3 ms·

Just read the federal complaint, my highlights and summary: - Hackers downloaded a bunch of PII from Uber - Uber CISO paid them a 100k bounty with bitcoin to

by cwkoss 6y ago

Just read the federal complaint, my highlights and summary: - Hackers downloaded a bunch of PII from Uber - Uber CISO paid them a 100k bounty with bitcoin to sign an NDA with their hacking handles, but they wouldn't give real names - Uber staff traced them down, found their real names, then met them in person and got them to sign NDAs with real names - FTC is mad because CISO tried to make it seem like it wasn't a data breach vs bug report through the bounty program. - Their 2014 breach was from "an AWS access ID and secret key in software code posted to GitHub" - In 2016 to FTC "SULLIVAN elaborated that it was common at the time to write access IDs and other secrets directly into code when that code needed to call for information from another service." - oof - SULLIVAN received an email from “johndoughs@protonmail.com” claiming to have found a “major vulnerability in uber,” and that “I was able to dump uber database and many other things.” - in 2016 breach, the hackers used to stolen credentials to... get the AWS keys that were still in their github code, but was now private -"Similarly, Uber argued that the industry at large had become more adept since 2014 at protecting private data in the cloud, and that Uber should not be judged for “what a company did then (back when the company was much smaller and the technology at issue was evolving) according to the standards that the agency thinks are appropriate now (given the current sophistication of the company and current industry best practices).” Uber made these arguments via letter in April 2017, approximately five months after the 2016 Breach." https://assets.documentcloud.org/documents/7041237/Joseph-Sullivan-Complaint.pdf https://assets.documentcloud.org/documents/7041237/Joseph-Su...

ashearer 6y ago
> "Similarly, Uber argued that the industry at large had become more adept since 2014 at protecting private data in the cloud, and that Uber should not be judged for “what a company did then (back when the company was much smaller and the technology at issue was evolving) according to the standards that the agency thinks are appropriate now (given the current sophistication of the company and current industry best practices).” Uber made these arguments via letter in April 2017, approximately five months after the 2016 Breach." I've been hearing this argument for decades, and every time it's been earnest but transparent blame-shifting. "The industry didn't understand security risks back then." "No one could have predicted this." The risks were well known back then by anyone who cared about risks.
- rorykoehler 6y ago
  Companies don't give a shit about security until it's too late. Security is a complex beast and I have yet to meet a developer who understands it top to bottom (nor should they but I would expect even juniors to know they should not store creds in the git repo). It's an increasing specialist role that startups rarely hire for because they're focusing on survival and growth so it's to be expected this story will repeat ad nausea.
piva00 6y ago
In 2015 I was rolling out Hashicorp's vault to deal with secrets management in a small Brazilian startup, I believe that Uber 2014 had the engineering resources to deal with this issue much better than my two-men team could.
- rorykoehler 6y ago
  Did you become a big startup?

by cwkoss 6y ago

ashearer 6y ago

> "Similarly, Uber argued that the industry at large had become more adept since 2014 at protecting private data in the cloud, and that Uber should not be judged for “what a company did then (back when the company was much smaller and the technology at issue was evolving) according to the standards that the agency thinks are appropriate now (given the current sophistication of the company and current industry best practices).” Uber made these arguments via letter in April 2017, approximately five months after the 2016 Breach." I've been hearing this argument for decades, and every time it's been earnest but transparent blame-shifting. "The industry didn't understand security risks back then." "No one could have predicted this." The risks were well known back then by anyone who cared about risks.

rorykoehler 6y ago
Companies don't give a shit about security until it's too late. Security is a complex beast and I have yet to meet a developer who understands it top to bottom (nor should they but I would expect even juniors to know they should not store creds in the git repo). It's an increasing specialist role that startups rarely hire for because they're focusing on survival and growth so it's to be expected this story will repeat ad nausea.

piva00 6y ago

In 2015 I was rolling out Hashicorp's vault to deal with secrets management in a small Brazilian startup, I believe that Uber 2014 had the engineering resources to deal with this issue much better than my two-men team could.

rorykoehler 6y ago
Did you become a big startup?