5 ms·

Former Uber Security Chief Charged with Concealing Hack

72 points by tempsy 6y ago

EE84M3i 6y ago
Isn't Joe Sullivan the CISO at Cloudflare now? Edit: Yes. https://twitter.com/eastdakota/status/1296522269313785862?s=19 https://twitter.com/eastdakota/status/1296522269313785862?s=... Edit2: full indictment https://www.justice.gov/usao-ndca/press-release/file/1306781/download https://www.justice.gov/usao-ndca/press-release/file/1306781...
- natcombs 6y ago
  Yes, that's correct. Though, I imagine Cloudflare will distance themselves now. Here's his "why I am joining Cloudflare " post: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/ He was also a member of Obama's "Commission on Enhancing National Cybersecurity" : https://obamawhitehouse.archives.gov/the-press-office/2016/04/13/president-obama-announces-more-key-administration-posts https://obamawhitehouse.archives.gov/the-press-office/2016/0...
- chubot 6y ago
  Not sure why the sibling comment was marked dead. It was a relevant response: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/
  - Scramblejams 6y ago
    Yes, I'm curious about that. Vouched.
- chubot 6y ago
  That makes sense as CloudFlare also has a history of minimizing important security breaches, like when they sprayed their customer's and customer's customer's private data all over the Internet: https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare Tavis Ormandy said: I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me. They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c16 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c19 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Maybe that was before this guy's tenure, not sure. The point is that most companies do this, and users and customers should push back on it.
  - EE84M3i 6y ago
    >Maybe that was before this guy's tenure, not sure. That predates him joining Cloudflare, as far as I can tell.
    - JakeTheAndroid 6y ago
      I believe the parent implication is that he aligns with CF's way of doing business in regards to disclosure of security issues.
  - user5994461 6y ago
    CloudFlare fixed the vulnerability in what? One week? As much as cloudflare downplayed the vulnerability, it's nothing in comparison to how much researchers overplayed it. If people really gave a shit about the impact on the poor affected innocents, the best thing to do was to fix it silently and wait 30 days for internet caches to clear before disclosing. Also raise an immediate deletion request to google on the 100 or so affected pages it stored in cache, that's ridiculously little compared to the alleged impact.
waihtis 6y ago
This is still baffling. To have that many records leak, and try to play a hush-hush strategy AND pay the hackers makes no sense at all, especially from a former federal prosecutor standpoint. There’s more to this story that is being told to the public.
- stefan_ 6y ago
  There was an ongoing FTC investigation into a S3 data breach from 2014. At around the same time they were trying to argue how very sophisticated their security practices now were after hiring Joe, this 2016 breach occurred, again from unprotected S3 data. Disclosing it would have obviously doomed the efforts to end the FTC investigation (escalated it in fact) and of course put his ongoing tenure as CSO in jeopardy. So, no, this is just run of the mill executive cover-up. The only reason there is a federal charge here is because he lied to the FTC to make it happen.
  - waihtis 6y ago
    I just find it difficult to see why the CSO would take such a big personal liability onto himself, but I guess we’ve seen some funky actions around the big startups elsewhere..
thrownaway954 6y ago
anyone have a non-paywall version edit: found one: https://www.npr.org/2020/08/20/904113981/former-uber-executive-charged-with-paying-hush-money-to-conceal-massive-breach https://www.npr.org/2020/08/20/904113981/former-uber-executi...
- everybodyknows 6y ago
  > also concealed it from many other Uber employees, including top management — with one exception. According to the complaint, Uber's CEO at the time, Travis Kalanick. So, COO kept in the dark. Is "Need-to-Know basis only" standard corporate cover-up practice?
- FanaHOVA 6y ago
  https://chrome.google.com/webstore/detail/archive-page/gcaimhkfmliahedmeklebabdgagipbia?hl=en-US https://chrome.google.com/webstore/detail/archive-page/gcaim...
skim_milk 6y ago
Will this change anything? Every last place I have ever worked at I am 100% certain concealed successful hacks in the past either internally for political purposes or purposefully externally for PR purposes. I still think it should be on the shareholders to hire brutally honest employees and CXX's or face the consequences of fines from employees concealing successful hacks. Don't put stress of having to manage expectations of greedy shareholders that don't want to hear about hacks and having the threat of some prosecutor somewhere drawing their own grey blurry line in the sand and saying you crossed it. That stress should 100% be on the shareholders - they will have to make sure to hire the right people and make the right culture that won't conceal hacks for internal, political purposes and external PR purposes. If we're going to keep ignoring corporate law and go after employees for their own mistakes, we're never going to fix our objectively awful collective security culture in our tech companies where we work and we're never going to hold greedy shareholders for the shit they could have prevented by fixing their employees' security culture.
jamestimmins 6y ago
From the affadavit: Records further indicate Uber’s management team, with the sole exception of Uber’s C.E.O. at the time, had no contemporaneous knowledge of the details of the data breach and had no role in the decision to treat the breach under the Bug Bounty program. Does this suggest that Travis might be guilty as well?
paxys 6y ago
I would like to hear about ONE thing Uber did during Travis's tenure that wasn't completely shady.
- godzillabrennus 6y ago
  They vastly improved the transportation industry from the standard that cab companies had set...
schoolornot 6y ago
I'm having a really hard time understanding the legalese around these charges. In 2014 Uber was hacked and the FTC opened an investigation In 2016 Uber was hacked again but Sullivan supposedly didn't disclose this to the FTC * Why would he be compelled to disclose information to the FTC about an incident unrelated to the one being investigated? * The charge of "Misprision of felony" is new to me: https://www.law.cornell.edu/uscode/text/18/4 https://www.law.cornell.edu/uscode/text/18/4 Since when does anyone have an obligation to report felonies to law enforcement? If I overhear some kids planning to burglarize a house, I have a legal obligation to report that? Isn't freedom of speech involved here?
- hpoe 6y ago
  Matt Levine explains it well by summarizing that in the US. "Everything is security fraud".
- ftf87 6y ago
  > If I overhear some kids planning to burglarize a house, I have a legal obligation to report that? No, because you did not become aware of the commission of a felony. If you overheard those same kids discussing a murder they had committed, yes, you are legally liable if you sit on that. Isn’t this common knowledge?
  - emiliobumachar 6y ago
    Excuse me, I did not get it. Is burglary not a felony? Is it about past vs. future?
    - meddlepal 6y ago
      Past vs future.
    - ftf87 6y ago
      The distinction comes down to whether something rises to the level of conspiracy, if you were hypothetically aware of a crime before it was committed. Beside that, however, burglary in the United States is not a federal felony, which is the specific charge being discussed here. I shared a general legal principle. If you become aware of the commission of a felony and leave a significant amount of evidence showing that you intended to conceal it, it’s absolutely open and shut, and you will be treated as an accomplice. All Americans have a duty, whether they like it or not, to disclose commission of a crime for investigation. Failure to do so can lead to liability down one of several paths. This is one of them. Freedom of speech is completely irrelevant.

