met. Everything was by the book. He cares about privacy. He cares about users. He’s prosecuted the worst of the worst. Something here isn’t right.
- bbarn 9y ago
  CSO/CISOs are basically there to be the fall person in the case of a data breach. Your job is basically to implement process and policy to the point of nearly breaking productivity, then get fired when that wasn't enough.
eddieplan9 9y ago
This has been blown out of proportion. - This is not Equifax, which leaked hundreds of millions SSN; or LinkedIn, which leaked hashed password of millions[1]; or Yahoo, which leaked personal information of billions, including security questions and hashed passwords [2]; or Target, which affected 40MM credit cards [3]. "Compromised data [..] included names, email addresses and phone numbers of 50 million Uber riders around the world, [..] including some 600,000 U.S. driver’s license numbers. No Social Security numbers, credit card information, trip location details or other data were taken" - There is no gross incompetence. The breach was due to an AWS access key in a private github repo. I bet you can find enough developers in this forum who store sensitive information in private GitHub repos without git encryption, and who may or may not feel guilty, because of the (false) sense of safety given by 1) the guarantee of github private repo and 2) the fact that access keys can be revoked and are generally handled with less care. - The response by the new CEO is decisive and timely. The CSO was fired on the same day the CEO learned about the incident. There is also internal review, new advisor, and reasonable protection offered to the drivers affected, even though there is no indication the data is leaked beyond the thief, and driver license numbers are not the best for identify theft. [1] https://en.wikipedia.org/wiki/2012_LinkedIn_hack https://en.wikipedia.org/wiki/2012_LinkedIn_hack [2] https://en.wikipedia.org/wiki/Yahoo!_data_breaches https://en.wikipedia.org/wiki/Yahoo!_data_breaches [3] https://www.huffingtonpost.com/eric-dezenhall/a-look-back-at-the-target_b_7000816.html https://www.huffingtonpost.com/eric-dezenhall/a-look-back-at...
ddmma 9y ago
Massive data spill as Uber was hacked.. maybe email address is not so importat but ride history and wherever location data is something quite sensitive .. shift delete!
yuvalmer 9y ago
It seems they didn't learn from their mistakes. It sounds that the 2014 breach was caused by the same mistake. "That gist is believed to have contained a login key used by a hacker to access an internal Uber database of 50,000 drivers." https://www.theregister.co.uk/2015/02/28/uber_subpoenas_github_for_hacker_details https://www.theregister.co.uk/2015/02/28/uber_subpoenas_gith...
HaoZeke 9y ago
The problem of course is them storing private credentials on Github despite numerous highlights on the site to not do so. Private github sites are private as in hidden. Not as in digitally encrypted bank vault. What sort of tech company doesn't go for a self hosted git option anyway!? Like Gitlab which comes with CI to keep the whole thing private. Also self hosting allows an arbitrary level of security..
cooltechguy 9y ago
Thats good , on the contrary Facebook continues to steal data. One of former FB employees has confirmed that the social media giant cares more about data collection than safeguarding your information
sAbakumoff 9y ago
> Here’s how the hack went down: Two attackers accessed a private GitHub coding site... I am wondering what private Github coding site stands for? If it is GitHub Enterprise, then how those hackers would even access it from outside of the uber network? Does it mean that they had access to Uber's VPN as well?
k__ 9y ago
lol, I just understood they stole data and then paid the hackers to delete it so nobody would suspect them spying on their users
jpkeisala 9y ago
That company just keeps giving.
jagermo 9y ago
Did they pinky-promise to delete the data? Sorry, but that is beyond naive.
marenkay 9y ago
... so honestly, at this point, we basically have another Uber thing every 2nd week. I do not get why there is no legal action taken against Uber or even steps to shut it down. So much of the stuff violate basic laws how to run a business, apart from the humongous flaws in Ubers ethics and damaging effects on society.
- skybrian 9y ago
  From the article: "After Uber’s disclosure Tuesday, New York Attorney General Eric Schneiderman launched an investigation into the hack, his spokeswoman Amy Spitalnick said. The company was also sued for negligence over the breach by a customer seeking class-action status."
  - marenkay 9y ago
    I read that, what I do not get is how the difference in judgement can be justified. Small companies will instantly get sued and pay fees ruining them for this things. And that already the 1st time it happens. For Uber this is beyond ten finger counting in terms of issues in the past two years. It is just not having any consequences and by now from the legal side you can conclude that Uber is a repeated offender which has not learned anything from previous cases. So, my point stands. When will this actually lead to consequences and justice being served?
fastball 9y ago
Did anyone else read this title and assume that it meant Uber had stolen the data of 57M people and then paid hackers to delete it? I feel like the word "ransom" should probably be used somewhere in the title.
phillip7899 9y ago
I lost my job few months back before i notice my wife started acting up, she changed passwords to every account that she has, put a pin lock on her phone which she has never done before, i have been searching for ways to retrieve her text messages without installing any software on her phone or having access to it, I was introduced to this wonderful hacker and he hacked into my partner mobile with just her phone number only. i get to know she was cheating and all.i felt very sad about this,but it over now.all thanks to murphy.c8990@gmail.com if you need help regarding to issues like this contact him.let him know philip referred you in.
nvahalik 9y ago
Aww man. If they were smart they would have announce a bug-bounty and then just did things that way.
mikemaster2000 9y ago
Uber should be shut down for stupidity.
mannykannot 9y ago
It seems that Uber has only paid the infiltrators to say they have deleted the data. Putting aside, for the moment, all the legal and ethical issues, why would anyone at Uber imagine that this would be in the slightest bit beneficial?
odammit 9y ago
Private repo or not, checking your credentials into git is amateur. I’d normally say eventually it’d bite you if you fall into the habit and do it on a public repo by accident but it looks like it can bite you on a private one too. Manage your secrets. Use something like Vault[1] or Pass[2] they’re free and awesome projects. I keep all of my secrets even non-prod ones in one of these two because if you think about it, even your “non-prod” github credentials are kinda prod since you have access to code. 1- https://www.vaultproject.io/ https://www.vaultproject.io/ 2- https://www.passwordstore.org/ https://www.passwordstore.org/ Also when it comes to AWS secrets, give your developers read only access, make them turn on MFA and assume a role that scopes permissions to the work they need to do. Leaking AWS secrets is really asking for it. The amount of bots that consistently scan public git repos and then use the credentials to spin up massive instances to mine crypto currency is impressive. I’ve seen it do upwards of $10000 in AWS usage within five minutes of the commit containing the credentials.
- sillysaurus3 9y ago
  It may be amateur, but it's one of the most common mistakes. Even at top companies.
  - odammit 9y ago
    Amateur may not have been the best word. Maybe easy or lazy or debt. Ive seen it a lot where it was something that was inherited and the current team knows its a problem, but they have a 1000 features to build and never get around to fixing that debt.
    - sillysaurus3 9y ago
      The cure for this is to get a pentest. It forces you to care.
- zanedb 9y ago
  If you still want to use a Git repo, at least use an encrypted Keybase teams repo[0]. [0]: https://keybase.io/blog/encrypted-git-for-everyone https://keybase.io/blog/encrypted-git-for-everyone
xedarius 9y ago
Missing a trick these hackers, they don't want to ask for a one of payment, they want to turn this business of theirs into a cashflow. Pay X a month and we will keep the data safe. X could be a much smaller number than 100k. As we all know they haven't deleted the data. Think of it as a security tax levied by the internets.
alehul 9y ago
Although obviously wrong on Uber's part, I'm curious: If they had informed law enforcement, could it be possible to legally pay the hackers to delete the data? Hacks of this magnitude, especially in other cases where they involve credit card information, cause millions in damages ultimately, however the black hats involved (the initial part of that chain of events) sell that data for much less. Could we cut the losses there, by paying the hackers? Would it be legal? It could be a more serious version of a bug bounty.
revmoo 9y ago
There is no hacker, the CTO (or somebody else) invented him to scam the company.
eyeareque 9y ago
I really hope Lyft can take advantage of all the mistakes Uber has made. I wonder if it is a good time to start a role at Uber or Lyft? I’m not sure which one I would pick.
BinaryIdiot 9y ago
Whoa, Uber even had the hackers sign an NDA? Like, what were they going to do if the hackers broke the NDA? That's just...insanity. The fact that Travis knew about it as well smells like he could face charges. https://www.nytimes.com/2017/11/21/technology/uber-hack.html https://www.nytimes.com/2017/11/21/technology/uber-hack.html
philip7899 9y ago
I lost my job few months back before i notice my wife started acting up, she changed passwords to every account that she has, put a pin lock on her phone which she has never done before, i have been searching for ways to retrieve her text messages without installing any software on her phone or having access to it, I was introduced to this wonderful hacker and he hacked into my partner mobile with just her phone number only. i get to know she was cheating and all.i felt very sad about this,but it over now.all thanks to murphy.c8990@gmail.com if you need help regarding to issues like this contact him.let him know philip referred you in.
0898 9y ago
How did they know they'd delete it?
p3t3rp4n 9y ago
These type of people actually have driving licences ...

