Uber Paid Hackers to Delete Stolen Data on 57M People | Hacker News Reader

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

1,720 pointscoloneltcb572 comments

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company.

Don't check secrets into VCS, folks!

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . .

[1] https://help.github.com/articles/requiring-two-factor-authen...

Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake.

One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and an investigation was conducted. It definitely inspires more confidence in leadership seeing that the CEO will not tolerate unethical behavior.

Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source.

In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to source code with secrets in it.

You couldn't enforce 2FA on GHE for the longest time. GHE version 2.8.0 lists [0] "Enforce two-factor authentication" as a feature. 2.8.0 was released November 2016. According to the article,

> Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said.

I don't know if they were using GHE. If they were, at the time it did not come with a good way for them to enforce 2FA for users.

[0] https://enterprise.github.com/releases/2.8.0

This is so gob-smackingly uncommon I started asking "do you require 2fa for your github accounts" as part of my interview questions when I was looking for jobs (i.e. I'd ask my interviewers).

I don't know how to feel knowing that there is even one software-focused company out there that doesn't enforce 2fa on its github accounts. Like... how?! Why?!

uber engineer here, we have 2fa set up for everything. Starting my day takes about 5 different 2fa checks (ssh access, aws, phabricator, team chat, etc)

2FA wouldn't have necessarily solved this, if the hackers had access to an engineer's ssh keypair (e.g stolen laptop) they could clone repos as they pleased. 2FA isn't a silver bullet.

Unless 2fa was bypassed with the token you get from GitHub in order to use the git client via https.

Maybe it's just me, could "private GitHub coding site" have meant a private GitHub repo with GitHub pages turned on?

If that were the case, there would be no authentication whatsoever to access the closed-source site; the hacker would have just needed to guess the right url.

Working at another large tech company, this does not surprise me.

Edit: I mean it would surprise me if it wasn't recommended practice, but it would also surprise me if it was somehow strictly enforced.

The most I've ever personally seen a company do is require a VPN for their privately-hosted repos. For others using GitHub or Bitbucket? Never anything beyond a standard login.

2FA doesn't help if they used SSH access

that doesn't protect you from GitHub employees snooping around.

Two factor won't protect you from a spear-fishing attack.

The attacker can submit your info to GitHub the moment you submit to the malicious site. You receive the token via SMS as expected, enter it on the second page of the malicious site, granting them access.

Do we know how the attackers accessed the github repo? If it was via malware on the employee's machine, or cookie theft then 2fa wouldn't have helped.

No, 2FA would not have prevented disclosure of credentials in GitHub. The fix for that is to not check credentials in to GitHub. Nothing else.

I mean they don't say how they accessed the GitHub repo or whether there was a vulnerability in Github itself that allowed access

You can use tools like Talisman which registers a Git hook to check if you are checking in anything that looks like secret.

https://github.com/thoughtworks/talisman

We use a tool under a Linux Foundation project called anteater https://github.com/opnfv/releng-anteater, which does the same thing (but is for a jenkins / gerrit workflow). A key difference from looking at talisman, is anteater uses standard RegEx rather then code to seek out strings, so anyone can add their own strings / file names easily into a simple yaml file. Like wise they can use regex to provide a waiver, should something be incorrectly reported.

I am thinking now would be a good time to port it to working with webhooks as well.

The tool would have blocked the aws credentials from being checked in: https://github.com/opnfv/releng-anteater/blob/master/master_...

It's not foolproof but this tool needs to be more widely-known - it would've saved me on countless occasions.

Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?

I've never used it in production (my last shop was heavily AWS based and relied on IAM), but I always like the look of Hashicorp's Vault [0]

https://www.vaultproject.io/

When it comes to security, there are no dumb questions.

There are a few SaaS offerings that will let you do that. LastPass or onepassword are two commonly used.

One you can use something like keypass to store a database in a shared location if you don't trust the SaaS offerings.

If you are looking at storing credentials for automation purposes, and don't have a secret store built in, you could look at something like Hashicorp Vault to help provide this for you

I think that something like Stack's Blackbox is the best idea. This ansible-based setup also explains the concepts pretty well: http://ansiblecookbook.com/html/en.html#how-do-i-store-priva...

In person I use a thumb drive. You could encrypt the credentials using PGP and send it to a coworker if they are remote.

Sometimes I just go on google hangouts and share my screen if I'm feeling lazy.

We're using Keepass / MacPass password protected vault shared with the team using Dropbox. It's really good and essentially free to use if you use a free Dropbox account.

Keepass and keybase team repo to sync.

We launched EnvKey[1] a couple months ago to offer an easy-to-integrate solution to this issue.

1 - https://www.envkey.com

We use 1password for teams.

Just pigging-backing on your comment. If you did, here's a guide from Github on how to remove it: https://help.github.com/articles/removing-sensitive-data-fro...

They key part is "Warning: Once you have pushed a commit to GitHub, you should consider any data it contains to be compromised. If you committed a password, change it! If you committed a key, generate a new one."

Removing the secrets from the repository is nice to have, but not that necessary - what is mandatory is to ensure that the compromised secrets are no longer useful, since they aren't secret any more and won't be ever again.

I am rather disappointed in github for publishing this guide. The portion at the top stating

> Warning: Once you have pushed a commit to GitHub, you should consider any data it contains to be compromised. If you committed a password, change it! If you committed a key, generate a new one.

Is a good argument as to why you shouldn't let users erase this data from history, it's already out there so no matter how painful or convoluted your process is for regenerating auth credentials is, you need to do it if you've published them into your SCM. If the process is painful you might want to simplify it because you'll probably need to do it sometime in the future again... yes even you large corporate workers who have no control over credential regeneration, an arduous process leads to credential sharing between projects which is another horrible thing.

"Don't check secrets into VCS, folks! "

I suppose? But at this point they have your code base. You are so owned at that point.

Yeah, but hopefully they can't do much if they just have your code base. If the secrecy of your code is the only thing stopping hackers from exploiting you, you're missing some gaping holes in your infrastructure. With that said, nothing wrong with using secrecy as a additional barrier, but shouldn't be the only, and if it's not the only, you're not "so owned at that point".

Really surprising to see that sensitive credentials were checked in to VCS. Apart from peer code review, how can a company avoid developers checking in sensitive data to VCS?

You could have a git hook (even remote) that would check for pre-configured patterns and reject the push if it contains them.

Quick google yielded this https://github.com/awslabs/git-secrets

Plug: https://github.com/thoughtworks/talisman

I really wish AWS would stop enabling master API keys by default. As soon as you create an AWS account you are given API keys which basically have SUDO permissions to your entire account. That is super dangerous and is probably the same key set that these hackers got ahold of. AWS needs to disable these full access API keys by default and instead should encourage users to generate keys for specific access to limit what they can do.

Totally agree. I am moving secrets onto consul/vault - would like to hear what others use for the same.

git-secrets is a pre-commit hook that regexp's out secrets and blocks commits

https://github.com/awslabs/git-secrets

Things like this make me feel much less concerned about the confidence gap.

