15 ms·
Ask HN: Have you taken action regarding the Uber hack?
Either personal (like asking your bank to revoke all cards you used with Uber) or work-related (recheck your security posture so that you won't have a Uber-level catastrophe)?
- Traubenfuchs 4y agoWhat harm can be done to me, as an uber user that has their cc data in the uber system by this? Is my credit card information compromised in a way that allows attackers stealing my money?
- thr0wnawaytod4y 4y agoPotentially yes, very likely yes it seems.
- theonething 4y agoHow so? Any more details you can provide about how CC data might be compromised in this case?
- gonchi 4y agoIt shouldn’t be an issue given that for compliance reasons they don’t store credit card data and instead use a third party, and even if they got access to the API keys for that provider, they shouldn’t have access to enough data to somehow use your card.
- ensignavenger 4y agoSteal your money? No. Steal the banks money, using your account details to defraud a bank, possibly createing a headache for you? Maybe.
- rr808 4y agoSo many leaks I've given up caring. Actually I haven't had any fraud for a few years now, it feels like getting better? I do rely on Amex now which seems much easier to cancel any transaction.
- Raed667 4y agoNot yet, I use a unique email and password for Uber. It sucks for my phone number but it won't be the first hack/leak where it is shown next to my name. Not sure about the scope of the hack so I won't be canceling my card yet.
- traceroute66 4y agoSitting here pleased I continually refused to open an Uber account or have anything to do with them.
- scarface74 4y agoYes, because I’m sure none of the places you do business with have ever been compromised.
- gregw2 4y agoThat's true. But like the parent poster, I'm likewise glad I had avoided using them. What I hated about Uber and why I never ended up using it was that their app wanted so much info from my phone for no discernibly good reason. And Lyft didn't seem to be much better. I just wanted a ride man, I didn't want a 500 MB app that sucked all the data out of my phone and sent it to god knows where. So I've just ended up calling taxis. It's not that your data won't get compromised by someone else, it's just about mitigating the exposure. I acknowledge my tradeoffs wouldn't make sense for a frequent traveller.
- scarface74 4y agoWhat data can app get from you that you don’t specifically allow? The Uber app only knows my location while I’m using it. If I choose not to give it my credit card number, I can just pay using Apple Pay and they have a one time use credit card. Not to mention with Uber/Lyft, I know exactly where my driver is, I don’t have to flag down a taxi, I know the price before I sit in the car, etc.
- psnatch 4y ago500MB? On what platform?
- jonas-w 4y agoIn the play store it says 67.65MB "Download Size". And in the apple appstore it says 363MB size. I don't know if apple calculates the unpacked and installed size or if it is the "download size" too.
- rat9988 4y agoNo action. I'm rarely anxious so it doesn't bother me.
- greggsy 4y agoAgreed. The financial aspect doesn’t bother me as it is very likely that action can be taken to prevent future misuse, and reparations can be made for past abuse. Drivers seem to be hit with a PII breach though, and I’d have concerns if pickup and drop off locations were exposed, particularly for those where that information might be sensitive (e.g. journalists in some jurisdictions).
- ThePowerOfFuet 4y agoFor those who aren't aware: https://theguardian.com/technology/2022/sep/15/uber-computer-network-hack-report https://theguardian.com/technology/2022/sep/15/uber-computer...
- sentrysapper 4y agoHN thread on the latest Uber hack for those in need of context: https://news.ycombinator.com/item?id=32860728 https://news.ycombinator.com/item?id=32860728
- ryankrage77 4y agoWent to try to delete my account, can't login because SMS 2FA doesn't seem to be working.
- theginger 4y agoIs it likely to affect Uber eats or are they completely separate?
- quadral 4y agoMost likely Uber Eats as well. I use both apps and my account is linked between both of them.
- tomaszsobota 4y agoWell now that you mention it, I enabled 2FA :awkward:
- sp332 4y agoGood, but the attacker spammed 2FA requests at an employee until they convinced them to accept one. Other than FIDO I think, most forms of 2FA are vulnerable to this.
- worble 4y agoI'm not sure what you mean, unless they have access to my 2FA app how can they get access to my codes?
