9 ms·

Uber Database Breach Exposed Information of 50,000 Drivers, Company Confirms

289 points by rockdiesel 12y ago

therobot24 12y ago
Data accessed on 5/13/2014, uber noticed on 9/17/2014, and then notifies affected on 2/27/2015. Thankfully it was only names and plate numbers, but still... All I see from uber is bad publicity and poor management decisions. I wonder what it's like to work there from an insiders perspective, cause from the outside it doesn't look good.
- inmyunix 12y ago
  the spotlight is magnified
- leereeves 12y ago
  > [From Uber's blog post] On September 17, 2014, we discovered that one of our databases could potentially have been accessed by a third party. A charitable interpretation might be that they discovered a vulnerability in September, but didn't find the May breach until recently.
- joshmlewis 12y ago
  I'm not defending them on this because that does seem to be a long enough time to be more proactive about it. You did bring up an interesting point though, Uber is facing opposition from almost every city they are in. Whether it's small town South Carolina where I'm from and even in some of the largest cities in the world. It would be interesting to see how people deal with this on the inside and how it affects the culture.
  - Kalium 12y ago
    Uber's in a position where they get flak for breaking the rules while also being painfully aware that following the rules is worse for them. They face opposition, but every time they play nice it doesn't go well for them. The lesson here is that sometimes, you do much better by breaking all the rules.
    - toomuchtodo 12y ago
      > The lesson here is that sometimes, you do much better by breaking all the rules. I guess we'll find out after Uber has exhausted its VC money, if Google doesn't replace them with self-driving cars first.
      - skuhn 12y ago
        Uber is already hamstrung by their inexperienced drivers's reliance on Google Maps for navigation. It is in no way equivalent to actually knowing your way around. The difficulty of making an urban self-driving car aside, Google would have to achieve a quantum leap forward in the quality of their navigation platform. Otherwise every auto-taxi in San Francisco will proceed single file down Van Ness, with turns onto Market or Mission only. All other streets will be empty and filled with pigeons.
        luddypants 12y ago
        I don't think it would require a quantum leap forward in tech to take traffic into account...
        skuhn 12y ago
        It's not just taking traffic into account, which it can (sort of) already do. They need to actually use the accident data. Use a diverse set of routes to get to the same place, so that there isn't one path for every car on the road. Understand stoplight patterns and where it's hard or easy to make a turn. Not focus obsessively on shortest path rather than most tolerable path. Fundamentally what a good cab driver (which are not that common) offers you is knowledge of the best route to a destination from experience. Google Maps doesn't have that. And if it did, and it controlled a significant portion of the cars, it would no longer be the best route.
        TeMPOraL 12y ago
        You know that you're describing things that machines are inherently better at than humans? And the problems you described stem mostly from the fact that maps also serve informative function (to learn the route in advance), and apparently Google didn't decide yet to compute routes in their navapp based on other active users of said navapp in the neighbourhood. But the data, infrastructure and algorithms are there. > And if it did, and it controlled a significant portion of the cars, it would no longer be the best route. Of course it would, because it would be able to run a global route optimization on all the cars simultaneously, thus outperforming even the most experienced human drivers by orders of magnitude. Getting above human level seems like a college-level exercise.
- joshmn 12y ago
  Early 2014, you could see the drivers home address, cell phone number, ESN for their phone, the car(s) they had on their account's VINs... list goes on and on...
- skuhn 12y ago
  It sounds like they realized the API was improperly exposed on 9/17/2014, but didn't necessary know if it had ever been accessed by an unauthorized request. I could see it taking a while to find one bad request in the entire history of the API's lifespan -- presuming that they had to find the logs, weed out false positives, different sites and versions that behaved differently, etc. That still doesn't explain a 5 month gap. The only (charitable) explanation that makes sense to me is that they discovered the API was exposed, thought they had proven it was never improperly accessed, and then only much later realized that it had been after all.
- joe_the_user 12y ago
  As eddieZone mentions in a post [currently] below this [0], Uber says names and driver's license numbers, which is a good deal worse [1]. [0] https://news.ycombinator.com/item?id=9122369 https://news.ycombinator.com/item?id=9122369 [1] http://blog.uber.com/2-27-15 http://blog.uber.com/2-27-15
- discloser 12y ago
  I'm not shocked. I recently found a vulnerability in software used by multiple companies in a specific industry - thousands of names, SSNs, addresses, etc open for the taking. I attempted to disclose to a local company that uses the software and never got a response. I think often companies just don't respond the first time, or ever. What can you do?
- Vintila 12y ago
  I have no experience in this area so could someone explain how Uber noticed there was a data breach ~4 months after it occurred.
  - thedufer 12y ago
    I don't know what happened here, but presumably they keep fairly detailed request logs. If they were notified of a security vulnerability like this, they would probably sweep logs for suspicious requests. This way they would become aware of all breaches using that vulnerability, but not until they found the vulnerability, which could be any amount of time after the breaches occurred.
nastygibbon 12y ago
No info as to how this was exposed. Were they storing data as plain text?
- notatoad 12y ago
  probably, yes. storing data in plain text is common practice and not really a problem.
