5 ms·

The person who posted the link says they were the one who broke into Uber recently. > My previous work: https://www.nytimes.com/2022/09/15/technology/uber-hack

by atfzl 4y ago

The person who posted the link says they were the one who broke into Uber recently. > My previous work: https://www.nytimes.com/2022/09/15/technology/uber-hacking-breach.html https://www.nytimes.com/2022/09/15/technology/uber-hacking-b...

Bayart 4y ago
> The hacker, who provided screenshots of internal Uber systems to demonstrate his access, said that he was 18 years old and had been working on his cybersecurity skills for several years. He said he had broken into Uber’s systems because the company had weak security. In the Slack message that announced the breach, the person also said Uber drivers should receive higher pay. Seems like a nice kid. I hope he doesn't get caught in litigations.
- KronisLV 4y ago
  > I hope he doesn't get caught in litigations. If you ever discover vulnerabilities, responsible disclosure seems like the only way to try to keep yourself out of trouble and even then only if ignorant people in the company/lawmakers won't misconstrue what has happened and want to put you in jail regardless. Going on the company Slack, announcing that you're a hacker who has stolen data and finishing your messages with something negative about the company does not seem to be a good way of doing that: > Hi @here > I announce i am a hacker and uber has suffered a data breach. > Slack has been stolen, confidential data with Confluence, stash and 2 monorepos from phabricator have also been stolen, along with secrets from sneakers. > #uberunderpaisdrives That feels like opening yourself up to being treated as a criminal, especially if you post about it elsewhere (like social media) and the "breach" gets attention, which might negatively impact the stock price of the company in question. It's good that many companies out there have bug bounties and hopefully InfoSec will be improved as a consequence of this, but there are better ways about achieving the same result, without putting yourself at so much risk.
  - that_guy_iain 4y ago
    Well, considering what they did was a crime. Being treated like a criminal seems fair.
    - KronisLV 4y ago
      Indeed, which is unfortunate, since there already is a better way to go about this (in most cases): https://hackerone.com/uber?type=team https://hackerone.com/uber?type=team Except for the social engineering aspect, in regards to acquiring the credentials, however. Which makes the situation even more problematic.
      - parkingrift 4y ago
        This kind found a power shell script on a shared drive with plain text admin credentials to practically every internal Uber system. How exactly is anyone supposed to submit a bug bounty for that?
      - that_guy_iain 4y ago
        I’m not sure why people are acting like this was anything but a criminal act that was from beginning to end anything but a security researcher. Just because it was a teen whole wrote that they stole things.
        deleted 4y ago
        [deleted]
      - 878654Tom 4y ago
        I sometimes do these bug bounties and some of these are just... I mean Uber critical max payout is... $15.000. These are bugs that leak out client data and could possible damage the company for millions. I've had companies that argued with me that loss of client data wasn't critical but minor. Some even just give a bounty of $250. Not that this excuses the behavior of hackers leaking confidential data but companies easily pay millions for anti-virus software that only detects well-known viruses but skimp on zero-days in their own software.
- i_like_apis 4y ago
  Screw that kid. Not even grey hat activity.
- 10x_contrarian 4y ago
  They also apparently posted the n-word in company chat and redirected all internal tools to a graphic shock image. Nice kid indeed.
- deleted 4y ago
  [deleted]
Tiberium 4y ago
I am kind of skeptical - the original author of the GTA 6 leak left a Telegram username to contact him, but that Telegram account was only registered today/yesterday (ID 5731422660), so it might as well be someone else who's trying to impersonate that Uber hacker. Or it could simply be that his older account got lost/blocked/something else so he made a new one :)

by atfzl 4y ago

Bayart 4y ago

> The hacker, who provided screenshots of internal Uber systems to demonstrate his access, said that he was 18 years old and had been working on his cybersecurity skills for several years. He said he had broken into Uber’s systems because the company had weak security. In the Slack message that announced the breach, the person also said Uber drivers should receive higher pay. Seems like a nice kid. I hope he doesn't get caught in litigations.

KronisLV 4y ago
> I hope he doesn't get caught in litigations. If you ever discover vulnerabilities, responsible disclosure seems like the only way to try to keep yourself out of trouble and even then only if ignorant people in the company/lawmakers won't misconstrue what has happened and want to put you in jail regardless. Going on the company Slack, announcing that you're a hacker who has stolen data and finishing your messages with something negative about the company does not seem to be a good way of doing that: > Hi @here > I announce i am a hacker and uber has suffered a data breach. > Slack has been stolen, confidential data with Confluence, stash and 2 monorepos from phabricator have also been stolen, along with secrets from sneakers. > #uberunderpaisdrives That feels like opening yourself up to being treated as a criminal, especially if you post about it elsewhere (like social media) and the "breach" gets attention, which might negatively impact the stock price of the company in question. It's good that many companies out there have bug bounties and hopefully InfoSec will be improved as a consequence of this, but there are better ways about achieving the same result, without putting yourself at so much risk.
- that_guy_iain 4y ago
  Well, considering what they did was a crime. Being treated like a criminal seems fair.
  - KronisLV 4y ago
    Indeed, which is unfortunate, since there already is a better way to go about this (in most cases): https://hackerone.com/uber?type=team https://hackerone.com/uber?type=team Except for the social engineering aspect, in regards to acquiring the credentials, however. Which makes the situation even more problematic.
    - parkingrift 4y ago
      This kind found a power shell script on a shared drive with plain text admin credentials to practically every internal Uber system. How exactly is anyone supposed to submit a bug bounty for that?
    - that_guy_iain 4y ago
      I’m not sure why people are acting like this was anything but a criminal act that was from beginning to end anything but a security researcher. Just because it was a teen whole wrote that they stole things.
      - deleted 4y ago
        [deleted]
    - 878654Tom 4y ago
      I sometimes do these bug bounties and some of these are just... I mean Uber critical max payout is... $15.000. These are bugs that leak out client data and could possible damage the company for millions. I've had companies that argued with me that loss of client data wasn't critical but minor. Some even just give a bounty of $250. Not that this excuses the behavior of hackers leaking confidential data but companies easily pay millions for anti-virus software that only detects well-known viruses but skimp on zero-days in their own software.
i_like_apis 4y ago
Screw that kid. Not even grey hat activity.
10x_contrarian 4y ago
They also apparently posted the n-word in company chat and redirected all internal tools to a graphic shock image. Nice kid indeed.
deleted 4y ago
[deleted]

Tiberium 4y ago

I am kind of skeptical - the original author of the GTA 6 leak left a Telegram username to contact him, but that Telegram account was only registered today/yesterday (ID 5731422660), so it might as well be someone else who's trying to impersonate that Uber hacker. Or it could simply be that his older account got lost/blocked/something else so he made a new one :)