I'm not even mad, thats a good bug bounty

From what I hear it's pretty common...

It's very common, but there are lots of ways of addressing it.

But you have to put them somewhere; how is idk, AWS credential management secured?

Store credential information where it is used. It is not used by the repository, so it is an improper location for it.

If someone gains access to a system that uses the credentials, then there is, in principle, no difference between puppeteering that system versus stealing its credentials.

> Don't check secrets into VCS, folks!

Ok, how do you handle a bootstrap problem?

Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known.

The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will resign, those who take the job would actually take an interest and have the ability to do so.

An idea whose time has come.

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear.

No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against.

There are millions of motivated adversaries out there and a finite number of employees at your company to outsmart them. It's a game you can't win. The larger your company becomes, the broader your attack surface becomes, and the higher value a target you become.

You just have to hope that when you get hacked, it is a "forgiveable" hack like a zero-day or highly targeted attack.

If CSO's are to be personally accountable for the malicious actions of others, it needs to be due to clear negligence on their part and the responsibilities need to be clearly defined.

Not because you got hacked. No. Hell no. I never suggested that and reject it totally.

We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your board of directors.

CSOs, senior management, boards of directors should be personally responsible for their own actions. They need to have something at stake that they really dread losing when making the decision "perhaps we can get away with this?"

The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data?

And how do you make that scale? If I miss a semicolon and leak 5 people's data, then I'd hardly get any jail time. If I miss a semicolon and leak 150,000,000 people's data, I will die in prison. In both scenarios, I made the same error, but the outcomes were insanely different!

IANAL but isn't it already the case that if you knowingly break a law, you can be convicted and sentenced to jail? In this case, I'm assuming that it's not against the law to cover up a hacking incident, in which case there's no basis to suggest putting someone in jail.

Covering up isn't done by the CSO. It'll be driven by lawyers, or worst-case by a rogue CEO. Mind you the CSO would be expected to resign under those circumstances, if they were kept in the loop on the cover up plan.

It's not really much about that Uber got hacked, which is bad enough. It's that they paid off the hackers and didn't tell anyone they got hacked until now.

I’m not sure the previous comment is saying in all circumstances. I agree with what you’re saying - because higher officials obviously aren’t able to catch every mistake made by every engineer but I think the parent comment really meant that if there is gross negligence or intent to cover up breaches then that seems like a crime that the individual should be punished for.

You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn't be given a pass on everything either.

So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence?

> A random engineer could make a mistake that gets hackers a step closer

That could be prevented, to a large extent, with much tighter controls. Of course, those controls would greatly increases the cost of operations and other things.

Is it possible we're all accustomed to the wrong model, that our standard of IT security is like the standard of car safety in the early auto industry (and maybe until the 1970s) - far too lenient? Maybe we should be facing the potential fact that the normal cost of IT should include those controls and other security expenses.

> So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence?

By analyzing how they prepared for the inevitable attack (mitigation), as well as how they respond to it after the fact.

> You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn't be given a pass on everything either

Sure they can. It is called "insurance". Sort of like malpractice. CSO wants to get paid millions of dollars? Excellent, either be personally on the hook or have an insurance company that would be willing to underwrite your method of dealing with it, be that having your own crack team of people who get to oversee everything, or relying on Jr system admins from your company or whatever else.

If you can demonstrate due process and reasonable effort to secure against breaches, your doing your job. For instance with described procedures, sane defaults, locked down environments ect. But if you're a CSO and have not described threatmodels, workflows, and security practices, then you've not done your job and should be held accountable for data breaches.

You're in charge of security at a large e-commerce company, and your view is that your company is bound to get hacked?

I think that's a very sad commentary on how little your company values security.

I think your perspective is either immature or unrealistic.

OP's a realistic. His perspective is nothing to do with how a company values security.

No one in security assumes they won't get hacked, we assume we will and when we do get compromised. Our metrics aren't measured on if, our success metrics are:

* How quickly we find out * How much damage we can mitigate * How quickly we mitigate the risks and controls for X vulnerability and * How we incorporate our reporting to find trends to find the event quicker next time

Now we report on many compromises. I'm not talking just about data breaches here, there's a whole spectrum of compromises that we manage and mitigate.

I don't know anyone who operates in Security who has a different mindset to OP.

Our company cares more about security than anyone in our space, if you look at how much we invest relative to the others. We have full time penetration testers on staff. We contract out to countless third party security vendors. We take their advice.

This has nothing to do with not valuing security, it's just about being realistic. Can you guarantee that your company is hacker-proof? No? Then we're on the same page.

More a sad commentary of how many people think there's some magic bullet of security practices and if they just follow those, then they won't be hacked.

If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems.

Otherwise, you'll be like a former coworker that refused to secure internal systems because "We paid a lot of money for our firewall, it's going to block any hackers". It took me less than 30 minutes on my first day to hack the login passwords of senior executives because they logged into a non-SSL reporting server (and I did through a simple MAC overflow attack on a network switch from a network port in the break room)

There is personal liability for board members and management boards (CEO etc.) in many (most?) jurisdictions, usually including for some things that they should have known but didn't know, typically if the "not knowing" part can be characterized as gross negligent.

Also, the personal liability for board members and managers is something that is exceedingly pursued by shareholders and creditors (for the financial liability) and prosecutors (for the criminal liability) compared to how it used to be.

I don't think it matters much, though.

How to implement though?

You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats. Also never underestimate just how disorganised large organisations are, incompetence at addressing issues is systemic and goes far beyond data protection. What seems like malice is sometimes just plain stupidity.

It has to be backed by some sort of regulatory framework. Just like a fire code or employment rights. But crafted in a way that it doesnt end up like PCI, ratings agencies or financial auditors. IE creating an industry that sells compliance and not actual security.

Perhaps something light, like mandetory minimum bug-bounty schemes for all companies, where fines (or more) are imposed for not addressing issues and an independant regulator works with larger companies to resolve issues (or penalise the company severely if they deliberately wont).

No, don't get hung up on unnecessary details.

The reasonable company director should have known X and when found out was bound to report it. Person Y did not report it, should have known as it was their job to know and there aren't extenuating circumstances. Guilty. 6 months. Next case.

"I don't know anything about this company I accept 7 figure sums to oversee as a director." Should never be any kind of legal defence. If senior management and directors have something personally at risk you'll see vastly improved behavior. Right now we're selecting for the opposite and seeing the inevitable results.

There is a story like this about directors and management cover ups every single day

So person Y read an email late at night and forgot about it. So you send a director to jail. Tomorrow many of the "good" directors feel scared and they simply do not accept any new appointments.

Who will fill the void ? People who are overconfident and people who are not scared of going to jail.

It's much better to impose financial penalties. Should the directors or the shareholders pay ? Let them figure it out between themselves!

Doesn't PCI work well in general? It has a large amount of overhead but we see very few credit card breaches from within the "PCI vault," while we see many Social Security number breaches and email/password combinations.