  - deleted 12y ago
    [deleted]
  - rietta 12y ago
    I would actively insist not storing PII in plain text unless there was absolutely no way around it. And it may involve changing the business model to enforce that certain data is not needed to be actively processed by the web application in the ordinary course of business. This is part of the security pushback phase that is essential that more developers adopt as a matter of professional ethics.
- rietta 12y ago
  Probably so and also an indication of a probably lack of defense in depth and failure of access control. It will be another example to add to my Litany of Data Breaches the next time I speak with developers about appsec. You can see my last talk at https://www.youtube.com/watch?v=dj196NhPyWs&t=19m50s https://www.youtube.com/watch?v=dj196NhPyWs&t=19m50s. So much failure to go around in application design and implementation.
martin_ 12y ago
I find it unlikely they have a database explicitly for driver names/license plates. Unless it was some flat-file dump compromised. I'm curious how much data was really obtained. If only 50k were truly stolen, it could be a shard too. The lack of technical details is sketchy to me
- MBlume 12y ago
  Maybe they have query logging turned on and saw what queries the attacker ran?
  - martin_ 12y ago
    Definitely plausible, and I hope so --- but there's no clarification of that or technical insight.
- imnewhere 12y ago
  Why wouldn't they? I imagine there's some driver signup form that saves to some database table on their site.
- froseph 12y ago
  I also find it unlikely it's just the name and license number. They used to return all of a driver's information (name, phone, address, drivers license, license plate, etc) from the rest endpoint they were using on their website. They closed that hole it after it we disclosed it to them.
berberous 12y ago
Uber really needs to have a public data retention policy stating that they anonymize or delete all data older than a couple weeks. I'm just waiting for them to be hacked and have to reveal that people's trip data for years has been released.
- dredmorbius 12y ago
  Not just Uber. Obama's proposing data privacy regulations. I think it's worth considering what you'd like to see involved in same.
  - paulannesley 12y ago
    Meanwhile, Australia is about to legislate mandatory data retention :( https://stopthespies.org/ https://stopthespies.org/
    - rietta 12y ago
      A data retention policy can state that you delete all non-operational data after 60 or 90 days. Or that it is moved to one-way encrypted storage for up to a year. In other words, it can be a security mechanism vs "we keep everything in the SQL database, forever" that tends to be the default in many circumstances.
- rietta 12y ago
  It's definitely not just Uber. And drivers' license numbers are serious PII! It was my exact example that I gave to my last appsec talk for Ruby developers this month in Nashville. Starting with the user story: "As a Pawn Shop Clerk, I scan a copy of the customer’s drivers’ license because the company is required by law to keep this record at least two years from the date we purchase a used valuable from a customer." https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s There was a good Q&A about data retention, that included a lawyer in the audience.
spdustin 12y ago
And depending on the state, you can find out the driver's birthday, or even if their real name is different from what is listed on their profile. The site at [0] shows how many states use soundex coding and modulus arithmetic to encode driver's license numbers with PII. I'd be keen to see if every driver's info aligns with the license number (for those states that use encoding systems that embed PII into the number). [0] http://www.highprogrammer.com/alan/numbers/index.html http://www.highprogrammer.com/alan/numbers/index.html
nathanmock 12y ago
I accidentally stumbled upon employee admin screens, all by changing a key, isAdmin = true. https://news.ycombinator.com/item?id=9121004 https://news.ycombinator.com/item?id=9121004
- bhauer 12y ago
  How in the world did you only get 8 points for that? I've upvoted yours. That seems almost as bad as the incident reported in this thread.
  - onewaystreet 12y ago
    Because it's just the UI, you can't actually use it without an admin account. It's really not an issue at all.
    - bhauer 12y ago
      Aha! Good point! Interesting nevertheless, but ultimately not more than a slight reveal of how things look on the inside.
    - nathanmock 12y ago
      This is a good point, but there should be more awareness towards the issue as a whole. I've seen many apps who expose data dangerously. Some developers may not be aware that these values are exposed (even with SSL), so they should architect their apps accordingly, reinforcing the fact that you should never trust the client. I also briefly touch on the fact about this dynamic architecture and some of the implications it brings.
      - tracker1 12y ago
        You mean throwing up a Meteor app with a direct db feed and no fine grained security at the server side can lead to exploits?
    - jayvanguard 12y ago
cmurf 12y ago
Congress needs to stop pissing in the wind and make a federal law on breach disclosure. Self evidently companies won't universally do this on their own, and state specific law makes compliance more difficult and expensive.
- anigbrowl 12y ago
  Ermahgerd why do you hate bidness and jawbs... ...will be the response by many Congresspersons. Nothing will happen on this until a number of public figures are doxxed to hell and back.
  - cmurf 12y ago
    Companies are asking Congress to do this because already states are doing it, and it's totally haphazard. If Congresscritters were to get doxxed maybe it'd go faster.
- tlrobinson 12y ago
  How would such legislation ensure companies are able to detect such breaches in the first place? For every Target/PSN/Anthem/Uber how many companies aren't even aware they've been breached?
  - cmurf 12y ago