1720 points by coloneltcb 9y ago

At what point can we just let a company die? Is there even such a line to be crossed anymore? Personal data leaks and illegal cover-ups, Greyball, utter disregard for regulations, IP theft, a culture systemic harassment and sexism, etc etc etc. Uber just needs to die so that the rest of us can have some semblance of faith in the system left.

codinghorror 9y ago
The "success at any cost" mentality may have some costs, in retrospect
- booleanbetrayal 9y ago
  Definitely cost me my personal data!

osrec 9y ago

I am amazed at the things Uber gets through and is still standing after...

idibidiart 9y ago
Money.
- sunsetMurk 9y ago
  how does this stop being the case? money > all else.
  - idibidiart 9y ago
    Start communities that use solar/wind energy, grow their own food (maybe using this in urban areas: https://www.media.mit.edu/groups/open-agriculture-openag/overview/ https://www.media.mit.edu/groups/open-agriculture-openag/ove...), use WiFi mesh networking, maybe launch their own satellites (for inter-community links: https://newatlas.com/tubesat-personal-satellite/22211/ https://newatlas.com/tubesat-personal-satellite/22211/), build their own things with multi-material 3D printers (maybe even print semiconductor components, who knows...) and employ barter rather than artificially scarce magical paper or e-coins. Also, employ "DIY Bio" in ethical life enhancing way, open production (open source everything etc) The technology and paradigms exist today or will fully exist soon.
  - IanCal 9y ago
    Laws & strong enforcement, with an informed population. While money gives power, the concern is that it's concentrated in a small number of people. Voting is not, and can result in controls of essentially any level.
wavefunction 9y ago
Their investors are too big to fail (to recoup their investments by IPO offloading to the sucker public).
dijit 9y ago
Never underestimate the power of marketing. My mother for instance would use Uber over any ride-sharing system due to its insane exposure and the fact that these stories remain relatively unheard of in comparison.
- cyberferret 9y ago
  My family and friends outside the tech industry have almost no clue about nearly all these scandals - especially the data breaches and the former CEO's indiscretions. About the only thing they hear is that some Uber drivers have assaulted passengers in the past, but they write that off against the fact that a lot of Taxi drivers have done the same in the past. It is a telling example that the pain point of a bad taxi service in a city is usually enough for them to conformance rationalise that Uber is still a better alternative, despite any of these issues.
- user5994461 9y ago
  She used uber because the service is fantastic.
- spike021 9y ago
  It's already way more common to use "Uber" as a verb, or even a noun, that doesn't necessarily even mean Uber the company itself. People have asked me before if I'm about "to uber" or "take an uber" someplace and they say it in an obvious way that implies "any ridesharing company" (or lyft in my case since most people know I only lyft nowadays). Uber just as a word for ride-sharing has become ingrained and won't be easy to get rid of, IMO.
  - ryacko 9y ago
    At this rate, Uber may be the first company to have a generic name and go out of business so soon afterward.
  - malydok 9y ago
    Same as `googling` will long remain the synonym for `searching the internet`.
deleted 9y ago
[deleted]

ipsum2 9y ago

> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection. This happened more than a year ago, and only now that they're planning on offering identity theft protection? That's ridiculous.