For example, the Target credit card breach occurred because malware intercepted the credit card information at the Point of Sale appliances before the information was encrypted and transmitted.

Prison time seems extreme, but Congress should should absolutely establish statutory fines (for companies) for breaches of PII. Then any company officer can save the company money by simply spending more on prevention because it will lower breach insurance premiums.

You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats.

WEll that's already happening without jail time so maybe give it a whirl. LEt's get real here, the idea of suits going to jail is just scary to some people but it'll be fine.

What's the largest group of people you've managed?

> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection.

This happened more than a year ago, and only now that they're planning on offering identity theft protection? That's ridiculous.

> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection.

"Sorry we left uranium in your house a year ago and didn't bother telling you. Here's a coupon for free cancer screenings."

Obviously because only now it's come to the public's attention.

Man, I don't know if Uber is evil or if most tech companies are evil and Uber just doesn't drop the kind of money on PR strategery that an evil company need to drop in order to seem normal. But either way, holy cow does that company come off as toxic. They've completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers (to the point that the CEO of Apple had to have a Come To Jesus talk with the CEO of Uber) or how their employees feel like they are getting screwed or, now, how they are concealing massive data breaches. It's like how I imagine Uber would be if it was run by Magneto instead of Tony Stark.

>and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers

I don't think the average Joe is up to date with this news, or even care about.

Nope, they don't know. My non-tech friends are all using Uber / UberEats with no clue about the company, and the CEO. They just see an easy to use app to get what they want quickly.

I don't know. I've received a lot of flak for even using Uber from non-tech friends/dates recently. I think the continual tide of negative publicity is definitely having a material effect on their brand image.

Does anybody have a link to a good source on this? I'm behind on this myself.

And testing their self driving cars without getting the proper permits. And hiding shit like this from investors so they’ll lose a lot of money later.

I would never work as an engineer for a company like that. How can I trust that it will honor any deal I make and not screw me? I have to think about that with every company but this one in particular can’t even spell ”integrity”.

That's silly. Uber has a revolving door with Google and Facebook. Nobody is getting screwed, or it would not work to hire people away.

Magneto is pretty concerned with ethics and morality, I think Uber is more owned by Tony Stark on a particularly bad binge.

Tony is a changed man! He even voluntarily subjected himself to regulation. We need a new target.

I never quite know how to think about them. On the one hand, they’d changed an entire industry in a way that people wanted but was getting serious resistance from the entrenched players. They had to break a lot of rules and go around a lot of people with a whole lot of connections to get where they are and in the process made a lot of enemies.

I expect blowback. I expect negative news. They essentially pulled it off by looking at every day as combat where fighting dirty was rewarded.

You can move fast and break things without being a jerk or a misogynist. They don't get an excuse because they mixed the two up.

No excuses for a systemically misogynistic corporate culture. I deleted Uber. You probably should too.

https://www.theguardian.com/technology/2017/jun/13/uber-ceo-...

AirBnb had to fight a very similar path and the only bad press I can remember about them was that tone deaf/ offensive political marketing campaign they had.

Plenty of companies have disrupted plenty of industries by now, but without this kind of behavior. I don't see how the way they dealt with the data breach was required to disrupt the local ground transportation industry, nor was the way they've treated employees (including drivers) and customers.

I haven't heard stories about how Uber employees are getting screwed. (Presumably financially?) Are you referring to Uber drivers in this comment?

Protip: Uber's own bullshit aside, their drivers are employees.

Who are getting screwed.

As much as I hate blaming the victim, but giving your personal info just to get a Taxi ride is utterly moronic. I don't want to have any relation of any sorts with a Taxi, I ride I pay and bye.

Having to register for that is quite surreal.

>to spy on their employees and customers

To be fair, they weren't spying on their customers. They were fingerprinting phones which is against the Apple ToS.

In that case, yes. But they were definitely spying on journalists, law enforcement and other potentially critical users

That concealing was a year ago. Now discovered by an internal investigation and disclosed. CEO has been different for a few months too.

Now with them investing heavily in self driving cars, they aim to avoid paying drivers.

Uber is like the Donald Trump of corporations. It sets new ground in how openly vile you can be without any consequences. Just like Donald Trump the real danger is not in Uber itself but in whatever it will be that uses it as a role model.

I propose a new law, similar to Godwin's.

"As an online discussion grows longer, the probability of a comparison involving Trump approaches 1"

Just yesterday, I got some serious flak for suggesting that changing one person in leadership wasn't enough to make them not evil. I'm sad to see just how bad this is/was, but I'm not one bit surprised.

No substance post, seeking the political low hanging fruit. Looks like the new crowd here loves it, giving you plenty of up votes.

I'm not sure if that's an accurate analogy. Few politicians would want to find themselves working in the climate Trump has found in Washington, (if anything, he has proven that a groundswell of popular support can't unseat a party establishment). Also, it simply would be inaccurate to describe Uber's actions as impotent.

Edit: allow me to replace the word "found" with "created." I was just using a figure of speech.

Private repo or not, checking your credentials into git is amateur.

I’d normally say eventually it’d bite you if you fall into the habit and do it on a public repo by accident but it looks like it can bite you on a private one too.

Manage your secrets. Use something like Vault[1] or Pass[2] they’re free and awesome projects.

I keep all of my secrets even non-prod ones in one of these two because if you think about it, even your “non-prod” github credentials are kinda prod since you have access to code.

1- https://www.vaultproject.io/

2- https://www.passwordstore.org/

Also when it comes to AWS secrets, give your developers read only access, make them turn on MFA and assume a role that scopes permissions to the work they need to do.

Leaking AWS secrets is really asking for it. The amount of bots that consistently scan public git repos and then use the credentials to spin up massive instances to mine crypto currency is impressive. I’ve seen it do upwards of $10000 in AWS usage within five minutes of the commit containing the credentials.

If you still want to use a Git repo, at least use an encrypted Keybase teams repo[0].

[0]: https://keybase.io/blog/encrypted-git-for-everyone

It may be amateur, but it's one of the most common mistakes. Even at top companies.

Amateur may not have been the best word. Maybe easy or lazy or debt. Ive seen it a lot where it was something that was inherited and the current team knows its a problem, but they have a 1000 features to build and never get around to fixing that debt.

The cure for this is to get a pentest. It forces you to care.

If the FTC doesn't act on this they are toothless. Uber's blatant disregard to anything accountable or respectable is astounding:

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014. After last year’s cyberattack, the company was negotiating with the FTC on a privacy settlement even as it haggled with the hackers on containing the breach, Uber said. The company finally agreed to the FTC settlement three months ago, without admitting wrongdoing and before telling the agency about last year’s attack."

One would hope the next settlement would have more teeth.

If I was running the FTC, I would not settle this time, because it's blatantly obvious Uber was acting in bad faith last time around.

I hope the earlier agreement contains language that allows it to be voided, and put all the original violations back on the table. If there is no such term, this is one relatively straightforward way to improve the handling of these matters in future (if a company was unaware of other breaches at the time and appeared to act in good faith, the FTC could always choose to let the original agreement stand.)

"Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company."

Seems to suggest they committed AWS credentials into source control?

81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches or data leaks. Most organizations believe that 2FA and SSO are the answer but this proves that 2FA/SSO are not enough.

81% — that is a very precise number.

Folks should be using short lived aws tokens to avoid the possibility of having tokens in source control: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentia...

If the attack was conducted using login credentials found on github how does this prove that 2FA/SSO are not enough? Wouldn't 2FA have prevented easy use of these credentials?

Do you believe this kind of thing is simply unavoidable? I wonder if this could've been avoided by simply making it impossible to access data without being connected to a VPN in addition to having some sort of physical device connected to your computer.

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014."

Because you know...20k really really hurts for a company like Uber.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups.

The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willing to pay. If the parents were fined a day's daycare fee for being ten minutes late you can bet their attitude would change.

I see company fines in the same light - they formalise the process of absolving responsibility and moving on. Just pay the toll and continue to handle your customer data cavalierly.

It's in the book Freakonomics, when talking about economic, social, and moral incentives.

The day care changed what was a social incentive for an economic one, and then couldn't reverse the consequences: Not fining the parents anymore didn't reduce the number of late ones to previous levels.

Well, day care operators have since learned...

... as I sit in my home office, just over an hour away from day care closing time I assure you I'm watching the clock like a hungry hawk watching a mouse. See, my kid's day care charges a mere $600 per hour late (billed in 1 minute increments).

I don't see kids parents late that often :-) and we've come close to missing it, but haven't in two years.

The way you fix this is by making each 5m late cost 2 gallon of milk. If you are late for 15m that's 6 gallons of milk, an operational burden has been passed to the late parent. It's embarrassing to bring in 6 gallons of milk, an inconvenience to buy and deliver it, and an effective deterrent.

And the fine should always be bigger than whatever the company pocketed from the "crime" during that time.

I think it was AT&T or Verizon that got fined the "record" $3 million by the FTC for tracking users' browsing behaviors for like 2 or 3 years.

The FTC should have asked (subpoena I should say) the company for reports on how much money it made per user from that tracking for the whole period, and then charge it a multiples of that.

Did it make $1 billion? Charge it $2 or $3 billion.

And do this sort of stuff across industries with a regular occurrence, so that companies can "expect" such audits, and so they don't just think it's a one in a decade fine that maybe one company in the industry will get.

I think you'll see abusive behavior drastically reduce.

Wait until the EU GDPR kicks and in fines of up to 4% of annual turnover or 20 million kick in...

> The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willing to pay.

The real question in this story is this: If you find that you have customers who are willing to pay you more for providing more service ... why not provide that service? You get more money, your staff gets paid overtime, parents get peace of mind, everyone's happy.

>Just pay the toll

especially when the cost of doing the right thing is higher.

i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor

Here's an article about that: http://www.nytimes.com/2005/05/15/books/chapters/freakonomic...

I know about day care in Bay Area which is charging $20 per 5 minutes delay. I guess that's the reason:)

This is mentioned in Dan Ariely's Predictably Irrational.

our daycare calls the police ... quite a deterrent I'd say

This would have been interesting if GDPR was applied.

https://www.gdpr.associates/data-breach-penalties/

"There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher.

The Parliament had requested for fines to reach €100 million or 5% of the company’s global annual turnover. The agreed fines are the compromise that was reached."

> The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher.

Why do big firms get off easier than the smaller firms?

Something nice is also the fact that the people impacted by the breach must be told 72 hours max after the company is aware of the hack.

Even larger fines seem to draw weak behavior change. The U.S. corporate structure is remarkable in that sense. It shields employees (especially executives who often don't carry out orders) from criminal and financial responsibility for their actions.

This is not true. Back when JPM was being fined billions of dollars when the Southern District of NY was after them, they were quaking in their boots internally while at the same time redlining PR efforts to project external calmness.

Huge fines do exactly what they’re intended to do. JPM for instance responded by making legitimate operational changes to detect all manner of financial malfeasance within their organization.

What? Uber acted in an unethical manner? Seriously, is anyone surprised? I kinda hope (but not really) that they get hacked again in June 2018 and play the same trick.. us in the EU will have a party on Uber's corpse over GDPR.

And then we can go back to getting ripped off by taxis. I’ve lost more money in taxi rip offs than I ever spent on Uber.

Other than the sexist nonsense of the CEO, there really is an irrational hatred of Uber. Are many of us secretly moonlighting as cab drivers?

Uber’s nonsense is minuscule compared to generations of taxi corruption.

This isn’t me excusing Uber but it does seem like many people, especially Europeans have an inordinate amount of glee over anytime AirBnB or Uber get in trouble. Has the hacker ethic really devolved into statism?

We should be cheering over disruption of the status quo. Does anyone actually long for the days of getting ripped off by over-regulated and over taxed hotels and taxis?

Do you people actually like having government pick winners and losers? Do you actually trust government to do the right thing? Governments have a strong track record of stifling innovation, abridging freedom and giving regulatory handouts to the privileged classes. People here get all kinds of sanctimonious when it comes to patents and copyrights yet seem to fall firmly on the side of the entrenched incumbents when it comes to things like disrupting hotels and taxis. It’s a weird double standard; a hatred of government when they want to prevent people from stealing movies, but a love of government when they want to prop-up taxis and hotels.

The bad PR might hurt more but I would error on the side of caution and say it has little effect. I have talked to drivers and passengers and they are unaware of those things .

I bet the statutes define fines the same for any party with some maximum. States could charge a percentage of revenue, cash on hand, valuation, but those are easily fudged to minimize liability.

more than 100% of their profits?

Yep.

About that time my Uber account was 'hacked' and someone kept requesting rides in Florida and I had to cancel them as fast as they made them.

I emailed Uber support and they got back to my 3 days later.

Then someone proceeded to try to gain access to every account I had with that email and password (yeah, yeah, I know). The next worse was someone getting into my DigitalOcean account and launching an instance.

It has finally settled down, I occasionally get alerts from people trying to break into something but lots of 2FA and no shared passwords anymore.

I am not sure if this was Uber's fault or another site's but the timeframe of Oct 2016 lines up.

In the disclosure it says that the attack included names, email addresses and phone numbers. It did not contain any passwords or social security numbers, so your passwords must have been compromised in some other way.

It's not related to this particular breach, but given this and Uber's other issues, it's not out of the realm of possibility that at some point they had a more serious breach involving loss of password hashes or interception of credentials at login.

(But in all likelihood the poster's account was just compromised through the usual means, otherwise there would be more reports of hacked accounts.)

Uber accounts are frequently sold on underground markets - they're sourced via endpoint malware and shared passwords

You should check over all of your accounts and machines - I doubt it has anything to do with this leak

check your email on https://haveibeenpwned.com

... so honestly, at this point, we basically have another Uber thing every 2nd week.

I do not get why there is no legal action taken against Uber or even steps to shut it down.

So much of the stuff violate basic laws how to run a business, apart from the humongous flaws in Ubers ethics and damaging effects on society.