    Withholding knowledge of a breach is self-rewarding which is why there needs to be a law stating the time frame for disclosure, and either penalties or liablity (per affected customer, employee, contractor, vendor). Lack of skill in detection is a problem, but I don't know whether Congress is well equipped to legislate that, and also companies aren't exactly incentivized to just let themselves get completely owned. They're just ignorant. There's no question this behavior is changing, even if we're dissatisfied with how slow it's happening. I mean, the average Congresscritter probably has no idea what the typical answer is to "how do you do a password reset?" other than "call daughter/son". They're not good at establishing competency. They are sorta half way decent at bringing out the hammer "disclose what you know within X days, or we're going to fine you... when we do find out when you knew it." So that brings up the question how the legislation determines whether and exactly when the company knew they were breached. And I'd say they should learn from history which is not to be such dicks like they were with hackers in the 80's and 90's and instantly criminalize disproportionately. We were learning things as a result of all of that, and by repressing it, we learned a lot less. So with companies I'd say up front the disclosure needs to be civil in nature (fines), and if there's willful hiding of what they know, tampering of evidence, destruction of evidence in an attempt to claim they didn't know they were breached or how badly, then it becomes criminal and lay down the hammer. Ultimately though, the worst punishment is up to the states, since the corporate charter is granted by states, not the feds. Off hand I can't think of a case where a corporation was executed in this manner though (revoking it's charter or articles of incorporation).
eddiezane 12y ago
The TechCrunch article says "license plate numbers" but the Uber post[0] says "driver’s license number". [0] http://blog.uber.com/2-27-15 http://blog.uber.com/2-27-15
- sschueller 12y ago
  In Massachusetts the driver's license number used to be your social security number. This was changes but are there other states that have not done so?
jheriko 12y ago
"cowboys get stung by being cowboys" the number of f*cks i can give for the company is so low. just feel sorry for all the drivers with the leaked information...
codewithcheese 12y ago
The free one-year membership of Experian’s® ProtectMyID® Alert is genius, its giving away something that costs them nothing (presumably Experian are using this as a marketing opportunity) as if it's a real step in the right direction to make up for the data leak.
- chambo622 12y ago
  Virtually every breach disclosure press release I've seen has included a line like this, as if it actually matters. Common practice.
Trisell 12y ago
Between this breach, and the impending classification as a cab company by more and more major cities. I think that we can consider Uber to be either the walking dead or something very close to it at this point.
- skuhn 12y ago
  I think it's a bit premature to count Uber out. They have an absurd amount of money in the bank, and they take on a very small amount of the risk of their business. I don't think that this data breach will have the slightest impact to their bottom line. If they get classified as a cab company in a particular market, they'll sue. If they don't get their way, they'll exit the market. They could also move into other businesses which are clearly not cabs, as shown by their dabblings in courier and delivery services. Consider how many startups are paying people to drive things from point A to point B -- that entire industry could be outsourced to Uber. If they do exit a market, they won't lose anything besides face -- it's the drivers who will carry all of the capital investment and most of the operating costs, they're the ones who will be hurt.
mrwarn 12y ago
Is this a signal that we should expect another large round of funding for Uber?
seanmccann 12y ago
Last year Uber was using Backbone and the JSON returned to the client included ALL information about the drivers you have used for trips including home address, phone number, etc. I wonder if this has something to do with that?
- joshmn 12y ago
  You could also use an auth token from the Android app and snoop around other users if you knew some info about them, which you could if you had access to a driver's phone (I did/do).
deleted 12y ago
[deleted]
freehunter 12y ago
I work in info sec, and in one of the "Who's Hiring" posts a few months ago (do we still do those? I haven't seen one in a while) I asked "why are startups never hiring security guys?", because I never see a security engineer position open in those topics. I never got a response. To me that indicates the response is "we don't". Listen, guys. I don't care how small you are. If you are handling PII or credit card data or anything that, if leaked, would harm your business or your customers, you need a security guy. Not a programmer who knows some security stuff. Not a manager who checks off the online PCI self-assessment. Not "we outsource to an MSSP". At least one security guy, full time. Make sure that everything you do is run past that person. If you're so busy that you can't run everything past that person, hire another. It's not a joke. Stop fucking ruining people's lives. It's 2015, four years past "the year of the breach" [1]. Get with the program. It's not okay to have a breach. It's not. It doesn't matter how much money you saved from not having a security guy or the tools they need. Get someone who knows what they're talking about and listen to them. [1] http://news.softpedia.com/news/IBM-2011-is-The-Year-of-the-Security-Breach-224465.shtml http://news.softpedia.com/news/IBM-2011-is-The-Year-of-the-S...
- damian2000 12y ago
  Agreed, but these guys aren't small, they're fucking huge, so they really don't have an excuse. They possibly still have the startup culture of growing quickly and worrying about the details (e.g. security) later.
- imnewhere 12y ago
  I mostly agree, but the calculation is different for different businesses. The costs of engineering time and hiring a security professional may be much more expensive than the lost business due to breaches. In this particular case they likely have enough resources to have made it happen, but it remains to be seen whether this will actually cost them much if anything.
