Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

251–260 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#251

Post by 52-6F-62 »

edgarvaldes wrote: post #190
chakalakasp wrote: post #170

Man, I don't know if Uber is evil or if most tech companies are evil and Uber just doesn't drop the kind of money on PR strategery that an evil company need to drop in order to seem normal. But either way, holy cow does that company come off as toxic. They've completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work enviro…

>and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers I don't think the average Joe is up to date with this news, or even care about.

Does anybody have a link to a good source on this? I'm behind on this myself.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#252

Post by TheSpiceIsLife »

londons_explore wrote: post #247

If these 'hackers' were white hat and signed a contract saying they responsibly handled and deleted the data, and then uber checked the access logs of the data and verified that nobody else accessed it, then IMO it is not a data breach. It was a potential breach. A white hat hacker you have an agreement with on how the data should be handled is the same as an employee who has access to the same data, where you also h…

Would a more correct term be "data security consultant"?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#253

Post by sbuttgereit »

tostitos1979 wrote: post #220
sbuttgereit wrote: post #207

Earlier quoted context omitted.

Well, day care operators have since learned... ... as I sit in my home office, just over an hour away from day care closing time I assure you I'm watching the clock like a hungry hawk watching a mouse. See, my kid's day care charges a mere $600 per hour late (billed in 1 minute increments). I don't see kids parents late that often :-) and we've come close to missing it, but haven't in two years.

Surely you are joking?? Why would you agree to such a thing?

There's a lot of things we as adults agree to where the consequences can be steep. This is one of the easier ones: we just show up on time. We plan accordingly and we, as responsible adults, manage to pull it off. That's not hard: so why not agree to such a thing?

Another perspective on this is why should we expect someone else to bear the consequences of our failing to meet our responsibilities? If we're late picking up our kid, they staff at the day care leave late to see their own families, they incur higher operational costs, etc.

Their request that we show up prior to their closing time is completely reasonable and that there are stern consequences for failing to meet our responsibilities doesn't seem unreasonable either... especially in light of the comment I was responding to.... I assure you the day care really doesn't want to collect that fee.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#254

Post by xyzzy_plugh »

londons_explore wrote: post #247

If these 'hackers' were white hat and signed a contract saying they responsibly handled and deleted the data, and then uber checked the access logs of the data and verified that nobody else accessed it, then IMO it is not a data breach. It was a potential breach. A white hat hacker you have an agreement with on how the data should be handled is the same as an employee who has access to the same data, where you also h…

If this was the case, why the secrecy? Why did staff get fired?

If it is as you describe, do you think the public would understand and react differently?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#255

Post by pserwylo »

londons_explore wrote: post #247

If these 'hackers' were white hat and signed a contract saying they responsibly handled and deleted the data, and then uber checked the access logs of the data and verified that nobody else accessed it, then IMO it is not a data breach. It was a potential breach. A white hat hacker you have an agreement with on how the data should be handled is the same as an employee who has access to the same data, where you also h…

What you have described makes sense only if they were originally hired as penetration testers. I think an external hack of this nature, even if done by white hat hackers, should rightfully be treated differently.

Having said that, you raise an interesting point, because if this money was paid as a bug bounty, then perhaps the lines would be blurred again. I guess the difference is that a bug bounty would have more clearly defined parameters about how far the hack should go. Logging into AWS using credentials that were found lying around, then continuing on to download data, seems like it is beyond the realm of reasonable bug-bounty hunting and responsible disclosure.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#256

Post by openasocket »

londons_explore wrote: post #247

If these 'hackers' were white hat and signed a contract saying they responsibly handled and deleted the data, and then uber checked the access logs of the data and verified that nobody else accessed it, then IMO it is not a data breach. It was a potential breach. A white hat hacker you have an agreement with on how the data should be handled is the same as an employee who has access to the same data, where you also h…

In what world is stealing information and then holding it for ransom 'white hat'?