From the article: "After Uber’s disclosure Tuesday, New York Attorney General Eric Schneiderman launched an investigation into the hack, his spokeswoman Amy Spitalnick said. The company was also sued for negligence over the breach by a customer seeking class-action status."

I read that, what I do not get is how the difference in judgement can be justified.

Small companies will instantly get sued and pay fees ruining them for this things. And that already the 1st time it happens. For Uber this is beyond ten finger counting in terms of issues in the past two years.

It is just not having any consequences and by now from the legal side you can conclude that Uber is a repeated offender which has not learned anything from previous cases.

So, my point stands. When will this actually lead to consequences and justice being served?

Something about this is sitting right with me.

I know Joe (the ousted CISO). I’ve known him for almost 15 years, and worked with him professionally in the past.

This is not like him. He was the most ethical lawyer I ever met. Everything was by the book. He cares about privacy. He cares about users. He’s prosecuted the worst of the worst.

Something here isn’t right.

CSO/CISOs are basically there to be the fall person in the case of a data breach. Your job is basically to implement process and policy to the point of nearly breaking productivity, then get fired when that wasn't enough.

I am amazed at the things Uber gets through and is still standing after...

Never underestimate the power of marketing. My mother for instance would use Uber over any ride-sharing system due to its insane exposure and the fact that these stories remain relatively unheard of in comparison.

My family and friends outside the tech industry have almost no clue about nearly all these scandals - especially the data breaches and the former CEO's indiscretions. About the only thing they hear is that some Uber drivers have assaulted passengers in the past, but they write that off against the fact that a lot of Taxi drivers have done the same in the past.

It is a telling example that the pain point of a bad taxi service in a city is usually enough for them to conformance rationalise that Uber is still a better alternative, despite any of these issues.

It's already way more common to use "Uber" as a verb, or even a noun, that doesn't necessarily even mean Uber the company itself.

People have asked me before if I'm about "to uber" or "take an uber" someplace and they say it in an obvious way that implies "any ridesharing company" (or lyft in my case since most people know I only lyft nowadays).

Uber just as a word for ride-sharing has become ingrained and won't be easy to get rid of, IMO.

It’s weird, I’ve been using Lyft as my only ride-sharing service for almost a year, but still catch myself saying “I’ll Uber over there in a bit” all the time. It’s definitely because saying “I’ll get a Lyft” is indistinguishable from “I’ll get a lift” and I was to disambiguate that I’m talking about a ride-sharing service, but I wonder how many other people do this and if (in several years at least) their trademark is in danger.

She used uber because the service is fantastic.

Their investors are too big to fail (to recoup their investments by IPO offloading to the sucker public).

Money.

how does this stop being the case? money > all else.

Laws & strong enforcement, with an informed population.

While money gives power, the concern is that it's concentrated in a small number of people. Voting is not, and can result in controls of essentially any level.

Start communities that use solar/wind energy, grow their own food (maybe using this in urban areas: https://www.media.mit.edu/groups/open-agriculture-openag/ove...), use WiFi mesh networking, maybe launch their own satellites (for inter-community links: https://newatlas.com/tubesat-personal-satellite/22211/), build their own things with multi-material 3D printers (maybe even print semiconductor components, who knows...) and employ barter rather than artificially scarce magical paper or e-coins. Also, employ "DIY Bio" in ethical life enhancing way, open production (open source everything etc) The technology and paradigms exist today or will fully exist soon.

Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same.

I plan to never use Uber again.

Uber employee chiming in - while I entirely sympathize with HN's frustrations around our ethics and can't really justify our actions around this data breach, it is very much worth noting that Lyft would not exist were it not for Uber's extremely aggressive practices. There were/are far too many protectionist policies at play at most locales that -- not out of pure coincidence -- needed a company as aggressive as Uber to pave the path for a better option for both riders and drivers (over existing taxis).

We fought all the battles, took a hit on our reputation and set it up nicely for Lyft who very smartly played along with the nice guy approach to capitalize. Net-net, no Uber would have most likely meant existing taxis everywhere and as most riders/drivers will tell you, there is nothing inherently better about either app, they offer the same, pay the same but vastly differ in perception.

That said, we took our aggressive attitude way too far. In an ideal world, Travis would have evolved or replaced himself a couple of years back once the company essentially reached escape velocity where our consumers themselves became our most fervent supporters. Unfortunately that did not play out and making a near perfect switch like that is probably unlikely.

Given this important context, I hope you will give Uber another chance as in the end, Dara and the employees are genuinely trying to evolve by doing the right things and putting all of this behind us. You can get some sense of this from going to sites like reddit.com/r/uberdrivers (or r/lyft) and seeing the changing perception at least from the driver side of things.

I disagree that Lyft would not exist; Lyft invented the UberX category. Originally Kalanick complained about Lyft's creative interpretation of the law, before succumbing to internal employee pressure to introduce a competitor. Years after its introduction, Kalanick admitted that he didn't believe in UberX until it demonstrated its success.

That said, almost all of the notable legislative and regulatory battles were conducted and won by Uber.

The wrongful actions by companies do get forgiven eventually, as toxic executives leave (as in the case of the CEO, Legal Officer, and now the CSO), but no public is foolish enough to immediately absolve any company of wrongdoing. Uber will have a reputation for sexual harassment long after it meets or exceeds the standards of other large companies.

Are you saying the end justify the means? The problem is that over and over and over we see companies breaking the rules, reaping massive rewards as a result of unethical practices, saying "sorry" and then carrying on with no real consequences. It sets a horrible precedent and unless people start being punished instead of rewarded(!!!) for their actions nothing will change.

I drove for Lyft and Uber during that era, and I promise you lyft was doing just as much to fight those protectionist policies, they were doing it with a lighter touch. In many places they were making headway, and then Uber's asshole tactics wound up turning it into a two-steps-back situation (getting ridership access to San Diego Airport e.g.)

You've got your history wrong. Lyft actually launched their ride sharing service before UberX. So don't take credit for Lyft's existence.

Sorry, no.

It's not like Uber did one bad thing. Uber has been a fountain of terrible things for years and years. You even admit that Uber's market-dominant position has been been achieved through those terrible things. And those are only the terrible things that we've discovered despite Uber's energetic attempts to cover things up. Lord knows what horrors you're still hiding.

Until Uber loses their ill-gotten lead, I won't even consider using them.

I don't buy your view of what transpired. "In an ideal world", "making a near perfect switch like that is probably unlikely", "took a hit on our reputation", etc. None of these truly recognize the actual weight of what Uber has done as an organization.

When I deactivated my account it was a huge pain, I had to reply to 2 emails, and in the end it took 5 days to complete. That alone annoyed me enough to never go back.

The current deletion process is smooth and can be completed in-app.

I also do this where possible, but Lyft doesn't operate outside the US. I wish they would launch in the UK, at least.

Only reason I use them is because of Uber Green, otherwise I use Cabify and tell everyone to do the same.

Good, it's important to judge a company of 10k people on one person's story. That's usually a great strategy.