  - freehunter 12y ago
    That was the case with Home Depot. They made the determination that the cost of implementing proper security would be more than the cost of cleaning up the breach. However, this is just offloading the negative externalities onto the banks and the customers. That's just shitty. I'm not one to call for government regulation that easily, but this is exactly why we have a federal government. To make sure the citizens are being protected. That's why the FCC declared ISPs to be utilities. To stop them from abusing the customers. That's why the EPA has regulations on chemical and oil spills. If Home Depot got fined $100m for their breach, what would the cost look like then? The cost of security is more than the impact of the lost business. That needs to be fixed, because until it is, we will continue to have breaches that make our lives terrible.
nedwin 12y ago
Good to get this news out there on a Friday afternoon.
anseljh 12y ago
Here's a sample of the notification that went to affected "driver partners": http://oag.ca.gov/ecrime/databreach/reports/sb24-48540 http://oag.ca.gov/ecrime/databreach/reports/sb24-48540
anseljh 12y ago
Under California law, data breach notifications "shall be made in the most expedient time possible and without unreasonable delay". Civil Code § 1798.82(a): http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 http://leginfo.legislature.ca.gov/faces/codes_displaySection... I find it hard to square that requirement with Uber waiting 5 months from when it found out.
- tomjen3 12y ago
  That is a bunch of lawyer words that they can stretch to mean anything. What we need are hard deadlines, say two days after the breakin. Not enough to full find out what happens, but enough to force the companies to act.
  - anseljh 12y ago
    It's soft language, but I don't think they can stretch it to mean "anything." 5 months is just way too long.
deleted 12y ago
[deleted]
unimportant 12y ago
On an unrelated note - does anyone want to be a co-founder of an uber competitior? I got 50k drivers ready to drive for us. :P
legulere 12y ago
I hope the authorities got hold of this data to check which drivers aren't paying taxes.
louwrentius 12y ago
This incident - amongst many others - only shows that most companies don't give a rat's ass about our data or privacy. They are happy enough if their systems actually work and run. That's enough for them. This incident won't cost Uber anything. It won't matter to them. A few appologies here and there and that will be the end of it. Maybe, maybe there is some trivial fine to pay, but that will be a rounding error on their balance sheet.
logn 12y ago
> Uber says it will offer a free one-year membership of Experian’s ProtectMyID Alert My ID has been breached twice in other, unrelated incidents. Each time these ID protection companies want to know my SS# and all sorts of other stuff. My heart skips a beat imagining them scraping the web for my SS# and CC# in an otherwise well intentioned effort. I've refused their services and insist they only provide the insurance policy associated with this.
- Karunamon 12y ago
  It's pretty hard (actually impossible) to pull the information necessary to do credit monitoring without your PII.
crdb 12y ago
I see a lot of comments about security, but would be happy to bet this was simple social engineering and "human hacking". It's sobering to see large-ish companies that give full read access (and sometimes write) of customer and financial data to interns, fresh grads and new contractors for expediency. Young people are cheap. $500 is a new computer or weeks of food to an indebted student. Management usually doesn't care, revenue and convenience trump security; until of course something bad happens, which is why older institutions have draconian access standards, meetings to discuss who has the right to know about the meeting to determine the access list management program (true story) and so on. Nothing in the press release hints at an actual attack. "An unauthorized third party accessed our database, and we immediately changed the password" sounds like they realized one of their competitors hired an intern to get them a login.
ukigumo 12y ago
Is this what a 40 billion dollar startup looks like?
- kmfrk 12y ago
  You're officially a billion-dollar corporation, when you start being careless with people's private data. :)
  - ukigumo 12y ago
    Ok you got me there. :-) I just think that this is a company with no product, no business model, horrendous business practices and somehow their valuation is still higher than the entire market they operate in. At least their not selling the data to the IRS, right?
ryan_j_naughton 12y ago
As much as Uber messed up here and there was a security breach, comparable information is publicly available. For example, the TLC in NYC provides this: http://www.nyc.gov/html/tlc/downloads/excel/current_medallion_drivers.xls http://www.nyc.gov/html/tlc/downloads/excel/current_medallio... This is a spreadsheet containing all the taxi drivers in NYC with their names, license numbers, and license expiration dates. Given that the only information leaked (according to Uber) were names and license numbers, that really isn't much beyond what might otherwise be available publicly.
- un1xl0ser 12y ago
  Those are medallion numbers or TLC license numbers, but not drivers license numbers. They can't be used for identity theft.
coldcode 12y ago
And apparently Uber has filed suit against github: http://www.theregister.co.uk/2015/02/28/uber_subpoenas_github_for_hacker_details/ http://www.theregister.co.uk/2015/02/28/uber_subpoenas_githu...
archlight 12y ago
the amazing thing i found uber is after all the gaffe, privacy leak and maybe more. it still grows in such a speed. it surely means something big
bobofettfett 12y ago
Why does sec get breached? Marketing wants easy access to all data, that's it. Big Data / deep learning wants easy access, lots of data is in transit. Security is not convenient for operations, therefor companies have sec on paper and audits and stuff but no real sec.
bobofettfett 12y ago
Why is data lost all the time? Because lists of data exist. Why do they exist? Because everyone is using Excel.