iDemonix 9y ago
Obviously because only now it's come to the public's attention.
nathan_long 9y ago
> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection. "Sorry we left uranium in your house a year ago and didn't bother telling you. Here's a coupon for free cancer screenings."

stevenj 9y ago

Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same. I plan to never use Uber again.

deleted 9y ago
[deleted]
rlabrecque 9y ago
When I deactivated my account it was a huge pain, I had to reply to 2 emails, and in the end it took 5 days to complete. That alone annoyed me enough to never go back.
- linkregister 9y ago
  The current deletion process is smooth and can be completed in-app.
  - adjkant 9y ago
    From the experience of two of my friends in the past month, they had that in-app system "error" and had to do the same emails and 5-day level delay.
  - euyyn 9y ago
    Why bother? I just deleted the app and forgot about it. Is there something I should know?
    - kelnos 9y ago
      IIRC you can't remove all payment methods from the app, so just deleting the app will leave your credit card information in their hands. Also all your previous ride data will still be on their servers. Both of these things could be lost in a data breach, and presumably account deletion deletes this data.
      - 9y ago

gncb 9y ago

lol

deusofnull 9y ago
lol
- kgraves 9y ago
  L O L
  - tmccrmck 9y ago
    Can you guys not do this, please? HN isn't Reddit. We try to maintain some semblance of effort and thoughtfulness into posting here.

jtchang 9y ago

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.

mewmew 9y ago
This would have been interesting if GDPR was applied. https://www.gdpr.associates/data-breach-penalties/ https://www.gdpr.associates/data-breach-penalties/ "There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher. The Parliament had requested for fines to reach €100 million or 5% of the company’s global annual turnover. The agreed fines are the compromise that was reached."
- Scoundreller 9y ago
  > The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. Why do big firms get off easier than the smaller firms?
  - will4274 9y ago
    That's not necessarily the case. Consider two firms one that has $1 billion in revenue and one that has $100 million in revenue. You'd argue that the bigger firm is getting off easier with a $20 million fine vs the smaller firm's $10 million because the fine is 2% instead of 10%. OTOH, consider that the bigger firm is made up of a collection of 10 services, each earning $100 million. The breach is only in one business unit - is the global revenue a fair metric if the breach is not global? It will be interesting to see how this is enforced against giant corporations when (inevitably) some small piece of data is missed on some small service in a business unit nobody at the c level has ever heard of.
  - dannyw 9y ago

sehugg 9y ago

At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers $100,000 to delete the data and keep the breach quiet.

Rotten194 9y ago
Only $100k? They really should have tried for more... not that I support stealing PII.
- trosi 9y ago
  They agreed to pay and nobody heard about it for a long time. I'd say they asked for the right amount

wheelzr 9y ago

Credit Monitoring is the shittiest way to resolve these issues. I've stopped using any credit card numbers for anything ditial. I can change paypal passwords weekly If I'm that paranoid.

wheelzr 9y ago

Credit card numbers are a bug.

rickcnagy 9y ago

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. Don't check secrets into VCS, folks!

claudiulodro 9y ago
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authentication-in-your-organization/ https://help.github.com/articles/requiring-two-factor-authen...
- lhorie 9y ago
  Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake. One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and an investigation was conducted. It definitely inspires more confidence in leadership seeing that the CEO will not tolerate unethical behavior.
  - perfmode 9y ago
    its possible and even likely that this happened post hack.
    - lhorie 9y ago
      True, I just wanted to shed some light into the current state of affairs in here.

Theodores 9y ago

I wish I was a fly on the wall at Transport for London. Or to be at that meeting TfL will be having with Uber, when Uber are going to magically prove themselves to be a 'fit and proper' company. At some point after some British chat about the weather someone on the TfL side of the table might ask: 'So, that data breach...'

ProAm 9y ago

If the FTC doesn't act on this they are toothless. Uber's blatant disregard to anything accountable or respectable is astounding: "In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014. After last year’s cyberattack, the company was negotiating with the FTC on a privacy settlement even as it haggled with the hackers on containing the breach, Uber said. The company finally agreed to the FTC settlement three months ago, without admitting wrongdoing and before telling the agency about last year’s attack."

gorbachev 9y ago
One would hope the next settlement would have more teeth. If I was running the FTC, I would not settle this time, because it's blatantly obvious Uber was acting in bad faith last time around.
mannykannot 9y ago
I hope the earlier agreement contains language that allows it to be voided, and put all the original violations back on the table. If there is no such term, this is one relatively straightforward way to improve the handling of these matters in future (if a company was unaware of other breaches at the time and appeared to act in good faith, the FTC could always choose to let the original agreement stand.)

justinzollars 9y ago

I woke up an Silicon Valley has really become an Evil place. What ever happened to our mantra (really Google's but it reflected the whole valley) "Don't be evil"? We really need to change.

dictum 9y ago
It all started when Google banned all software that can not be used for Evil: http://wonko.com/post/jsmin-isnt-welcome-on-google-code http://wonko.com/post/jsmin-isnt-welcome-on-google-code
- halflings 9y ago
  People keep bringing this link up every time, but obscure the actual reason that was done: it puts the developers depending on the library in legal jeopardy. Licenses like "Do Whatever The Fuck You Want To" [0] are in the same boat. Redhat also stopped including JSMin for the same reason. [1] [0] https://en.wikipedia.org/wiki/WTFPL https://en.wikipedia.org/wiki/WTFPL [1] https://bugzilla.redhat.com/show_bug.cgi?id=455507 https://bugzilla.redhat.com/show_bug.cgi?id=455507
  - dictum 9y ago
    Thanks, but my comment was entirely in jest.
659087 9y ago
> What ever happened to our mantra (really Google's but it reflected the whole valley) "Don't be evil"? The kool-aid wore off and everyone realized it never had any meaning to begin with.
- quickthrower2 9y ago
  "Don't be evil" - a command not a mantra.

vthallam 9y ago

> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection This got to be a running joke now. Companies lose the data and offer credit/theft protection than facing the consequences. If Equifax could get away with the giant breach, I am sure Uber will not even feel the heat. smh.

