5 ms·

Look at the comment to the article: > It's a shame when tech journalists don't understand tech. Of course, they outed their source. With the time stamp Uber ca

by zavulon 13y ago

Look at the comment to the article: > It's a shame when tech journalists don't understand tech. Of course, they outed their source. With the time stamp Uber can check which employees looked at that page at a particular time. They can then ask these employees [likely just one] whose computer they were using at that time to figure out who grabbed the screenshot and sold it to ValleyWag. So it's either VW didn't realize this, or fully realized it and still outed their source because they don't give a shit. Given their history of outing their sources, even after specifically being asked not to, I think the latter is much more likely.

untog 13y ago
With the time stamp Uber can check which employees looked at that page at a particular time. I think it's a bit of a leap to assume that the Uber admin system logs every user pageview. It may well do, but many home-grown systems (and it certainly looks homegrown) don't bother with that level of detail. Certainly, if they were that security conscious you'd think they'd also avoid allowing any employee to see overall revenue figures.
- ars_technician 13y ago
  Apache access log by default has this. Doesn't matter how crappy the upper layers are.
  - untog 13y ago
    Page views, yes. User account used, no.
    - jc4p 13y ago
      Assuming they're using Apache's basic logs wouldn't it be insanely easy to track down all URLs visited by that IP? After you login to Uber.com it instantly does a GET to /api/clients/[PERSUMABLY_USER_ID]?parameters which would be in the logs or they might have logs of user logins on their side (to show users a 'you've recently logged in from...' list somewhere)
- boomzilla 13y ago
  Default web server set up would log all HTTP requests. It's trivial to see which (internal) IP addresses connecting around that timestamp.
  - untog 13y ago
    It wouldn't be an internal address. As the article states, an Uber employee logged on using their friend's laptop. I'd be surprised if they did that at an Uber office.
    - dclusin 13y ago
      You can subpoena ISP's to see who owned an address (I believe) up to 6 months back. How exactly do you think the RIAA filed so many lawsuits against internet pirates?
    - ChuckMcM 13y ago
      Think that through, the Uber dashboard is going to be protected by a login regardless of the IP used. Somebody's login was used to access the dashboard at that exact time stamp which will be in the logs. And every web server logs this stuff as a matter of course, and every operations group keeps those logs to scan for unexpected accesses from outside the company or from former employees etc etc.
    - potatolicious 13y ago
      I don't know any company - even small ones - that keep internal stuff like that in the open. I'm willing to bet the Uber employee was on a VPN at the time, which narrows the search considerably. I doubt Uber was secure/paranoid enough that the timestamp will immediately yield the leaker - but between webserver logs, VPN logs, etc etc, there's probably enough information there to deduce the culprit, especially if this occurred outside business hours.
      - untog 13y ago
        Given that the Valleywag article (flagged off HN of course) said that they were able to load up the admin interface themselves (just not log in) I'm going to say that yes, its open.
- AJ007 13y ago
  Last updated != time page loaded Presumably if the time stamp is identifiable, the leak comes from an entry level employee. On the other hand, this makes for a nice PR stunt.
KaoruAoiShiho 13y ago
There's no timestamp for view... it only says last updated. If it updates every 10 minutes many people could have seen it.
maxerickson 13y ago
There is a discussion in the article between Techcrunch and the Gawker editor about the timestamp. What's weird is the editor hairsplitting between the source and the employee that happily helped the source access the data. I guess Uber might care about the intermediary, but I'm pretty sure they will be concerned about the actions of the employee.

by zavulon 13y ago

untog 13y ago

With the time stamp Uber can check which employees looked at that page at a particular time. I think it's a bit of a leap to assume that the Uber admin system logs every user pageview. It may well do, but many home-grown systems (and it certainly looks homegrown) don't bother with that level of detail. Certainly, if they were that security conscious you'd think they'd also avoid allowing any employee to see overall revenue figures.

ars_technician 13y ago
Apache access log by default has this. Doesn't matter how crappy the upper layers are.
- untog 13y ago
  Page views, yes. User account used, no.
  - jc4p 13y ago
    Assuming they're using Apache's basic logs wouldn't it be insanely easy to track down all URLs visited by that IP? After you login to Uber.com it instantly does a GET to /api/clients/[PERSUMABLY_USER_ID]?parameters which would be in the logs or they might have logs of user logins on their side (to show users a 'you've recently logged in from...' list somewhere)
boomzilla 13y ago
Default web server set up would log all HTTP requests. It's trivial to see which (internal) IP addresses connecting around that timestamp.
- untog 13y ago
  It wouldn't be an internal address. As the article states, an Uber employee logged on using their friend's laptop. I'd be surprised if they did that at an Uber office.
  - dclusin 13y ago
    You can subpoena ISP's to see who owned an address (I believe) up to 6 months back. How exactly do you think the RIAA filed so many lawsuits against internet pirates?
  - ChuckMcM 13y ago
    Think that through, the Uber dashboard is going to be protected by a login regardless of the IP used. Somebody's login was used to access the dashboard at that exact time stamp which will be in the logs. And every web server logs this stuff as a matter of course, and every operations group keeps those logs to scan for unexpected accesses from outside the company or from former employees etc etc.
  - potatolicious 13y ago
    I don't know any company - even small ones - that keep internal stuff like that in the open. I'm willing to bet the Uber employee was on a VPN at the time, which narrows the search considerably. I doubt Uber was secure/paranoid enough that the timestamp will immediately yield the leaker - but between webserver logs, VPN logs, etc etc, there's probably enough information there to deduce the culprit, especially if this occurred outside business hours.
    - untog 13y ago
      Given that the Valleywag article (flagged off HN of course) said that they were able to load up the admin interface themselves (just not log in) I'm going to say that yes, its open.
AJ007 13y ago
Last updated != time page loaded Presumably if the time stamp is identifiable, the leak comes from an entry level employee. On the other hand, this makes for a nice PR stunt.

KaoruAoiShiho 13y ago

There's no timestamp for view... it only says last updated. If it updates every 10 minutes many people could have seen it.

maxerickson 13y ago

There is a discussion in the article between Techcrunch and the Gawker editor about the timestamp. What's weird is the editor hairsplitting between the source and the employee that happily helped the source access the data. I guess Uber might care about the intermediary, but I'm pretty sure they will be concerned about the actions of the employee.