289 points by rockdiesel 12y ago

Data accessed on 5/13/2014, uber noticed on 9/17/2014, and then notifies affected on 2/27/2015. Thankfully it was only names and plate numbers, but still... All I see from uber is bad publicity and poor management decisions. I wonder what it's like to work there from an insiders perspective, cause from the outside it doesn't look good.

inmyunix 12y ago
the spotlight is magnified
leereeves 12y ago
> [From Uber's blog post] On September 17, 2014, we discovered that one of our databases could potentially have been accessed by a third party. A charitable interpretation might be that they discovered a vulnerability in September, but didn't find the May breach until recently.
joshmlewis 12y ago
I'm not defending them on this because that does seem to be a long enough time to be more proactive about it. You did bring up an interesting point though, Uber is facing opposition from almost every city they are in. Whether it's small town South Carolina where I'm from and even in some of the largest cities in the world. It would be interesting to see how people deal with this on the inside and how it affects the culture.
- Kalium 12y ago
  Uber's in a position where they get flak for breaking the rules while also being painfully aware that following the rules is worse for them. They face opposition, but every time they play nice it doesn't go well for them. The lesson here is that sometimes, you do much better by breaking all the rules.
  - toomuchtodo 12y ago
    > The lesson here is that sometimes, you do much better by breaking all the rules. I guess we'll find out after Uber has exhausted its VC money, if Google doesn't replace them with self-driving cars first.
    - skuhn 12y ago
      Uber is already hamstrung by their inexperienced drivers's reliance on Google Maps for navigation. It is in no way equivalent to actually knowing your way around. The difficulty of making an urban self-driving car aside, Google would have to achieve a quantum leap forward in the quality of their navigation platform. Otherwise every auto-taxi in San Francisco will proceed single file down Van Ness, with turns onto Market or Mission only. All other streets will be empty and filled with pigeons.
      - luddypants 12y ago
        I don't think it would require a quantum leap forward in tech to take traffic into account...
        skuhn 12y ago
        It's not just taking traffic into account, which it can (sort of) already do. They need to actually use the accident data. Use a diverse set of routes to get to the same place, so that there isn't one path for every car on the road. Understand stoplight patterns and where it's hard or easy to make a turn. Not focus obsessively on shortest path rather than most tolerable path. Fundamentally what a good cab driver (which are not that common) offers you is knowledge of the best route to a destination from experience. Google Maps doesn't have that. And if it did, and it controlled a significant portion of the cars, it would no longer be the best route.
        TeMPOraL 12y ago
        You know that you're describing things that machines are inherently better at than humans? And the problems you described stem mostly from the fact that maps also serve informative function (to learn the route in advance), and apparently Google didn't decide yet to compute routes in their navapp based on other active users of said navapp in the neighbourhood. But the data, infrastructure and algorithms are there. > And if it did, and it controlled a significant portion of the cars, it would no longer be the best route. Of course it would, because it would be able to run a global route optimization on all the cars simultaneously, thus outperforming even the most experienced human drivers by orders of magnitude. Getting above human level seems like a college-level exercise.
joshmn 12y ago
Early 2014, you could see the drivers home address, cell phone number, ESN for their phone, the car(s) they had on their account's VINs... list goes on and on...
skuhn 12y ago
It sounds like they realized the API was improperly exposed on 9/17/2014, but didn't necessary know if it had ever been accessed by an unauthorized request. I could see it taking a while to find one bad request in the entire history of the API's lifespan -- presuming that they had to find the logs, weed out false positives, different sites and versions that behaved differently, etc. That still doesn't explain a 5 month gap. The only (charitable) explanation that makes sense to me is that they discovered the API was exposed, thought they had proven it was never improperly accessed, and then only much later realized that it had been after all.
joe_the_user 12y ago
As eddieZone mentions in a post [currently] below this [0], Uber says names and driver's license numbers, which is a good deal worse [1]. [0] https://news.ycombinator.com/item?id=9122369 https://news.ycombinator.com/item?id=9122369 [1] http://blog.uber.com/2-27-15 http://blog.uber.com/2-27-15
discloser 12y ago
I'm not shocked. I recently found a vulnerability in software used by multiple companies in a specific industry - thousands of names, SSNs, addresses, etc open for the taking. I attempted to disclose to a local company that uses the software and never got a response. I think often companies just don't respond the first time, or ever. What can you do?
Vintila 12y ago
I have no experience in this area so could someone explain how Uber noticed there was a data breach ~4 months after it occurred.
- thedufer 12y ago
  I don't know what happened here, but presumably they keep fairly detailed request logs. If they were notified of a security vulnerability like this, they would probably sweep logs for suspicious requests. This way they would become aware of all breaches using that vulnerability, but not until they found the vulnerability, which could be any amount of time after the breaches occurred.

nastygibbon 12y ago

No info as to how this was exposed. Were they storing data as plain text?