72 points by tempsy 6y ago

Isn't Joe Sullivan the CISO at Cloudflare now? Edit: Yes. https://twitter.com/eastdakota/status/1296522269313785862?s=19 https://twitter.com/eastdakota/status/1296522269313785862?s=... Edit2: full indictment https://www.justice.gov/usao-ndca/press-release/file/1306781/download https://www.justice.gov/usao-ndca/press-release/file/1306781...

natcombs 6y ago
Yes, that's correct. Though, I imagine Cloudflare will distance themselves now. Here's his "why I am joining Cloudflare " post: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/ He was also a member of Obama's "Commission on Enhancing National Cybersecurity" : https://obamawhitehouse.archives.gov/the-press-office/2016/04/13/president-obama-announces-more-key-administration-posts https://obamawhitehouse.archives.gov/the-press-office/2016/0...
chubot 6y ago
Not sure why the sibling comment was marked dead. It was a relevant response: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/
- Scramblejams 6y ago
  Yes, I'm curious about that. Vouched.
chubot 6y ago
That makes sense as CloudFlare also has a history of minimizing important security breaches, like when they sprayed their customer's and customer's customer's private data all over the Internet: https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare Tavis Ormandy said: I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me. They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c16 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c19 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Maybe that was before this guy's tenure, not sure. The point is that most companies do this, and users and customers should push back on it.
- EE84M3i 6y ago
  >Maybe that was before this guy's tenure, not sure. That predates him joining Cloudflare, as far as I can tell.
  - JakeTheAndroid 6y ago
    I believe the parent implication is that he aligns with CF's way of doing business in regards to disclosure of security issues.
- user5994461 6y ago
  CloudFlare fixed the vulnerability in what? One week? As much as cloudflare downplayed the vulnerability, it's nothing in comparison to how much researchers overplayed it. If people really gave a shit about the impact on the poor affected innocents, the best thing to do was to fix it silently and wait 30 days for internet caches to clear before disclosing. Also raise an immediate deletion request to google on the 100 or so affected pages it stored in cache, that's ridiculously little compared to the alleged impact.

waihtis 6y ago

This is still baffling. To have that many records leak, and try to play a hush-hush strategy AND pay the hackers makes no sense at all, especially from a former federal prosecutor standpoint. There’s more to this story that is being told to the public.