I'm not defending uber, but this kind of attitude is exactly what got Trump elected. You can't generalize and demonize entities based on one person's view.

You might have a point if this was a different company, but look at the context - it's Uber. Probably one of the outright most scummiest companies out there.

> this kind of attitude is exactly what got Trump elected

Not really seeing the connection here

Same here. That and that video from the driver that bought a black car to drive it for Uber and ended up in massive debt.

You'll find that thinking like that will only lead to misery at worst and hypocrisy at best. For example, if you live in the United States (though this logic applies to any country, really), you'll be interested to know that the US holds the world record for the amount innocent civilians killed [1].

[1] https://www.globalresearch.ca/u-s-holds-the-world-record-of-...

EDIT: I realize I sound far more judge-y than intended in these posts. My overall point is that people should just do whatever makes 'em happy while doing the best you can (w.r.t. everything else). Trying to emphasize the morality in your actions is just wrong, imo.

Don’t let hypocrisy stop you from doing the right thing. Sometimes you need to climb one tree to cut down another.[1] That’s ok.

[1] tbh I don’t think you do, but I like the analogy so I’m keeping it.

We can vote for people who don't want the US to kill civilians while not using Uber. I don't see the conflict here.

If you're not willing to restructure your entire life to the point of renouncing citizenship of the country you were born into then you shouldn't ever make any choices based on moral principles whatsoever? uh.. what??

https://yourlogicalfallacyis.com/black-or-white

Amazon's access control and authorization system is the current most important broken thing in the industry.

The Joe Sullivan details are the lurid stuff that propels news story copy, but the important takeaway is that almost nobody, including companies with serious investments in security, can safely get a large-scale dev team deploying onto AWS.

This story keeps getting re-told, and has been for something like 5 years now. It's a problem, and it needs to get fixed, decisively.

Full disclosure: I'm the founder of CloudSploit[1] which aims to reduce these risks.

You're definitely on to something here. While I wouldn't call AWS security "broken," it is next to impossible to implement it correctly in any medium to large size business. There are 30+ services that AWS provides, each with an infinite number of security controls, JSON-based policies, etc. Cross-service access is even worse. Almost every service has some form of sub control that extends or complements the main security tool (IAM). KMS has key policies, ECR has registry policies, SNS has delivery policies, etc. S3 has perhaps the most confusing permission policy in existence, which has led to scores of high profile hacks this year alone.

There are 12+ public regions now, with more coming every few months, each fully enabled, yet segregated within the UI and API (which makes detecting attackers who have embedded themselves in unused regions more difficult).

All it takes is literally one typo in a single user's policy and leaked credentials and you're environment is completely compromised. Recovery is next to impossible without basically starting from scratch because you'll never find every tiny hole the attacker left as a backdoor for later without combing through GB of CloudTrail logs.

Now take all that, put it in an organization with 500+ engineers and you can see how easy it is for this to happen. Think you're safe by putting each team in their own account? Well AWS supports cross account role provisioning and engineers can easily set that up within their accounts. The spider web of issues is endless.

[1] https://cloudsploit.com

> While I wouldn't call AWS security "broken," ...

That doesn't match with the rest of your comment. At all. What would you call broken, then?

> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection

This got to be a running joke now. Companies lose the data and offer credit/theft protection than facing the consequences. If Equifax could get away with the giant breach, I am sure Uber will not even feel the heat. smh.

I moved to the US in April was and shocked by the Equifax breach, but more surprised to hear from a coworker how often these “free credit/identity monitoring for a year” situations occur.

One co-worker is covered by no less than four groups who failed to look out for him earlier, all for trusting companies to not screw up PII or remember that data is a liability.

Yeah, this happens a lot here. I mean the cheapest and most effective way for companies to get away.

It'd be nice if I could register for 2FA with all the various agencies. Commenters have suggested paying a fee to 'freeze' credit activities but the process to 'unfreeze' them requires no new information than what's already in most of these leaks...

From https://www.nytimes.com/2017/11/21/technology/uber-hack.html

> Two hackers had stolen data about the company’s riders and drivers — including phone numbers, email addresses and names — from a third-party server, putting the personal data of more than 57 million people at risk. The hackers approached Uber and demanded $100,000 to delete their copy of the data [...].

> Uber acquiesced to the demands. Under the orders of Travis Kalanick, who was then its chief executive, and Joe Sullivan, the chief security officer, the company paid the ransom.

> Then Uber went further. The company tracked down the hackers and pushed them to sign nondisclosure agreements [...]. To further conceal the damage, Uber executives also made it appear as if the payout had been part of a “bug bounty” [...].

IANAL but I did some basic visualization work as part of a story on US state data breach regulations. What may be Uber's undoing is that they must have the drivers license numbers for all of their drivers on file and that is considered PII by 45 states (nevermind that they also missed their reporting deadline).

And if you're interested, a gif of the data:

https://imgur.com/Rm32MeC

The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for?

If it was paid to hackers it's unlikely that finance cut a check. I'm imagining this was paid in bitcoin or similar. How was this able to be approved?

I'm guessing someone created a fake invoice? Wouldn't that constitute fraud?

Who needs to approve it? How would you know they didn't?

Generally your finance department needs approve purchases beyond a certain dollar amount. This is pretty standard stuff.

If they got it approved as such don't you think the CEO would have been informed that there was line item from Security for ransom?

The article states the CEO didn't find out about the hack until a month after.

I doubt the CEO of Uber is informed of every $100K transaction.

IIRC Uber has had a very large bug bounty program with substantial payouts. It seems possible this was billed under the guise of a bounty.

Yes, this is spot-on, the just published New York Times article details this: https://www.nytimes.com/2017/11/21/technology/uber-hack.html

Maybe it's personal cash. 100k is barely a weekend in Vegas for these people.

This has been blown out of proportion.

- This is not Equifax, which leaked hundreds of millions SSN; or LinkedIn, which leaked hashed password of millions[1]; or Yahoo, which leaked personal information of billions, including security questions and hashed passwords [2]; or Target, which affected 40MM credit cards [3].

"Compromised data [..] included names, email addresses and phone numbers of 50 million Uber riders around the world, [..] including some 600,000 U.S. driver’s license numbers. No Social Security numbers, credit card information, trip location details or other data were taken"

- There is no gross incompetence. The breach was due to an AWS access key in a private github repo. I bet you can find enough developers in this forum who store sensitive information in private GitHub repos without git encryption, and who may or may not feel guilty, because of the (false) sense of safety given by 1) the guarantee of github private repo and 2) the fact that access keys can be revoked and are generally handled with less care.

- The response by the new CEO is decisive and timely. The CSO was fired on the same day the CEO learned about the incident. There is also internal review, new advisor, and reasonable protection offered to the drivers affected, even though there is no indication the data is leaked beyond the thief, and driver license numbers are not the best for identify theft.

[1] https://en.wikipedia.org/wiki/2012_LinkedIn_hack

[2] https://en.wikipedia.org/wiki/Yahoo!_data_breaches

[3] https://www.huffingtonpost.com/eric-dezenhall/a-look-back-at...