notatoad 12y ago
probably, yes. storing data in plain text is common practice and not really a problem.
- deleted 12y ago
  [deleted]
- rietta 12y ago
  I would actively insist not storing PII in plain text unless there was absolutely no way around it. And it may involve changing the business model to enforce that certain data is not needed to be actively processed by the web application in the ordinary course of business. This is part of the security pushback phase that is essential that more developers adopt as a matter of professional ethics.
rietta 12y ago
Probably so and also an indication of a probably lack of defense in depth and failure of access control. It will be another example to add to my Litany of Data Breaches the next time I speak with developers about appsec. You can see my last talk at https://www.youtube.com/watch?v=dj196NhPyWs&t=19m50s https://www.youtube.com/watch?v=dj196NhPyWs&t=19m50s. So much failure to go around in application design and implementation.

martin_ 12y ago

I find it unlikely they have a database explicitly for driver names/license plates. Unless it was some flat-file dump compromised. I'm curious how much data was really obtained. If only 50k were truly stolen, it could be a shard too. The lack of technical details is sketchy to me

MBlume 12y ago
Maybe they have query logging turned on and saw what queries the attacker ran?
- martin_ 12y ago
  Definitely plausible, and I hope so --- but there's no clarification of that or technical insight.
imnewhere 12y ago
Why wouldn't they? I imagine there's some driver signup form that saves to some database table on their site.
froseph 12y ago
I also find it unlikely it's just the name and license number. They used to return all of a driver's information (name, phone, address, drivers license, license plate, etc) from the rest endpoint they were using on their website. They closed that hole it after it we disclosed it to them.

berberous 12y ago

Uber really needs to have a public data retention policy stating that they anonymize or delete all data older than a couple weeks. I'm just waiting for them to be hacked and have to reveal that people's trip data for years has been released.

dredmorbius 12y ago
Not just Uber. Obama's proposing data privacy regulations. I think it's worth considering what you'd like to see involved in same.
- paulannesley 12y ago
  Meanwhile, Australia is about to legislate mandatory data retention :( https://stopthespies.org/ https://stopthespies.org/
  - rietta 12y ago
    A data retention policy can state that you delete all non-operational data after 60 or 90 days. Or that it is moved to one-way encrypted storage for up to a year. In other words, it can be a security mechanism vs "we keep everything in the SQL database, forever" that tends to be the default in many circumstances.
rietta 12y ago
It's definitely not just Uber. And drivers' license numbers are serious PII! It was my exact example that I gave to my last appsec talk for Ruby developers this month in Nashville. Starting with the user story: "As a Pawn Shop Clerk, I scan a copy of the customer’s drivers’ license because the company is required by law to keep this record at least two years from the date we purchase a used valuable from a customer." https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s There was a good Q&A about data retention, that included a lawyer in the audience.

spdustin 12y ago

And depending on the state, you can find out the driver's birthday, or even if their real name is different from what is listed on their profile. The site at [0] shows how many states use soundex coding and modulus arithmetic to encode driver's license numbers with PII. I'd be keen to see if every driver's info aligns with the license number (for those states that use encoding systems that embed PII into the number). [0] http://www.highprogrammer.com/alan/numbers/index.html http://www.highprogrammer.com/alan/numbers/index.html

nathanmock 12y ago

I accidentally stumbled upon employee admin screens, all by changing a key, isAdmin = true. https://news.ycombinator.com/item?id=9121004 https://news.ycombinator.com/item?id=9121004

bhauer 12y ago
How in the world did you only get 8 points for that? I've upvoted yours. That seems almost as bad as the incident reported in this thread.
- onewaystreet 12y ago
  Because it's just the UI, you can't actually use it without an admin account. It's really not an issue at all.
  - bhauer 12y ago
    Aha! Good point! Interesting nevertheless, but ultimately not more than a slight reveal of how things look on the inside.
  - nathanmock 12y ago
    This is a good point, but there should be more awareness towards the issue as a whole. I've seen many apps who expose data dangerously. Some developers may not be aware that these values are exposed (even with SSL), so they should architect their apps accordingly, reinforcing the fact that you should never trust the client. I also briefly touch on the fact about this dynamic architecture and some of the implications it brings.
    - tracker1 12y ago
      You mean throwing up a Meteor app with a direct db feed and no fine grained security at the server side can lead to exploits?
  - jayvanguard 12y ago

cmurf 12y ago

Congress needs to stop pissing in the wind and make a federal law on breach disclosure. Self evidently companies won't universally do this on their own, and state specific law makes compliance more difficult and expensive.

