Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

61–70 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#61

Post by 21 »

gr3yh47 wrote: post #46
untog wrote: post #40

Earlier quoted context omitted.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

>Just pay the toll especially when the cost of doing the right thing is higher. i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor

> laundered trillions of dollars of mega-organized-crime money

While I agree with your sentiment, there is no need to use such inflated and hilarious numbers.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#62

Post by malydok »

spike021 wrote: post #33
dijit wrote: post #9

Earlier quoted context omitted.

Never underestimate the power of marketing. My mother for instance would use Uber over any ride-sharing system due to its insane exposure and the fact that these stories remain relatively unheard of in comparison.

It's already way more common to use "Uber" as a verb, or even a noun, that doesn't necessarily even mean Uber the company itself. People have asked me before if I'm about "to uber" or "take an uber" someplace and they say it in an obvious way that implies "any ridesharing company" (or lyft in my case since most people know I only lyft nowadays). Uber just as a word for ride-sharing has become ingrained and won't be e…

Same as `googling` will long remain the synonym for `searching the internet`.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#63

Post by watwut »

Swizec wrote: post #49
untog wrote: post #40

Earlier quoted context omitted.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

> The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willing to pay. The real question in this story is this: If you find that you have customers who are willing to pay you more for providing more service ... why not provide that service? You get more money, your staff gets paid overtime, parents get peace of mind, everyone's happy.

Because those more money may not be enough to pay for more people that would need to be hired? While existing stuff may be wiling to stay 30 minutes more occasionally, they might not like the idea of having even longer shifts all the time.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#66

Post by dboreham »

claudiulodro wrote: post #31
rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

Unless 2fa was bypassed with the token you get from GitHub in order to use the git client via https.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#67

Post by nothrabannosir »

_m8fo wrote: post #60
stevenj wrote: post #4

Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same. I plan to never use Uber again.

You'll find that thinking like that will only lead to misery at worst and hypocrisy at best. For example, if you live in the United States (though this logic applies to any country, really), you'll be interested to know that the US holds the world record for the amount innocent civilians killed [1]. [1] https://www.globalresearch.ca/u-s-holds-the-world-record-of-... EDIT: I realize I sound far more judge-y than inten…

Don’t let hypocrisy stop you from doing the right thing. Sometimes you need to climb one tree to cut down another.[1] That’s ok.

[1] tbh I don’t think you do, but I like the analogy so I’m keeping it.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#68

Post by tedunangst »

bogomipz wrote: post #54

The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for? If it was paid to hackers it's unlikely that finance cut a check. I'm imagining this was paid in bitcoin or similar. How was this able to be approved? I'm guessing someone created a fake invoice? Wouldn't that constitute fraud?

Who needs to approve it? How would you know they didn't?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#69

Post by flylib »

claudiulodro wrote: post #31
rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

I mean they don't say how they accessed the GitHub repo or whether there was a vulnerability in Github itself that allowed access

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#70

Post by panarky »

gr3yh47 wrote: post #46
untog wrote: post #40

Earlier quoted context omitted.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

>Just pay the toll especially when the cost of doing the right thing is higher. i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor

And they say we need less regulation of corporate behavior.
Post reply on HN