I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story.

I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the cover up.

Regarding Joe's previous behaviour: https://www.theverge.com/2016/7/10/12127638/uber-ergo-invest... https://lawyerist.com/ubers-secret-encrypted-far-reaching-in...

A lot more will likely leak out now. Iceberg tip located.

At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers $100,000 to delete the data and keep the breach quiet.

Only $100k? They really should have tried for more... not that I support stealing PII.

They agreed to pay and nobody heard about it for a long time. I'd say they asked for the right amount

Credit Monitoring is the shittiest way to resolve these issues.

I've stopped using any credit card numbers for anything ditial. I can change paypal passwords weekly If I'm that paranoid.

> Joe Sullivan, the outgoing security chief, spearheaded the response to the hack last year, a spokesman told Bloomberg. Sullivan, a onetime federal prosecutor who joined Uber in 2015 from Facebook Inc....

Why on earth would a software-based company like Uber that stores a boatload of confidential employee and customer information on its servers put a non-technical person of any sort, lawyer or not, in charge of its security team?

Security, as far as a corporate entity is concerned, is fundamentally a way to reduce business and legal risk. A lawyer at the top, making those decisions with the input of technologists, seems like it should be reasonable when things are working correctly. This isn't a failure of skillset or knowledge, it's a failure of ethics and leadership. (Which should, to be clear, be punished far more severely than skill-related incompetence.)

Welcome to lobbying ver, 2.0.

Instead of giving cash bribe, bribe with cushy jobs with high salary and no real responsibility, since no one would expect a lawyer to understand what even to delegate to members of IT security team.

Put a lawyer in charge when your strategy is to defend lawsuits against issues and mitigate the fallout of issues, rather than to, you know, prevent the security issues

Missing a trick these hackers, they don't want to ask for a one of payment, they want to turn this business of theirs into a cashflow. Pay X a month and we will keep the data safe. X could be a much smaller number than 100k. As we all know they haven't deleted the data. Think of it as a security tax levied by the internets.

I wish I was a fly on the wall at Transport for London. Or to be at that meeting TfL will be having with Uber, when Uber are going to magically prove themselves to be a 'fit and proper' company. At some point after some British chat about the weather someone on the TfL side of the table might ask: 'So, that data breach...'

If these 'hackers' were white hat and signed a contract saying they responsibly handled and deleted the data, and then uber checked the access logs of the data and verified that nobody else accessed it, then IMO it is not a data breach. It was a potential breach.

A white hat hacker you have an agreement with on how the data should be handled is the same as an employee who has access to the same data, where you also have an agreement on the employees use of the data.

You might say "Ooh, but can you trust the hacker not to keep a copy of the data!?!", but it's exactly the same as saying "Can you trust the employee not to copy the data?". I don't think a company would announce a data breach just because the database administrator had access to a backup tape...

What you have described makes sense only if they were originally hired as penetration testers. I think an external hack of this nature, even if done by white hat hackers, should rightfully be treated differently.

Having said that, you raise an interesting point, because if this money was paid as a bug bounty, then perhaps the lines would be blurred again. I guess the difference is that a bug bounty would have more clearly defined parameters about how far the hack should go. Logging into AWS using credentials that were found lying around, then continuing on to download data, seems like it is beyond the realm of reasonable bug-bounty hunting and responsible disclosure.

These are absolutely not white-hat hackers. In order for a breach of this nature to be white-hat, they would have to be acting openly, and within the parameters of Uber's bug bounty program (https://hackerone.com/uber). I have yet to see a bug bounty program that would allow the pen-testers to access private user data en-masse (I don't even think a company could legally allow this).

Anonymously extorting a company after stealing its data is a black-hat activity any way you look at it.

If Uber didn't have a bounty program or responsible disclosure policy, and the hackers didn't download the user data, but reported it in a manner consistent with other responsible disclosures after discovering a means to access, then it would be grey-hat at best.

In what world is stealing information and then holding it for ransom 'white hat'?

> You might say "Ooh, but can you trust the hacker not to keep a copy of the data!?!", but it's exactly the same as saying "Can you trust the employee not to copy the data?".

I trust someone I vetted and hired a hell of a lot more than the person who just extorted $100K from me.

If this was the case, why the secrecy? Why did staff get fired?

If it is as you describe, do you think the public would understand and react differently?

Would a more correct term be "data security consultant"?

Did they pinky-promise to delete the data? Sorry, but that is beyond naive.

Although obviously wrong on Uber's part, I'm curious: If they had informed law enforcement, could it be possible to legally pay the hackers to delete the data?

Hacks of this magnitude, especially in other cases where they involve credit card information, cause millions in damages ultimately, however the black hats involved (the initial part of that chain of events) sell that data for much less. Could we cut the losses there, by paying the hackers? Would it be legal? It could be a more serious version of a bug bounty.

It seems they didn't learn from their mistakes. It sounds that the 2014 breach was caused by the same mistake.

"That gist is believed to have contained a login key used by a hacker to access an internal Uber database of 50,000 drivers."

https://www.theregister.co.uk/2015/02/28/uber_subpoenas_gith...

Whoa, Uber even had the hackers sign an NDA? Like, what were they going to do if the hackers broke the NDA? That's just...insanity. The fact that Travis knew about it as well smells like he could face charges.

https://www.nytimes.com/2017/11/21/technology/uber-hack.html

I don't know, paying off the hackers might have been the best call. It prevented my data from being exposed into the wild vs notifying authorities which would have all but guaranteed a leak. If the objective was to protect Ubers' customers, mission accomplished. Should they have covered it up and not disclosed it? No, but this is as a tough call ethically.

"For $100K we will delete the information, Scouts honor!"

...

Another breach that 2FA and SSO didn't stop. 81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches. Most organizations believe that 2FA and SSO are the answer but this proves they are not enough.

It never fucking ends with this company, does it?

No, it does not. Tough luck if you are a drive, btw. You'll be made redundant to self-driving cars soon.

Did anyone else read this title and assume that it meant Uber had stolen the data of 57M people and then paid hackers to delete it? I feel like the word "ransom" should probably be used somewhere in the title.

I really hope Lyft can take advantage of all the mistakes Uber has made.

I wonder if it is a good time to start a role at Uber or Lyft? I’m not sure which one I would pick.

How can they be sure the hackers didn’t have another copy?

I'm getting sick of this stuff. As a user of Uber (or Equifax), would I have any case if I tried to sue them for mishandling private data (I live in Massachusetts)?

http://www.mass.gov/ago/doing-business-in-massachusetts/priv...

Maybe if you can organize a class lawsuit.

Even if this was the correct way to handle such an incident, how can you be sure that once you've paid the hackers they actually destroy the data?

Why was this only worth 100K? How did they verify info was deleted? And how does this show up on an expense report at the end of the year?

> Why was this only worth 100K?

Gotta be careful dealing with company like Uber. At some price point they might just hire hitmen to kill you instead.