anigbrowl 12y ago
Ermahgerd why do you hate bidness and jawbs... ...will be the response by many Congresspersons. Nothing will happen on this until a number of public figures are doxxed to hell and back.
- cmurf 12y ago
  Companies are asking Congress to do this because already states are doing it, and it's totally haphazard. If Congresscritters were to get doxxed maybe it'd go faster.
tlrobinson 12y ago
How would such legislation ensure companies are able to detect such breaches in the first place? For every Target/PSN/Anthem/Uber how many companies aren't even aware they've been breached?
- cmurf 12y ago
  Withholding knowledge of a breach is self-rewarding which is why there needs to be a law stating the time frame for disclosure, and either penalties or liablity (per affected customer, employee, contractor, vendor). Lack of skill in detection is a problem, but I don't know whether Congress is well equipped to legislate that, and also companies aren't exactly incentivized to just let themselves get completely owned. They're just ignorant. There's no question this behavior is changing, even if we're dissatisfied with how slow it's happening. I mean, the average Congresscritter probably has no idea what the typical answer is to "how do you do a password reset?" other than "call daughter/son". They're not good at establishing competency. They are sorta half way decent at bringing out the hammer "disclose what you know within X days, or we're going to fine you... when we do find out when you knew it." So that brings up the question how the legislation determines whether and exactly when the company knew they were breached. And I'd say they should learn from history which is not to be such dicks like they were with hackers in the 80's and 90's and instantly criminalize disproportionately. We were learning things as a result of all of that, and by repressing it, we learned a lot less. So with companies I'd say up front the disclosure needs to be civil in nature (fines), and if there's willful hiding of what they know, tampering of evidence, destruction of evidence in an attempt to claim they didn't know they were breached or how badly, then it becomes criminal and lay down the hammer. Ultimately though, the worst punishment is up to the states, since the corporate charter is granted by states, not the feds. Off hand I can't think of a case where a corporation was executed in this manner though (revoking it's charter or articles of incorporation).

eddiezane 12y ago

The TechCrunch article says "license plate numbers" but the Uber post[0] says "driver’s license number". [0] http://blog.uber.com/2-27-15 http://blog.uber.com/2-27-15

sschueller 12y ago
In Massachusetts the driver's license number used to be your social security number. This was changes but are there other states that have not done so?

jheriko 12y ago

"cowboys get stung by being cowboys" the number of f*cks i can give for the company is so low. just feel sorry for all the drivers with the leaked information...

codewithcheese 12y ago

The free one-year membership of Experian’s® ProtectMyID® Alert is genius, its giving away something that costs them nothing (presumably Experian are using this as a marketing opportunity) as if it's a real step in the right direction to make up for the data leak.

chambo622 12y ago
Virtually every breach disclosure press release I've seen has included a line like this, as if it actually matters. Common practice.

Trisell 12y ago

Between this breach, and the impending classification as a cab company by more and more major cities. I think that we can consider Uber to be either the walking dead or something very close to it at this point.

skuhn 12y ago
I think it's a bit premature to count Uber out. They have an absurd amount of money in the bank, and they take on a very small amount of the risk of their business. I don't think that this data breach will have the slightest impact to their bottom line. If they get classified as a cab company in a particular market, they'll sue. If they don't get their way, they'll exit the market. They could also move into other businesses which are clearly not cabs, as shown by their dabblings in courier and delivery services. Consider how many startups are paying people to drive things from point A to point B -- that entire industry could be outsourced to Uber. If they do exit a market, they won't lose anything besides face -- it's the drivers who will carry all of the capital investment and most of the operating costs, they're the ones who will be hurt.

mrwarn 12y ago

Is this a signal that we should expect another large round of funding for Uber?

seanmccann 12y ago

Last year Uber was using Backbone and the JSON returned to the client included ALL information about the drivers you have used for trips including home address, phone number, etc. I wonder if this has something to do with that?

joshmn 12y ago
You could also use an auth token from the Android app and snoop around other users if you knew some info about them, which you could if you had access to a driver's phone (I did/do).

deleted 12y ago

[deleted]

freehunter 12y ago

I work in info sec, and in one of the "Who's Hiring" posts a few months ago (do we still do those? I haven't seen one in a while) I asked "why are startups never hiring security guys?", because I never see a security engineer position open in those topics. I never got a response. To me that indicates the response is "we don't". Listen, guys. I don't care how small you are. If you are handling PII or credit card data or anything that, if leaked, would harm your business or your customers, you need a security guy. Not a programmer who knows some security stuff. Not a manager who checks off the online PCI self-assessment. Not "we outsource to an MSSP". At least one security guy, full time. Make sure that everything you do is run past that person. If you're so busy that you can't run everything past that person, hire another. It's not a joke. Stop fucking ruining people's lives. It's 2015, four years past "the year of the breach" [1]. Get with the program. It's not okay to have a breach. It's not. It doesn't matter how much money you saved from not having a security guy or the tools they need. Get someone who knows what they're talking about and listen to them. [1] http://news.softpedia.com/news/IBM-2011-is-The-Year-of-the-Security-Breach-224465.shtml http://news.softpedia.com/news/IBM-2011-is-The-Year-of-the-S...

damian2000 12y ago
Agreed, but these guys aren't small, they're fucking huge, so they really don't have an excuse. They possibly still have the startup culture of growing quickly and worrying about the details (e.g. security) later.
imnewhere 12y ago
I mostly agree, but the calculation is different for different businesses. The costs of engineering time and hiring a security professional may be much more expensive than the lost business due to breaches. In this particular case they likely have enough resources to have made it happen, but it remains to be seen whether this will actually cost them much if anything.
- freehunter 12y ago
  That was the case with Home Depot. They made the determination that the cost of implementing proper security would be more than the cost of cleaning up the breach. However, this is just offloading the negative externalities onto the banks and the customers. That's just shitty. I'm not one to call for government regulation that easily, but this is exactly why we have a federal government. To make sure the citizens are being protected. That's why the FCC declared ISPs to be utilities. To stop them from abusing the customers. That's why the EPA has regulations on chemical and oil spills. If Home Depot got fined $100m for their breach, what would the cost look like then? The cost of security is more than the impact of the lost business. That needs to be fixed, because until it is, we will continue to have breaches that make our lives terrible.