Jach 9y ago
It'd be nice if I could register for 2FA with all the various agencies. Commenters have suggested paying a fee to 'freeze' credit activities but the process to 'unfreeze' them requires no new information than what's already in most of these leaks...
theDoug 9y ago
I moved to the US in April was and shocked by the Equifax breach, but more surprised to hear from a coworker how often these “free credit/identity monitoring for a year” situations occur. One co-worker is covered by no less than four groups who failed to look out for him earlier, all for trusting companies to not screw up PII or remember that data is a liability.
- vthallam 9y ago
  Yeah, this happens a lot here. I mean the cheapest and most effective way for companies to get away.

sthomas1618 9y ago

"Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company." Seems to suggest they committed AWS credentials into source control?

chadbennett 9y ago
81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches or data leaks. Most organizations believe that 2FA and SSO are the answer but this proves that 2FA/SSO are not enough.
- tabeth 9y ago
  Do you believe this kind of thing is simply unavoidable? I wonder if this could've been avoided by simply making it impossible to access data without being connected to a VPN in addition to having some sort of physical device connected to your computer.
  - cdoxsey 9y ago
    For amazon you can use IAM roles tied to specific EC2 instances, then no credentials are ever stored, you simply make S3 API calls in your code and as long as the machine you're making them from has access to the bucket you can get to the data.
  - ajsharp 9y ago
    It's entirely avoidable. Just don't commit secrets to source control. Ever.
    - tabeth 9y ago
      This is good advice, but even if you don't, it's possible that someone else on your team will.

NelsonMinar 9y ago

It never fucking ends with this company, does it?

chris_wot 9y ago
No, it does not. Tough luck if you are a drive, btw. You'll be made redundant to self-driving cars soon.

SubiculumCode 9y ago

I think its time that Uber starts paying a real and deathly penalty for their pattern of behaviors.

ksk 9y ago

If companies hiring the "best and brightest" can't keep your data secure, what hope is there for the average non-tech company? Low tech lock-and-key solutions don't seem so bad now. If only they could scale...

GameOfTrolls 9y ago

If there was ever a company that I'd like to watch die in a fire, it would be Uber.

madamelic 9y ago

Yep. About that time my Uber account was 'hacked' and someone kept requesting rides in Florida and I had to cancel them as fast as they made them. I emailed Uber support and they got back to my 3 days later. Then someone proceeded to try to gain access to every account I had with that email and password (yeah, yeah, I know). The next worse was someone getting into my DigitalOcean account and launching an instance. It has finally settled down, I occasionally get alerts from people trying to break into something but lots of 2FA and no shared passwords anymore. I am not sure if this was Uber's fault or another site's but the timeframe of Oct 2016 lines up.

asabjorn 9y ago
In the disclosure it says that the attack included names, email addresses and phone numbers. It did not contain any passwords or social security numbers, so your passwords must have been compromised in some other way.
- shallot_router 9y ago
  It's not related to this particular breach, but given this and Uber's other issues, it's not out of the realm of possibility that at some point they had a more serious breach involving loss of password hashes or interception of credentials at login. (But in all likelihood the poster's account was just compromised through the usual means, otherwise there would be more reports of hacked accounts.)
  - asabjorn 9y ago
    The article states that this disclosure came out of an board commissioned investigation into the activities of Sullivan’s security team. Do you think that other more serious breaches discovered by this investigation is hidden, or is this more of a general sentiment around how you perceive Uber?
    - kenbaylor 9y ago
      Oh there's more. Much more.

keyle 9y ago

"For $100K we will delete the information, Scouts honor!" ...

bogomipz 9y ago

The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for? If it was paid to hackers it's unlikely that finance cut a check. I'm imagining this was paid in bitcoin or similar. How was this able to be approved? I'm guessing someone created a fake invoice? Wouldn't that constitute fraud?

tedunangst 9y ago
Who needs to approve it? How would you know they didn't?
- bogomipz 9y ago
  Generally your finance department needs approve purchases beyond a certain dollar amount. This is pretty standard stuff. If they got it approved as such don't you think the CEO would have been informed that there was line item from Security for ransom? The article states the CEO didn't find out about the hack until a month after.
  - tedunangst 9y ago
    I doubt the CEO of Uber is informed of every $100K transaction.
xyzzy_plugh 9y ago
IIRC Uber has had a very large bug bounty program with substantial payouts. It seems possible this was billed under the guise of a bounty.
- dantiberian 9y ago
  Yes, this is spot-on, the just published New York Times article details this: https://www.nytimes.com/2017/11/21/technology/uber-hack.html https://www.nytimes.com/2017/11/21/technology/uber-hack.html
quickthrower2 9y ago

michaelbuckbee 9y ago

IANAL but I did some basic visualization work as part of a story on US state data breach regulations. What may be Uber's undoing is that they must have the drivers license numbers for all of their drivers on file and that is considered PII by 45 states (nevermind that they also missed their reporting deadline). And if you're interested, a gif of the data: https://imgur.com/Rm32MeC https://imgur.com/Rm32MeC

ejcx 9y ago

I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story. I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the cover up.

kenbaylor 9y ago
Regarding Joe's previous behaviour: https://www.theverge.com/2016/7/10/12127638/uber-ergo-investigation-lawsuit-fraud-travis-kalanick https://www.theverge.com/2016/7/10/12127638/uber-ergo-invest... https://lawyerist.com/ubers-secret-encrypted-far-reaching-investigation-opposing-counsel/ https://lawyerist.com/ubers-secret-encrypted-far-reaching-in... A lot more will likely leak out now. Iceberg tip located.

tibbon 9y ago

I'm getting sick of this stuff. As a user of Uber (or Equifax), would I have any case if I tried to sue them for mishandling private data (I live in Massachusetts)? http://www.mass.gov/ago/doing-business-in-massachusetts/privacy-and-data-security/standards-for-the-protection-of-personal.html http://www.mass.gov/ago/doing-business-in-massachusetts/priv...

omeid2 9y ago
Maybe if you can organize a class lawsuit.

moomin 9y ago

At this point if the next headline is “Uber sold nuclear submarine secrets to China whilst kicking puppies” I won’t bat an eyelid.

yawz 9y ago

> Uber paid hackers $100,000 to delete stolen data and keep quiet Really? Really? Come on!!!

chadbennett 9y ago

Another breach that 2FA and SSO didn't stop. 81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches. Most organizations believe that 2FA and SSO are the answer but this proves they are not enough.

