9 ms·

Data accessed on 5/13/2014, uber noticed on 9/17/2014, and then notifies affected on 2/27/2015. Thankfully it was only names and plate numbers, but still... A

Data accessed on 5/13/2014, uber noticed on 9/17/2014, and then notifies affected on 2/27/2015. Thankfully it was only names and plate numbers, but still... All I see from uber is bad publicity and poor management decisions. I wonder what it's like to work there from an insiders perspective, cause from the outside it doesn't look good.

inmyunix 12y ago
the spotlight is magnified
leereeves 12y ago
> [From Uber's blog post] On September 17, 2014, we discovered that one of our databases could potentially have been accessed by a third party. A charitable interpretation might be that they discovered a vulnerability in September, but didn't find the May breach until recently.
joshmlewis 12y ago
I'm not defending them on this because that does seem to be a long enough time to be more proactive about it. You did bring up an interesting point though, Uber is facing opposition from almost every city they are in. Whether it's small town South Carolina where I'm from and even in some of the largest cities in the world. It would be interesting to see how people deal with this on the inside and how it affects the culture.
- Kalium 12y ago
  Uber's in a position where they get flak for breaking the rules while also being painfully aware that following the rules is worse for them. They face opposition, but every time they play nice it doesn't go well for them. The lesson here is that sometimes, you do much better by breaking all the rules.
  - toomuchtodo 12y ago
    > The lesson here is that sometimes, you do much better by breaking all the rules. I guess we'll find out after Uber has exhausted its VC money, if Google doesn't replace them with self-driving cars first.
    - skuhn 12y ago
      Uber is already hamstrung by their inexperienced drivers's reliance on Google Maps for navigation. It is in no way equivalent to actually knowing your way around. The difficulty of making an urban self-driving car aside, Google would have to achieve a quantum leap forward in the quality of their navigation platform. Otherwise every auto-taxi in San Francisco will proceed single file down Van Ness, with turns onto Market or Mission only. All other streets will be empty and filled with pigeons.
      - luddypants 12y ago
        I don't think it would require a quantum leap forward in tech to take traffic into account...
        skuhn 12y ago
        It's not just taking traffic into account, which it can (sort of) already do. They need to actually use the accident data. Use a diverse set of routes to get to the same place, so that there isn't one path for every car on the road. Understand stoplight patterns and where it's hard or easy to make a turn. Not focus obsessively on shortest path rather than most tolerable path. Fundamentally what a good cab driver (which are not that common) offers you is knowledge of the best route to a destination from experience. Google Maps doesn't have that. And if it did, and it controlled a significant portion of the cars, it would no longer be the best route.
        TeMPOraL 12y ago
        You know that you're describing things that machines are inherently better at than humans? And the problems you described stem mostly from the fact that maps also serve informative function (to learn the route in advance), and apparently Google didn't decide yet to compute routes in their navapp based on other active users of said navapp in the neighbourhood. But the data, infrastructure and algorithms are there. > And if it did, and it controlled a significant portion of the cars, it would no longer be the best route. Of course it would, because it would be able to run a global route optimization on all the cars simultaneously, thus outperforming even the most experienced human drivers by orders of magnitude. Getting above human level seems like a college-level exercise.
joshmn 12y ago
Early 2014, you could see the drivers home address, cell phone number, ESN for their phone, the car(s) they had on their account's VINs... list goes on and on...
skuhn 12y ago
It sounds like they realized the API was improperly exposed on 9/17/2014, but didn't necessary know if it had ever been accessed by an unauthorized request. I could see it taking a while to find one bad request in the entire history of the API's lifespan -- presuming that they had to find the logs, weed out false positives, different sites and versions that behaved differently, etc. That still doesn't explain a 5 month gap. The only (charitable) explanation that makes sense to me is that they discovered the API was exposed, thought they had proven it was never improperly accessed, and then only much later realized that it had been after all.
joe_the_user 12y ago
As eddieZone mentions in a post [currently] below this [0], Uber says names and driver's license numbers, which is a good deal worse [1]. [0] https://news.ycombinator.com/item?id=9122369 https://news.ycombinator.com/item?id=9122369 [1] http://blog.uber.com/2-27-15 http://blog.uber.com/2-27-15
discloser 12y ago
I'm not shocked. I recently found a vulnerability in software used by multiple companies in a specific industry - thousands of names, SSNs, addresses, etc open for the taking. I attempted to disclose to a local company that uses the software and never got a response. I think often companies just don't respond the first time, or ever. What can you do?
Vintila 12y ago
I have no experience in this area so could someone explain how Uber noticed there was a data breach ~4 months after it occurred.
- thedufer 12y ago
  I don't know what happened here, but presumably they keep fairly detailed request logs. If they were notified of a security vulnerability like this, they would probably sweep logs for suspicious requests. This way they would become aware of all breaches using that vulnerability, but not until they found the vulnerability, which could be any amount of time after the breaches occurred.