stefan_ 6y ago
There was an ongoing FTC investigation into a S3 data breach from 2014. At around the same time they were trying to argue how very sophisticated their security practices now were after hiring Joe, this 2016 breach occurred, again from unprotected S3 data. Disclosing it would have obviously doomed the efforts to end the FTC investigation (escalated it in fact) and of course put his ongoing tenure as CSO in jeopardy. So, no, this is just run of the mill executive cover-up. The only reason there is a federal charge here is because he lied to the FTC to make it happen.
- waihtis 6y ago
  I just find it difficult to see why the CSO would take such a big personal liability onto himself, but I guess we’ve seen some funky actions around the big startups elsewhere..

thrownaway954 6y ago

anyone have a non-paywall version edit: found one: https://www.npr.org/2020/08/20/904113981/former-uber-executive-charged-with-paying-hush-money-to-conceal-massive-breach https://www.npr.org/2020/08/20/904113981/former-uber-executi...

everybodyknows 6y ago
> also concealed it from many other Uber employees, including top management — with one exception. According to the complaint, Uber's CEO at the time, Travis Kalanick. So, COO kept in the dark. Is "Need-to-Know basis only" standard corporate cover-up practice?
FanaHOVA 6y ago
https://chrome.google.com/webstore/detail/archive-page/gcaimhkfmliahedmeklebabdgagipbia?hl=en-US https://chrome.google.com/webstore/detail/archive-page/gcaim...

skim_milk 6y ago

Will this change anything? Every last place I have ever worked at I am 100% certain concealed successful hacks in the past either internally for political purposes or purposefully externally for PR purposes. I still think it should be on the shareholders to hire brutally honest employees and CXX's or face the consequences of fines from employees concealing successful hacks. Don't put stress of having to manage expectations of greedy shareholders that don't want to hear about hacks and having the threat of some prosecutor somewhere drawing their own grey blurry line in the sand and saying you crossed it. That stress should 100% be on the shareholders - they will have to make sure to hire the right people and make the right culture that won't conceal hacks for internal, political purposes and external PR purposes. If we're going to keep ignoring corporate law and go after employees for their own mistakes, we're never going to fix our objectively awful collective security culture in our tech companies where we work and we're never going to hold greedy shareholders for the shit they could have prevented by fixing their employees' security culture.

jamestimmins 6y ago

From the affadavit: Records further indicate Uber’s management team, with the sole exception of Uber’s C.E.O. at the time, had no contemporaneous knowledge of the details of the data breach and had no role in the decision to treat the breach under the Bug Bounty program. Does this suggest that Travis might be guilty as well?

paxys 6y ago

I would like to hear about ONE thing Uber did during Travis's tenure that wasn't completely shady.

godzillabrennus 6y ago
They vastly improved the transportation industry from the standard that cab companies had set...

schoolornot 6y ago

I'm having a really hard time understanding the legalese around these charges. In 2014 Uber was hacked and the FTC opened an investigation In 2016 Uber was hacked again but Sullivan supposedly didn't disclose this to the FTC * Why would he be compelled to disclose information to the FTC about an incident unrelated to the one being investigated? * The charge of "Misprision of felony" is new to me: https://www.law.cornell.edu/uscode/text/18/4 https://www.law.cornell.edu/uscode/text/18/4 Since when does anyone have an obligation to report felonies to law enforcement? If I overhear some kids planning to burglarize a house, I have a legal obligation to report that? Isn't freedom of speech involved here?

hpoe 6y ago
Matt Levine explains it well by summarizing that in the US. "Everything is security fraud".
ftf87 6y ago
> If I overhear some kids planning to burglarize a house, I have a legal obligation to report that? No, because you did not become aware of the commission of a felony. If you overheard those same kids discussing a murder they had committed, yes, you are legally liable if you sit on that. Isn’t this common knowledge?
- emiliobumachar 6y ago
  Excuse me, I did not get it. Is burglary not a felony? Is it about past vs. future?
  - meddlepal 6y ago
    Past vs future.
  - ftf87 6y ago
    The distinction comes down to whether something rises to the level of conspiracy, if you were hypothetically aware of a crime before it was committed. Beside that, however, burglary in the United States is not a federal felony, which is the specific charge being discussed here. I shared a general legal principle. If you become aware of the commission of a felony and leave a significant amount of evidence showing that you intended to conceal it, it’s absolutely open and shut, and you will be treated as an accomplice. All Americans have a duty, whether they like it or not, to disclose commission of a crime for investigation. Failure to do so can lead to liability down one of several paths. This is one of them. Freedom of speech is completely irrelevant.