revelation 9y ago

Well I hope Uber asked for the hard drive shredder receipt this time around.

harry8 9y ago

Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known. The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will resign, those who take the job would actually take an interest and have the ability to do so. An idea whose time has come.

ian0 9y ago
How to implement though? You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats. Also never underestimate just how disorganised large organisations are, incompetence at addressing issues is systemic and goes far beyond data protection. What seems like malice is sometimes just plain stupidity. It has to be backed by some sort of regulatory framework. Just like a fire code or employment rights. But crafted in a way that it doesnt end up like PCI, ratings agencies or financial auditors. IE creating an industry that sells compliance and not actual security. Perhaps something light, like mandetory minimum bug-bounty schemes for all companies, where fines (or more) are imposed for not addressing issues and an independant regulator works with larger companies to resolve issues (or penalise the company severely if they deliberately wont).
- harry8 9y ago
  No, don't get hung up on unnecessary details. The reasonable company director should have known X and when found out was bound to report it. Person Y did not report it, should have known as it was their job to know and there aren't extenuating circumstances. Guilty. 6 months. Next case. "I don't know anything about this company I accept 7 figure sums to oversee as a director." Should never be any kind of legal defence. If senior management and directors have something personally at risk you'll see vastly improved behavior. Right now we're selecting for the opposite and seeing the inevitable results. There is a story like this about directors and management cover ups every single day
  - 9y ago

halflings 9y ago

They stored AWS storage credentials in clear, in a (private) Github repo... This is so baffling coming from one of the largest tech companies in the world. Among other things, this shows that they do not have proper access policies to user data (e.g anybody working at Uber can get access to any user's data), which in my opinion is a larger issue than this individual hacking case.

the_cat_kittles 9y ago
as the size of the company grows past a certain size, especially these "move fast and break things" idiots, i feel like the likelihood of this goes up. there are more and more people, someone is bound to do something stupid.
- halflings 9y ago
  The fact that this is a big company is exactly why strict access policies are necessary! I might trust a handful of administrators, or a limited set of engineers whose data access is audited, but I sure as hell would not trust thousands of engineers with my private data. Other tech companies (e.g Google) safely silo PII data, and any access has to be audited. I cannot wait before GDPR is implemented in Europe... at least companies will be seriously fined if they want to cut corners on privacy and data protection.
x0x0 9y ago
We already knew that -- viz Uber showing off their ability to track famous users at a party. see https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view-uber-allegedly-stalked-users-for-party-goers-viewing-pleasure/ https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view... https://www.cnet.com/news/god-view-under-spotlight-as-uber-investigation-intensifies/ https://www.cnet.com/news/god-view-under-spotlight-as-uber-i... and https://www.cnet.com/news/uber-lawsuit-alleges-startup-tracked-celebs-politicians/ https://www.cnet.com/news/uber-lawsuit-alleges-startup-track...
- halflings 9y ago

tabeth 9y ago

Wouldn't the easy solution to this class of problems be to require some sort of physical device to be connected to your machine in order to access certain sets of data? Assuming the device itself couldn't be spoofed, wouldn't that solve this once and for all?

leroy_masochist 9y ago

> Joe Sullivan, the outgoing security chief, spearheaded the response to the hack last year, a spokesman told Bloomberg. Sullivan, a onetime federal prosecutor who joined Uber in 2015 from Facebook Inc.... Why on earth would a software-based company like Uber that stores a boatload of confidential employee and customer information on its servers put a non-technical person of any sort, lawyer or not, in charge of its security team?

moxious 9y ago
Put a lawyer in charge when your strategy is to defend lawsuits against issues and mitigate the fallout of issues, rather than to, you know, prevent the security issues
dba7dba 9y ago
Welcome to lobbying ver, 2.0. Instead of giving cash bribe, bribe with cushy jobs with high salary and no real responsibility, since no one would expect a lawyer to understand what even to delegate to members of IT security team.
eropple 9y ago
Security, as far as a corporate entity is concerned, is fundamentally a way to reduce business and legal risk. A lawyer at the top, making those decisions with the input of technologists, seems like it should be reasonable when things are working correctly. This isn't a failure of skillset or knowledge, it's a failure of ethics and leadership. (Which should, to be clear, be punished far more severely than skill-related incompetence.)

chakalakasp 9y ago

Man, I don't know if Uber is evil or if most tech companies are evil and Uber just doesn't drop the kind of money on PR strategery that an evil company need to drop in order to seem normal. But either way, holy cow does that company come off as toxic. They've completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers (to the point that the CEO of Apple had to have a Come To Jesus talk with the CEO of Uber) or how their employees feel like they are getting screwed or, now, how they are concealing massive data breaches. It's like how I imagine Uber would be if it was run by Magneto instead of Tony Stark.

necessity 9y ago
You're watching too much CNN.
edgarvaldes 9y ago
>and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers I don't think the average Joe is up to date with this news, or even care about.
- wingworks 9y ago
  Nope, they don't know. My non-tech friends are all using Uber / UberEats with no clue about the company, and the CEO. They just see an easy to use app to get what they want quickly.
  - wallace_f 9y ago
    Speaking of politics, media influence and tech, a fair number of average joes have a terrible opinion of Musk/Tesla/SpaceX; but these same people are unaware, or maybe vaguely aware the US Gov spent >10billion, just in direct financial losses, bailing out GM. If everyone in the country was told "write a check to GM for $50 or go to jail," and conservative media wasn't berating Tesla/Musk, public opinion would be a lot different... Take it all with some healthy skepticism.

chis 9y ago

Why was this only worth 100K? How did they verify info was deleted? And how does this show up on an expense report at the end of the year?

cube00 9y ago
Security Penetration Testing
- Strom 9y ago
  What would be the tax implications of this in USA? I imagine there isn't a bill given by another entity, but this is rather a bitcoin/cash transaction. In my country this would mean this payout would be hit with all the taxes [1], pretty much doubling the cost. -- [1] Income tax, unemployment insurance, healthcare, and maybe even pension. All going to the benefit of the country as there is no identifiable human on the receiving end.
dilyevsky 9y ago
> Why was this only worth 100K? Gotta be careful dealing with company like Uber. At some price point they might just hire hitmen to kill you instead.