inmyunix 12y ago

the spotlight is magnified

leereeves 12y ago

> [From Uber's blog post] On September 17, 2014, we discovered that one of our databases could potentially have been accessed by a third party. A charitable interpretation might be that they discovered a vulnerability in September, but didn't find the May breach until recently.

joshmlewis 12y ago

I'm not defending them on this because that does seem to be a long enough time to be more proactive about it. You did bring up an interesting point though, Uber is facing opposition from almost every city they are in. Whether it's small town South Carolina where I'm from and even in some of the largest cities in the world. It would be interesting to see how people deal with this on the inside and how it affects the culture.

Kalium 12y ago
Uber's in a position where they get flak for breaking the rules while also being painfully aware that following the rules is worse for them. They face opposition, but every time they play nice it doesn't go well for them. The lesson here is that sometimes, you do much better by breaking all the rules.
- toomuchtodo 12y ago
  > The lesson here is that sometimes, you do much better by breaking all the rules. I guess we'll find out after Uber has exhausted its VC money, if Google doesn't replace them with self-driving cars first.
  - skuhn 12y ago
    Uber is already hamstrung by their inexperienced drivers's reliance on Google Maps for navigation. It is in no way equivalent to actually knowing your way around. The difficulty of making an urban self-driving car aside, Google would have to achieve a quantum leap forward in the quality of their navigation platform. Otherwise every auto-taxi in San Francisco will proceed single file down Van Ness, with turns onto Market or Mission only. All other streets will be empty and filled with pigeons.
    - luddypants 12y ago
      I don't think it would require a quantum leap forward in tech to take traffic into account...
      - skuhn 12y ago
        It's not just taking traffic into account, which it can (sort of) already do. They need to actually use the accident data. Use a diverse set of routes to get to the same place, so that there isn't one path for every car on the road. Understand stoplight patterns and where it's hard or easy to make a turn. Not focus obsessively on shortest path rather than most tolerable path. Fundamentally what a good cab driver (which are not that common) offers you is knowledge of the best route to a destination from experience. Google Maps doesn't have that. And if it did, and it controlled a significant portion of the cars, it would no longer be the best route.
        TeMPOraL 12y ago
        You know that you're describing things that machines are inherently better at than humans? And the problems you described stem mostly from the fact that maps also serve informative function (to learn the route in advance), and apparently Google didn't decide yet to compute routes in their navapp based on other active users of said navapp in the neighbourhood. But the data, infrastructure and algorithms are there. > And if it did, and it controlled a significant portion of the cars, it would no longer be the best route. Of course it would, because it would be able to run a global route optimization on all the cars simultaneously, thus outperforming even the most experienced human drivers by orders of magnitude. Getting above human level seems like a college-level exercise.

joshmn 12y ago

Early 2014, you could see the drivers home address, cell phone number, ESN for their phone, the car(s) they had on their account's VINs... list goes on and on...

skuhn 12y ago

It sounds like they realized the API was improperly exposed on 9/17/2014, but didn't necessary know if it had ever been accessed by an unauthorized request. I could see it taking a while to find one bad request in the entire history of the API's lifespan -- presuming that they had to find the logs, weed out false positives, different sites and versions that behaved differently, etc. That still doesn't explain a 5 month gap. The only (charitable) explanation that makes sense to me is that they discovered the API was exposed, thought they had proven it was never improperly accessed, and then only much later realized that it had been after all.

joe_the_user 12y ago

As eddieZone mentions in a post [currently] below this [0], Uber says names and driver's license numbers, which is a good deal worse [1]. [0] https://news.ycombinator.com/item?id=9122369 https://news.ycombinator.com/item?id=9122369 [1] http://blog.uber.com/2-27-15 http://blog.uber.com/2-27-15

discloser 12y ago

I'm not shocked. I recently found a vulnerability in software used by multiple companies in a specific industry - thousands of names, SSNs, addresses, etc open for the taking. I attempted to disclose to a local company that uses the software and never got a response. I think often companies just don't respond the first time, or ever. What can you do?

Vintila 12y ago

I have no experience in this area so could someone explain how Uber noticed there was a data breach ~4 months after it occurred.

thedufer 12y ago
I don't know what happened here, but presumably they keep fairly detailed request logs. If they were notified of a security vulnerability like this, they would probably sweep logs for suspicious requests. This way they would become aware of all breaches using that vulnerability, but not until they found the vulnerability, which could be any amount of time after the breaches occurred.