nedwin 12y ago

Good to get this news out there on a Friday afternoon.

anseljh 12y ago

Here's a sample of the notification that went to affected "driver partners": http://oag.ca.gov/ecrime/databreach/reports/sb24-48540 http://oag.ca.gov/ecrime/databreach/reports/sb24-48540

anseljh 12y ago

Under California law, data breach notifications "shall be made in the most expedient time possible and without unreasonable delay". Civil Code § 1798.82(a): http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 http://leginfo.legislature.ca.gov/faces/codes_displaySection... I find it hard to square that requirement with Uber waiting 5 months from when it found out.

tomjen3 12y ago
That is a bunch of lawyer words that they can stretch to mean anything. What we need are hard deadlines, say two days after the breakin. Not enough to full find out what happens, but enough to force the companies to act.
- anseljh 12y ago
  It's soft language, but I don't think they can stretch it to mean "anything." 5 months is just way too long.

deleted 12y ago

[deleted]

unimportant 12y ago

On an unrelated note - does anyone want to be a co-founder of an uber competitior? I got 50k drivers ready to drive for us. :P

legulere 12y ago

I hope the authorities got hold of this data to check which drivers aren't paying taxes.

louwrentius 12y ago

This incident - amongst many others - only shows that most companies don't give a rat's ass about our data or privacy. They are happy enough if their systems actually work and run. That's enough for them. This incident won't cost Uber anything. It won't matter to them. A few appologies here and there and that will be the end of it. Maybe, maybe there is some trivial fine to pay, but that will be a rounding error on their balance sheet.

logn 12y ago

> Uber says it will offer a free one-year membership of Experian’s ProtectMyID Alert My ID has been breached twice in other, unrelated incidents. Each time these ID protection companies want to know my SS# and all sorts of other stuff. My heart skips a beat imagining them scraping the web for my SS# and CC# in an otherwise well intentioned effort. I've refused their services and insist they only provide the insurance policy associated with this.

Karunamon 12y ago
It's pretty hard (actually impossible) to pull the information necessary to do credit monitoring without your PII.

crdb 12y ago

I see a lot of comments about security, but would be happy to bet this was simple social engineering and "human hacking". It's sobering to see large-ish companies that give full read access (and sometimes write) of customer and financial data to interns, fresh grads and new contractors for expediency. Young people are cheap. $500 is a new computer or weeks of food to an indebted student. Management usually doesn't care, revenue and convenience trump security; until of course something bad happens, which is why older institutions have draconian access standards, meetings to discuss who has the right to know about the meeting to determine the access list management program (true story) and so on. Nothing in the press release hints at an actual attack. "An unauthorized third party accessed our database, and we immediately changed the password" sounds like they realized one of their competitors hired an intern to get them a login.

ukigumo 12y ago

Is this what a 40 billion dollar startup looks like?

kmfrk 12y ago
You're officially a billion-dollar corporation, when you start being careless with people's private data. :)
- ukigumo 12y ago
  Ok you got me there. :-) I just think that this is a company with no product, no business model, horrendous business practices and somehow their valuation is still higher than the entire market they operate in. At least their not selling the data to the IRS, right?

ryan_j_naughton 12y ago

As much as Uber messed up here and there was a security breach, comparable information is publicly available. For example, the TLC in NYC provides this: http://www.nyc.gov/html/tlc/downloads/excel/current_medallion_drivers.xls http://www.nyc.gov/html/tlc/downloads/excel/current_medallio... This is a spreadsheet containing all the taxi drivers in NYC with their names, license numbers, and license expiration dates. Given that the only information leaked (according to Uber) were names and license numbers, that really isn't much beyond what might otherwise be available publicly.

un1xl0ser 12y ago
Those are medallion numbers or TLC license numbers, but not drivers license numbers. They can't be used for identity theft.

coldcode 12y ago

And apparently Uber has filed suit against github: http://www.theregister.co.uk/2015/02/28/uber_subpoenas_github_for_hacker_details/ http://www.theregister.co.uk/2015/02/28/uber_subpoenas_githu...

archlight 12y ago

the amazing thing i found uber is after all the gaffe, privacy leak and maybe more. it still grows in such a speed. it surely means something big

bobofettfett 12y ago

Why does sec get breached? Marketing wants easy access to all data, that's it. Big Data / deep learning wants easy access, lots of data is in transit. Security is not convenient for operations, therefor companies have sec on paper and audits and stuff but no real sec.

bobofettfett 12y ago

Why is data lost all the time? Because lists of data exist. Why do they exist? Because everyone is using Excel.