partycoder 9y ago

And how exactly did they verify that the hackers actually deleted the data?

hwu2whag 9y ago

Even if this was the correct way to handle such an incident, how can you be sure that once you've paid the hackers they actually destroy the data?

pcarolan 9y ago

I don't know, paying off the hackers might have been the best call. It prevented my data from being exposed into the wild vs notifying authorities which would have all but guaranteed a leak. If the objective was to protect Ubers' customers, mission accomplished. Should they have covered it up and not disclosed it? No, but this is as a tough call ethically.

seanmccann 9y ago

In about 2014 I noticed that the logged in API request, on Uber's website, included full driver info nested under the ride JSON object. It included the drivers full address, license, phone numbers, etc. They patched it a few months later, but it was the worst data leak I've seen.

yalogin 9y ago

This is exactly why the CEO should lead by example. If the CEO himself does shady stuff all the time and in fact encourages it, its normal and even expected that the hack is covered up.

developuh 9y ago

How should a startup or a company in this situation handle it properly ? Should they come out clean to their users ?

rdxm 9y ago

if the board had any self-respect they would shutter the shit-show that is uber and walk away. and yeah, that's walking away from a truckload of dough, but really, how can any board memeber look themselves in the mirror at this point? the business model is a joke, the culture is toxic, and basically its a failed experiment. i've been back channel spanked by yc moderators on this topic for some of my snarky comments on uber, but all i have to do is wait a week or two for the next shoe to drop and then, well, there you have it.. uber is the poster-child for why the broader US loathes the valley. i would love to see real innovation and advancement become a reality out of SV soon and return the storied past to a real thing. but. as long as entities like uber and theranos, etc, etc are allowed to persist that will never happen...

eeZah7Ux 9y ago

The journalist speculated about "evidence that the files were actually deleted" referring to the "hackers" deleting their copies of the extracted data. Really? Evidence of deletion?

londons_explore 9y ago

If these 'hackers' were white hat and signed a contract saying they responsibly handled and deleted the data, and then uber checked the access logs of the data and verified that nobody else accessed it, then IMO it is not a data breach. It was a potential breach. A white hat hacker you have an agreement with on how the data should be handled is the same as an employee who has access to the same data, where you also have an agreement on the employees use of the data. You might say "Ooh, but can you trust the hacker not to keep a copy of the data!?!", but it's exactly the same as saying "Can you trust the employee not to copy the data?". I don't think a company would announce a data breach just because the database administrator had access to a backup tape...

TheSpiceIsLife 9y ago
Would a more correct term be "data security consultant"?
xyzzy_plugh 9y ago
If this was the case, why the secrecy? Why did staff get fired? If it is as you describe, do you think the public would understand and react differently?
pserwylo 9y ago
What you have described makes sense only if they were originally hired as penetration testers. I think an external hack of this nature, even if done by white hat hackers, should rightfully be treated differently. Having said that, you raise an interesting point, because if this money was paid as a bug bounty, then perhaps the lines would be blurred again. I guess the difference is that a bug bounty would have more clearly defined parameters about how far the hack should go. Logging into AWS using credentials that were found lying around, then continuing on to download data, seems like it is beyond the realm of reasonable bug-bounty hunting and responsible disclosure.
openasocket 9y ago
In what world is stealing information and then holding it for ransom 'white hat'? > You might say "Ooh, but can you trust the hacker not to keep a copy of the data!?!", but it's exactly the same as saying "Can you trust the employee not to copy the data?". I trust someone I vetted and hired a hell of a lot more than the person who just extorted $100K from me.

tptacek 9y ago

Amazon's access control and authorization system is the current most important broken thing in the industry. The Joe Sullivan details are the lurid stuff that propels news story copy, but the important takeaway is that almost nobody, including companies with serious investments in security, can safely get a large-scale dev team deploying onto AWS. This story keeps getting re-told, and has been for something like 5 years now. It's a problem, and it needs to get fixed, decisively.

cddotdotslash 9y ago
Full disclosure: I'm the founder of CloudSploit[1] which aims to reduce these risks. You're definitely on to something here. While I wouldn't call AWS security "broken," it is next to impossible to implement it correctly in any medium to large size business. There are 30+ services that AWS provides, each with an infinite number of security controls, JSON-based policies, etc. Cross-service access is even worse. Almost every service has some form of sub control that extends or complements the main security tool (IAM). KMS has key policies, ECR has registry policies, SNS has delivery policies, etc. S3 has perhaps the most confusing permission policy in existence, which has led to scores of high profile hacks this year alone. There are 12+ public regions now, with more coming every few months, each fully enabled, yet segregated within the UI and API (which makes detecting attackers who have embedded themselves in unused regions more difficult). All it takes is literally one typo in a single user's policy and leaked credentials and you're environment is completely compromised. Recovery is next to impossible without basically starting from scratch because you'll never find every tiny hole the attacker left as a backdoor for later without combing through GB of CloudTrail logs. Now take all that, put it in an organization with 500+ engineers and you can see how easy it is for this to happen. Think you're safe by putting each team in their own account? Well AWS supports cross account role provisioning and engineers can easily set that up within their accounts. The spider web of issues is endless. [1] https://cloudsploit.com https://cloudsploit.com
- aptwebapps 9y ago
  > While I wouldn't call AWS security "broken," ... That doesn't match with the rest of your comment. At all. What would you call broken, then?

foobaw 9y ago

So was the stolen data deleted? This could've easily just been part of a "bug county," no? Except when you actually steal data, you're not eligible to bounty. This means the hackers had decent leverage and negotiation skills (maybe Uber could've scared them with lawyers, etc).

jimjimjim 9y ago

Someone needs to start a Top 10 Evil Corp web site. maybe a yearly most evil corp awards. because it looks like uber is relentlessly bad.

joveian 9y ago
Not quite what you are looking for but the International Labor Rights Forum does a great job of trying to change some of the worst of the worst practices around the world (unfortunately, Uber is unlikely to make a top ten list). https://ilrf.org/ https://ilrf.org/

deleted 9y ago

[deleted]

anigbrowl 9y ago

And people wonder why I keep saying that Uber needs to have its business license yanked or suffer some similarly drastic sanction or they'll just keep right on doing it and others will follow the same strategy. I mean, how often does a firm have to breach the trust of (just about) everyone it deals with before it's time to punish it in some meaningful way?

