4 ms·
It was Lyft; https://www.reuters.com/article/uk-uber-tech-lyft-hacking-exclusive/exclusive-in-lawsuit-over-hacking-uber-probes-ip-address-assigned-to-lyft-exec
by mikeyouse 4y ago
It was Lyft;
https://www.reuters.com/article/uk-uber-tech-lyft-hacking-exclusive/exclusive-in-lawsuit-over-hacking-uber-probes-ip-address-assigned-to-lyft-exec-sources-idUKKCN0S20D020151008 https://www.reuters.com/article/uk-uber-tech-lyft-hacking-ex...
Reading between some lines, what Uber thinks happened is that Chris Lambert, the CTO of Lyft accessed the Github repository that had the improperly stored key (they know the IP address of the only person who they couldn't rule out and that IP was associated with Chris elsewhere online). But then the actual hack using those credentials was carried out via NordVPN so they can't be sure who actually downloaded the material.
Later on, Uber was interviewing a Lyft engineer who let them know that Lyft had a copy of the driver database, so they reverse engineered how they could have downloaded it and found their exposed credentials.
- 0xBAADA555 4y agoI'm genuinely surprised because I would have assumed NordVPN keeps user activity logs regardless of what they say (what all those services say, really).
- HPsquared 4y agoIf they did, they probably wouldn't burn that resource over some petty civil matter.
- public_defender 4y ago1) It was a petty criminal matter. 2) All the advertisement bluster in the world melts away at the arrival of the first subpoena, search warrant, or national security letter. I'm not saying that there must be no NordVPN logs, but I am saying that if they existed and they were subpoenaed, it would be really, really surprising if Nord didn't immediately turn them over.