- bdsa 4y agoBy setting up a dummy login screen that you unwittingly enter a valid code into (which I believe is the current best guess for how it was achieved in this case.)
- SargeDebian 4y agoSome corporate 2FA apps send a push notification to a mobile device. Because of how that is set up, it doesn't always (A) show what the login is for because it shows the name of the SSO app instead of the actual application, (B) show other correct data, e.g. if the user is on a VPN, the location may be the VPN endpoint because of IP-address based locations, and (C) it doesn't always show on the user's device that a login needs to take place, because it may be an Exchange connection refreshing periodically in the background So, some people just accept whatever pushes they get.
- sp332 4y agoSee this screenshot https://mobile.twitter.com/GossiTheDog/status/1570717994397073410/photo/1 https://mobile.twitter.com/GossiTheDog/status/15707179943970...
- amalcon 4y agoYou can obviously rate limit the requests, and there are other tricks as well. I tend to think FIDO is better than push notifications for other (related) reasons, but it's not impossible to mitigate this kind of attack.
- graderjs 4y agoThe vibe I get is this is an internal compromise. Disgruntled employee, maybe looking for evidence of upcoming layoffs, doesn't find them, now makes it look like "a hacker".
- lawgimenez 4y agoCurrently there is an 18 year old hacker bragging everywhere on the internet and seems he/she has no clue what to do with his/her newfound god mode.
- graderjs 4y agoYeah I heard that. I read on Techcrunch. Do you have any links to this person?
- lawgimenez 4y agoNone, no idea.
- rroot 4y agoPCI standard requires them to report the incident. I think most card issuers would close the affected cards (my bank had done that a few times, rather annoyingly without telling!)
- yreg 4y agoI'm not pre-emptively revoking my card either. In this case the decision should be up to the issuer, not me. They have more or at least the same information as me and it's their money that's at risk.
- matwood 4y agoI always used Apple Pay to pay for Uber rides, so I'm not sure there's any card # to be stolen. I'm sure someone who knows better than I do will chime in :)
- deleted 4y ago[deleted]
- xyst 4y agoI never drove for Uber nor worked as a corporate employee (no risk for SSN leak). Have only used them as a customer. I only paid for their services using Apple Pay. Even if that number was compromised, the CVV would no longer be valid. I think most banks would automatically re-issue the account number (not the physical card number) if they detect fraudulent use. The only time I saved a card to Uber was before the NFC era (pre-2015/2016). Those cards have long been removed from the account and have expired. I am not too worried. Worst case scenario, they have my address and name. Which are both publicly available anyways. Although maybe I shouldn’t be too complacent. If the data is sold, then it will make me more vulnerable to social engineering attacks. Albeit knowing Uber has been hacked I will be much more aware.
- aconbere 4y agoWith apple pay your card number is never even sent to uber. Apple generates a unique virtual card number every time you use it.
- fishnchips 4y agoYes, we are running a wargame at work trying to replicate this scenario in our setup.
- pc86 4y agook?
- sp332 4y agoYeah, I'm considering an audit for hard coded passwords.
- sixhobbits 4y agoI was dumb and they have details for two physical cards + a virtual card that I use in a few other places + my personal phone number that is still pretty hard to find + my personal email address as I used 'sign in with Google' when I recently set it up in a rush instead of my normal 'services/spam' email :( So yeah not great, but also too much effort to pre-emptively revoke anything so I'll just hope that the fallout isn't too bad.
- swyx 4y agoalso the credit card security model has fraud protection built in so just gotta look out on the monthly statements
- rdl 4y agoGoing to wage jihad on everything less than FIDO2/WebAuthn in any org where I'm affiliated; previously people were pushing for using push-auth shit (e.g. Microsoft Authenticator) as an option. Previous jihads against hardcoded credentials (use Vault or equivalent). Next target after this will probably be Slack.
- qwertyuiop_ 4y agoI get the spirit of your conversation but I urge you to not normalize a term like jihad. It’s sole purpose is to exterminate people by means of brutal violence who don’t fall in line in the name of religion.
- inawarminister 4y agoPretty weird since in the original language it just means Struggle. Cleaner connotation than the western equivalent 'Crusade' which is used secularly all the time tbh.