petarb 9y ago

Moral of the story, use two factor auth on GitHub and AWS to prevent unauthorized access.

kenbaylor 9y ago

And just for an FYI: California law SB1386 requires mandatory breach notification when drivers license data is stolen.... which this team knew very very well. So this was willful. Expect many more exits.

dantiberian 9y ago

From https://www.nytimes.com/2017/11/21/technology/uber-hack.html https://www.nytimes.com/2017/11/21/technology/uber-hack.html > Two hackers had stolen data about the company’s riders and drivers — including phone numbers, email addresses and names — from a third-party server, putting the personal data of more than 57 million people at risk. The hackers approached Uber and demanded $100,000 to delete their copy of the data [...]. > Uber acquiesced to the demands. Under the orders of Travis Kalanick, who was then its chief executive, and Joe Sullivan, the chief security officer, the company paid the ransom. > Then Uber went further. The company tracked down the hackers and pushed them to sign nondisclosure agreements [...]. To further conceal the damage, Uber executives also made it appear as if the payout had been part of a “bug bounty” [...].

ravirajx7 9y ago

Paying hackers good move or bad move? Or Little bit of PR as well that they can pay if they got hacked again?

gimmeminusnow2 9y ago

I feel like uber, google and facebook have competition who steal and violate peoples privacy the most.. Please, do not use these corporations services.

cmurf 9y ago

I thought it was illegal to conceal breaches. Certainly there should be disclosure requirements for publicly traded companies.

gok 9y ago

So was it bad to have paid the ransom?

aaroninsf 9y ago

"Delete" can't even lolz

sebleon 9y ago

Meh, Uber is one of the good guys, compared to other American multinationals. For starters, Chiquita Bananas intimidated farmers and union leaders with AK 47s and hired militias in Colombia [1]. [1] https://en.m.wikipedia.org/wiki/United_Fruit_Company#Aiding_and_abetting_a_terrorist_organization https://en.m.wikipedia.org/wiki/United_Fruit_Company#Aiding_...

Nicholas7900 9y ago

Some times, i don't code programs. I know that's a typical of someone perceived as a hacker, but my techniques have always been a typical. For instance, it might surprise readers to know that all of the widely publicized hacks I was involved in - let's call that the "Adrian Classic" period :p - were done using a web browser and Notepad, on dialup, on Windows 98. If you stop to think about it, this is really a true meta-hack. People who ask to learn how to hack are generally told to install Linux, learn how to code, and experiment with various hacking tools. Much how network administrators learning to secure their systems tend to get the same certifications, read many of the same books. This results in activity that's really more like jousting than hacking - a predefined pattern of attack taking place against a predefined pattern of defense. When i started Hacking, I learnt how to code, I learned to read code, and I learned how programmers thought, which assumptions they tended to make, and what mistakes their common training tended to cause them to make in common across completely different systems. One example of this is writing access code with the assumption that if failure = no then access = yes. On many systems, I found that by simply removing a username or password field, access would be automatically granted - because there had been no username or password failure, since there had been none to fail, so access was granted. Because my methods were and are unorthodox, they are rarely detected by intrusion detection systems. They don't resemble common attacks because they aren't common attacks. I often make them up on the spot. Which is why the question "teach me to hack" is so frustrating. This is particularly emphasized by a meme pic I got a Google Alert for this morning: I always give readers free Access to reach me for all kinds of Hacking Issues though : compositehacks@gmail.com

yeukhon 9y ago

How can they be sure the hackers didn’t have another copy?

jedberg 9y ago

Something about this is sitting right with me. I know Joe (the ousted CISO). I’ve known him for almost 15 years, and worked with him professionally in the past. This is not like him. He was the most ethical lawyer I ever met. Everything was by the book. He cares about privacy. He cares about users. He’s prosecuted the worst of the worst. Something here isn’t right.

bbarn 9y ago
CSO/CISOs are basically there to be the fall person in the case of a data breach. Your job is basically to implement process and policy to the point of nearly breaking productivity, then get fired when that wasn't enough.

eddieplan9 9y ago

This has been blown out of proportion. - This is not Equifax, which leaked hundreds of millions SSN; or LinkedIn, which leaked hashed password of millions[1]; or Yahoo, which leaked personal information of billions, including security questions and hashed passwords [2]; or Target, which affected 40MM credit cards [3]. "Compromised data [..] included names, email addresses and phone numbers of 50 million Uber riders around the world, [..] including some 600,000 U.S. driver’s license numbers. No Social Security numbers, credit card information, trip location details or other data were taken" - There is no gross incompetence. The breach was due to an AWS access key in a private github repo. I bet you can find enough developers in this forum who store sensitive information in private GitHub repos without git encryption, and who may or may not feel guilty, because of the (false) sense of safety given by 1) the guarantee of github private repo and 2) the fact that access keys can be revoked and are generally handled with less care. - The response by the new CEO is decisive and timely. The CSO was fired on the same day the CEO learned about the incident. There is also internal review, new advisor, and reasonable protection offered to the drivers affected, even though there is no indication the data is leaked beyond the thief, and driver license numbers are not the best for identify theft. [1] https://en.wikipedia.org/wiki/2012_LinkedIn_hack https://en.wikipedia.org/wiki/2012_LinkedIn_hack [2] https://en.wikipedia.org/wiki/Yahoo!_data_breaches https://en.wikipedia.org/wiki/Yahoo!_data_breaches [3] https://www.huffingtonpost.com/eric-dezenhall/a-look-back-at-the-target_b_7000816.html https://www.huffingtonpost.com/eric-dezenhall/a-look-back-at...

ddmma 9y ago

Massive data spill as Uber was hacked.. maybe email address is not so importat but ride history and wherever location data is something quite sensitive .. shift delete!

yuvalmer 9y ago

It seems they didn't learn from their mistakes. It sounds that the 2014 breach was caused by the same mistake. "That gist is believed to have contained a login key used by a hacker to access an internal Uber database of 50,000 drivers." https://www.theregister.co.uk/2015/02/28/uber_subpoenas_github_for_hacker_details https://www.theregister.co.uk/2015/02/28/uber_subpoenas_gith...