Security Penetration Testing

What would be the tax implications of this in USA? I imagine there isn't a bill given by another entity, but this is rather a bitcoin/cash transaction. In my country this would mean this payout would be hit with all the taxes [1], pretty much doubling the cost.

[1] Income tax, unemployment insurance, healthcare, and maybe even pension. All going to the benefit of the country as there is no identifiable human on the receiving end.

And people wonder why I keep saying that Uber needs to have its business license yanked or suffer some similarly drastic sanction or they'll just keep right on doing it and others will follow the same strategy. I mean, how often does a firm have to breach the trust of (just about) everyone it deals with before it's time to punish it in some meaningful way?

They stored AWS storage credentials in clear, in a (private) Github repo...

This is so baffling coming from one of the largest tech companies in the world.

Among other things, this shows that they do not have proper access policies to user data (e.g anybody working at Uber can get access to any user's data), which in my opinion is a larger issue than this individual hacking case.

We already knew that -- viz Uber showing off their ability to track famous users at a party.

see

https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view...

https://www.cnet.com/news/god-view-under-spotlight-as-uber-i...

and

https://www.cnet.com/news/uber-lawsuit-alleges-startup-track...

Yes, and this is from 2014! They really did not learn anything, and Kalanick's apologies and statements about "becoming more mature" were all just bullshit.

as the size of the company grows past a certain size, especially these "move fast and break things" idiots, i feel like the likelihood of this goes up. there are more and more people, someone is bound to do something stupid.

The fact that this is a big company is exactly why strict access policies are necessary! I might trust a handful of administrators, or a limited set of engineers whose data access is audited, but I sure as hell would not trust thousands of engineers with my private data.

Other tech companies (e.g Google) safely silo PII data, and any access has to be audited.

I cannot wait before GDPR is implemented in Europe... at least companies will be seriously fined if they want to cut corners on privacy and data protection.

The problem of course is them storing private credentials on Github despite numerous highlights on the site to not do so.

Private github sites are private as in hidden. Not as in digitally encrypted bank vault.

What sort of tech company doesn't go for a self hosted git option anyway!?

Like Gitlab which comes with CI to keep the whole thing private.

Also self hosting allows an arbitrary level of security..

At what point can we just let a company die? Is there even such a line to be crossed anymore? Personal data leaks and illegal cover-ups, Greyball, utter disregard for regulations, IP theft, a culture systemic harassment and sexism, etc etc etc. Uber just needs to die so that the rest of us can have some semblance of faith in the system left.

The "success at any cost" mentality may have some costs, in retrospect

Definitely cost me my personal data!

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site...

I am wondering what private Github coding site stands for? If it is GitHub Enterprise, then how those hackers would even access it from outside of the uber network? Does it mean that they had access to Uber's VPN as well?

In about 2014 I noticed that the logged in API request, on Uber's website, included full driver info nested under the ride JSON object. It included the drivers full address, license, phone numbers, etc. They patched it a few months later, but it was the worst data leak I've seen.

So was the stolen data deleted? This could've easily just been part of a "bug county," no?

Except when you actually steal data, you're not eligible to bounty. This means the hackers had decent leverage and negotiation skills (maybe Uber could've scared them with lawyers, etc).

Someone needs to start a Top 10 Evil Corp web site.

maybe a yearly most evil corp awards.

because it looks like uber is relentlessly bad.

Not quite what you are looking for but the International Labor Rights Forum does a great job of trying to change some of the worst of the worst practices around the world (unfortunately, Uber is unlikely to make a top ten list).

https://ilrf.org/

Wouldn't the easy solution to this class of problems be to require some sort of physical device to be connected to your machine in order to access certain sets of data? Assuming the device itself couldn't be spoofed, wouldn't that solve this once and for all?

It seems that Uber has only paid the infiltrators to say they have deleted the data. Putting aside, for the moment, all the legal and ethical issues, why would anyone at Uber imagine that this would be in the slightest bit beneficial?

If companies hiring the "best and brightest" can't keep your data secure, what hope is there for the average non-tech company? Low tech lock-and-key solutions don't seem so bad now. If only they could scale...

And just for an FYI: California law SB1386 requires mandatory breach notification when drivers license data is stolen.... which this team knew very very well.

So this was willful. Expect many more exits.

This is exactly why the CEO should lead by example. If the CEO himself does shady stuff all the time and in fact encourages it, its normal and even expected that the hack is covered up.

The journalist speculated about "evidence that the files were actually deleted" referring to the "hackers" deleting their copies of the extracted data.

Really? Evidence of deletion?

Massive data spill as Uber was hacked.. maybe email address is not so importat but ride history and wherever location data is something quite sensitive .. shift delete!

I thought it was illegal to conceal breaches. Certainly there should be disclosure requirements for publicly traded companies.

How should a startup or a company in this situation handle it properly ? Should they come out clean to their users ?

Paying hackers good move or bad move? Or Little bit of PR as well that they can pay if they got hacked again?

Meh, Uber is one of the good guys, compared to other American multinationals.

For starters, Chiquita Bananas intimidated farmers and union leaders with AK 47s and hired militias in Colombia [1].

[1] https://en.m.wikipedia.org/wiki/United_Fruit_Company#Aiding_...

Moral of the story, use two factor auth on GitHub and AWS to prevent unauthorized access.

And how exactly did they verify that the hackers actually deleted the data?

These type of people actually have driving licences ...

lol, I just understood they stole data and then paid the hackers to delete it so nobody would suspect them spying on their users

How did they know they'd delete it?

Uber should be shut down for stupidity.

So was it bad to have paid the ransom?

That company just keeps giving.

Aww man. If they were smart they would have announce a bug-bounty and then just did things that way.

> Uber paid hackers $100,000 to delete stolen data and keep quiet

Really? Really? Come on!!!

"Delete"

can't even lolz

Well I hope Uber asked for the hard drive shredder receipt this time around.

I think its time that Uber starts paying a real and deathly penalty for their pattern of behaviors.

At this point if the next headline is “Uber sold nuclear submarine secrets to China whilst kicking puppies” I won’t bat an eyelid.

Credit card numbers are a bug.

I woke up an Silicon Valley has really become an Evil place. What ever happened to our mantra (really Google's but it reflected the whole valley) "Don't be evil"?

We really need to change.

> What ever happened to our mantra (really Google's but it reflected the whole valley) "Don't be evil"?

The kool-aid wore off and everyone realized it never had any meaning to begin with.

"Don't be evil" - a command not a mantra.

It all started when Google banned all software that can not be used for Evil: http://wonko.com/post/jsmin-isnt-welcome-on-google-code

People keep bringing this link up every time, but obscure the actual reason that was done: it puts the developers depending on the library in legal jeopardy. Licenses like "Do Whatever The Fuck You Want To" [0] are in the same boat.

Redhat also stopped including JSMin for the same reason. [1]

[0] https://en.wikipedia.org/wiki/WTFPL

[1] https://bugzilla.redhat.com/show_bug.cgi?id=455507

Reply on news.ycombinator.com