3 ms·

Well, considering what they did was a crime. Being treated like a criminal seems fair.

• KronisLV 4y ago
  Indeed, which is unfortunate, since there already is a better way to go about this (in most cases): https://hackerone.com/uber?type=team https://hackerone.com/uber?type=team Except for the social engineering aspect, in regards to acquiring the credentials, however. Which makes the situation even more problematic.
  • parkingrift 4y ago
    This kind found a power shell script on a shared drive with plain text admin credentials to practically every internal Uber system. How exactly is anyone supposed to submit a bug bounty for that?
  • that_guy_iain 4y ago
    I’m not sure why people are acting like this was anything but a criminal act that was from beginning to end anything but a security researcher. Just because it was a teen whole wrote that they stole things.
    • deleted 4y ago
      [deleted]
  • 878654Tom 4y ago
    I sometimes do these bug bounties and some of these are just... I mean Uber critical max payout is... $15.000. These are bugs that leak out client data and could possible damage the company for millions. I've had companies that argued with me that loss of client data wasn't critical but minor. Some even just give a bounty of $250. Not that this excuses the behavior of hackers leaking confidential data but companies easily pay millions for anti-virus software that only detects well-known viruses but skimp on zero-days in their own software.