HaoZeke 9y ago

The problem of course is them storing private credentials on Github despite numerous highlights on the site to not do so. Private github sites are private as in hidden. Not as in digitally encrypted bank vault. What sort of tech company doesn't go for a self hosted git option anyway!? Like Gitlab which comes with CI to keep the whole thing private. Also self hosting allows an arbitrary level of security..

cooltechguy 9y ago

Thats good , on the contrary Facebook continues to steal data. One of former FB employees has confirmed that the social media giant cares more about data collection than safeguarding your information

sAbakumoff 9y ago

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site... I am wondering what private Github coding site stands for? If it is GitHub Enterprise, then how those hackers would even access it from outside of the uber network? Does it mean that they had access to Uber's VPN as well?

k__ 9y ago

lol, I just understood they stole data and then paid the hackers to delete it so nobody would suspect them spying on their users

jpkeisala 9y ago

That company just keeps giving.

jagermo 9y ago

Did they pinky-promise to delete the data? Sorry, but that is beyond naive.

marenkay 9y ago

... so honestly, at this point, we basically have another Uber thing every 2nd week. I do not get why there is no legal action taken against Uber or even steps to shut it down. So much of the stuff violate basic laws how to run a business, apart from the humongous flaws in Ubers ethics and damaging effects on society.

skybrian 9y ago
From the article: "After Uber’s disclosure Tuesday, New York Attorney General Eric Schneiderman launched an investigation into the hack, his spokeswoman Amy Spitalnick said. The company was also sued for negligence over the breach by a customer seeking class-action status."
- marenkay 9y ago
  I read that, what I do not get is how the difference in judgement can be justified. Small companies will instantly get sued and pay fees ruining them for this things. And that already the 1st time it happens. For Uber this is beyond ten finger counting in terms of issues in the past two years. It is just not having any consequences and by now from the legal side you can conclude that Uber is a repeated offender which has not learned anything from previous cases. So, my point stands. When will this actually lead to consequences and justice being served?

fastball 9y ago

Did anyone else read this title and assume that it meant Uber had stolen the data of 57M people and then paid hackers to delete it? I feel like the word "ransom" should probably be used somewhere in the title.

phillip7899 9y ago

I lost my job few months back before i notice my wife started acting up, she changed passwords to every account that she has, put a pin lock on her phone which she has never done before, i have been searching for ways to retrieve her text messages without installing any software on her phone or having access to it, I was introduced to this wonderful hacker and he hacked into my partner mobile with just her phone number only. i get to know she was cheating and all.i felt very sad about this,but it over now.all thanks to murphy.c8990@gmail.com if you need help regarding to issues like this contact him.let him know philip referred you in.

nvahalik 9y ago

Aww man. If they were smart they would have announce a bug-bounty and then just did things that way.

mikemaster2000 9y ago

Uber should be shut down for stupidity.

mannykannot 9y ago

It seems that Uber has only paid the infiltrators to say they have deleted the data. Putting aside, for the moment, all the legal and ethical issues, why would anyone at Uber imagine that this would be in the slightest bit beneficial?

odammit 9y ago

Private repo or not, checking your credentials into git is amateur. I’d normally say eventually it’d bite you if you fall into the habit and do it on a public repo by accident but it looks like it can bite you on a private one too. Manage your secrets. Use something like Vault[1] or Pass[2] they’re free and awesome projects. I keep all of my secrets even non-prod ones in one of these two because if you think about it, even your “non-prod” github credentials are kinda prod since you have access to code. 1- https://www.vaultproject.io/ https://www.vaultproject.io/ 2- https://www.passwordstore.org/ https://www.passwordstore.org/ Also when it comes to AWS secrets, give your developers read only access, make them turn on MFA and assume a role that scopes permissions to the work they need to do. Leaking AWS secrets is really asking for it. The amount of bots that consistently scan public git repos and then use the credentials to spin up massive instances to mine crypto currency is impressive. I’ve seen it do upwards of $10000 in AWS usage within five minutes of the commit containing the credentials.

sillysaurus3 9y ago
It may be amateur, but it's one of the most common mistakes. Even at top companies.
- odammit 9y ago
  Amateur may not have been the best word. Maybe easy or lazy or debt. Ive seen it a lot where it was something that was inherited and the current team knows its a problem, but they have a 1000 features to build and never get around to fixing that debt.
  - sillysaurus3 9y ago
    The cure for this is to get a pentest. It forces you to care.
zanedb 9y ago
If you still want to use a Git repo, at least use an encrypted Keybase teams repo[0]. [0]: https://keybase.io/blog/encrypted-git-for-everyone https://keybase.io/blog/encrypted-git-for-everyone

xedarius 9y ago

Missing a trick these hackers, they don't want to ask for a one of payment, they want to turn this business of theirs into a cashflow. Pay X a month and we will keep the data safe. X could be a much smaller number than 100k. As we all know they haven't deleted the data. Think of it as a security tax levied by the internets.

alehul 9y ago

Although obviously wrong on Uber's part, I'm curious: If they had informed law enforcement, could it be possible to legally pay the hackers to delete the data? Hacks of this magnitude, especially in other cases where they involve credit card information, cause millions in damages ultimately, however the black hats involved (the initial part of that chain of events) sell that data for much less. Could we cut the losses there, by paying the hackers? Would it be legal? It could be a more serious version of a bug bounty.

revmoo 9y ago

There is no hacker, the CTO (or somebody else) invented him to scam the company.

eyeareque 9y ago

I really hope Lyft can take advantage of all the mistakes Uber has made. I wonder if it is a good time to start a role at Uber or Lyft? I’m not sure which one I would pick.

BinaryIdiot 9y ago

Whoa, Uber even had the hackers sign an NDA? Like, what were they going to do if the hackers broke the NDA? That's just...insanity. The fact that Travis knew about it as well smells like he could face charges. https://www.nytimes.com/2017/11/21/technology/uber-hack.html https://www.nytimes.com/2017/11/21/technology/uber-hack.html

philip7899 9y ago

0898 9y ago

How did they know they'd delete it?

p3t3rp4n 9y ago

These type of people actually have driving licences ...