- allisdust 4y agoIt's simply a matter of how many people are affected by jihad vs crusade in the last few decades. This is the first time I'm seeing jihad used in something not associated with terrorism.
- profile53 4y agoA drink called the Irish car bomb can be readily ordered anywhere in the US, despite brutal killings in the 80s-90s. Use of a term is oft separated from the historical connotations of it.
- soco 4y agoSlack had it already in 2015...
- rdl 4y ago
- iLoveOncall 4y agoWhy are you assuming that any sensitive information about customers have been compromised? Uber is legally required to report to its users what is at risk of having been stolen, and so far they haven't said anything. Canceling cards preemptively is a nuclear option.
- doodlesdev 4y agoAbsence of proof is not proof of absence. Uber has no fucking idea what's happening, just like Heroku a few months ago. They got completelly pwned. Assume everything has been leaked.
- latexr 4y ago> Uber is legally required Uber is infamous for not following the law¹. There is at least one other known case of them not disclosing a data leak²: > In 2016, hackers stole information from 57 million driver and rider accounts and then approached Uber and demanded $100,000 to delete their copy of the data. Uber arranged the payment but kept the breach a secret for more than a year. ¹ https://www.theguardian.com/news/2022/jul/10/uber-files-leak-reveals-global-lobbying-campaign https://www.theguardian.com/news/2022/jul/10/uber-files-leak... ² https://www.nytimes.com/2022/09/15/technology/uber-hacking-breach.html https://www.nytimes.com/2022/09/15/technology/uber-hacking-b...
- bloqs 4y agoDo we know if the details were stored in a format I need to worry about? If their protocols are in place surely a breach is just high level PII
- thr0wnawaytod4y 4y ago?!
- bloqs 4y agoAs in, not plaintext passwords.
- michaelwww 4y agoI drove for Uber a couple of years ago. They have my DL and bank routing number. Should I be worried?
- booboofixer 4y agoI did too, don't they also have a picture of your ID they took when you signed up, for "verification purposes"?
- michaelwww 4y agoYes they have a picture of my ID. They have quite a big of info about me since did a background check
- nikau 4y agoThis is why you should watermark any ID images with something like "FOR UBER USE ONLY SEPTEMBER 2022" in a wavy distorted font.
- michaelwww 4y agoI'm setting up a savings account that they can't get at online
- deleted 4y ago[deleted]
- champagnepapi 4y agoI just changed my password, and i had 2FA turned on already, that's about it... Any recommendations?
- lr1970 4y ago> [From the end of the article] Lawyers for Mr. Sullivan have argued that other employees were responsible for regulatory disclosures and said the company had scapegoated Mr. Sullivan. Unless and until CEOs are held personally responsible for such security breaches there will be no solution to the problem. A Chief Security Officer job looks more and more as a designated scape-goat for hire.
- GuB-42 4y agoIt is an idea I hear often, but I don't think it will solve anything. The CEO will be the scapegoat, and may get paid better for the risk taken. So having a CEO scapegoat or a CSO scapegoat, same thing. You have to realize that a CEO is just an employee. An important employee, but like any other employee, he is paid to do a job, and can be fired if his employers are not satisfied with his work. If we want to punish the people who have the ultimate responsibility, that would be the shareholders. And it may include you if you have stock in that company. The CEO could also be punished as a shareholder (CEOs usually are), but not as a CEO unless he commit fraud against the shareholders. We could imagine prison sentences for the most important shareholders, but really, financial sanctions are the most fair. Shareholders will lose money proportional to their share. And if the CEO really is the problem, shareholders will be very unhappy and he won't last long and may even get sued.
- bmitc 4y agoIt's interesting that if you commit crimes or harm, whether intentional or not, but in the aggregate, at scale, etc. that you can get away with it or just be fined. Be a single employee that accidentally or intentionally leaks information, particularly company or government information, and you'll be sued to oblivion. Or imagine being a lower or middle class person charged with a crime or have a civil suit brought against you and all you get is a like $20 fine.
- derwiki 4y agoI filed a CCPA delete request for Uber a few month back—feeling good about that now!
- auslegung 4y ago