> You might say "Ooh, but can you trust the hacker not to keep a copy of the data!?!", but it's exactly the same as saying "Can you trust the employee not to copy the data?".

I trust someone I vetted and hired a hell of a lot more than the person who just extorted $100K from me.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#257

Post by dgacmu »

_m8fo wrote: post #248
dgacmu wrote: post #244

Earlier quoted context omitted.

> people don't actually care. It's just virtue signaling. "Virtue signaling" is an annoying, low-effort way of dismissing something. Try harder. You haven't even provided any evidence. Here's an alternative proposal: People like doing things that they believe will make the world a better place, within their money/time/inconvenience budget, in ways that are limited by their attention. They're human - they have limited…

Though I appreciate your post, it only further emphasizes my original point. You, apparently a professor at CMU, praise folks for merely uninstalling an app. Something you only knew because they bothered to post it on an internet board. This further reinforces that people should post that they're doing such virtuous things to begin with. Why, because they want to increase social standing among people in a given area,…

Let me quote from your original comment:

> people don't actually care. It's just virtue signaling.

You're making claims about their underlying motivation, and dismissing their actions as just virtue signaling.

"They're not doing A, they're only doing B"

Showing the presence of B is not sufficient to demonstrate the absence of A.

Second, you haven't actually shown that they're virtue signaling. Note that your definition specifically includes intent: "publicly expressing opinions or sentiments intended to demonstrate one's good character" -- the OP could be expressing their sentiments publicly in order to induce others to follow suit, for example. The same post admits many possible explanations, and you are in no position to read the mind of the posters in order to divine their intent. You're making assumptions, but you again haven't presented any evidence to suggest that your hypothesis is better than any others.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#258

Post by sbuttgereit »

mattdw wrote: post #233
synicalx wrote: post #223

Earlier quoted context omitted.

> See, my kid's day care charges a mere $600 per hour late (billed in 1 minute increments). WOW, I'm in the wrong business I think. What else charges that much per hour? I don't even think a neurosurgeon could command that sort of rate!

The point is that you're not expecting people to ever pay it, because you've set it high enough to be a solid disincentive. If people are actually paying it regularly, you obviously haven't set it high enough. This is also common when quoting freelance projects you don't really want to do.

This. I'm an independent consultant, too. There are things clients want me to do that I don't want to do and on terms that I don't want to do it on. However, if there's a real pinch and they have no other choice than hire me for that kind of gig: I'll do it, but you'll pay me my "I really don't want you to hire me for this" price. I'd rather they not hire me in those cases, but just telling them no is more alienating than telling them in advance here's my "don't hire me for this price".

(and with that... I better pick up the kid... ;-) )

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#259

Post by bogomipz »

tedunangst wrote: post #68
bogomipz wrote: post #54

The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for? If it was paid to hackers it's unlikely that finance cut a check. I'm imagining this was paid in bitcoin or similar. How was this able to be approved? I'm guessing someone created a fake invoice? Wouldn't that constitute fraud?

Who needs to approve it? How would you know they didn't?

Generally your finance department needs approve purchases beyond a certain dollar amount. This is pretty standard stuff.

If they got it approved as such don't you think the CEO would have been informed that there was line item from Security for ransom?

The article states the CEO didn't find out about the hack until a month after.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#260

Post by StanislavPetrov »

_m8fo wrote: post #77
lern_too_spel wrote: post #76

Earlier quoted context omitted.

We can vote for people who don't want the US to kill civilians while not using Uber. I don't see the conflict here.

The point is that if you know that the US kills civilians yet you stay in the US, giving them money through tax, the majority of which is used to fund the very same military that kills civilians, yet claim to do the right thing, that's hypocritical, no? In any case, you're right. There is no conflict. Just hypocrisy. EDIT: I realize I sound far more judge-y than intended in these posts. My overall point is that peopl…

>giving them money through tax

This number doesn't account for countless millions, if not the majority of Americans who drain more from the government in the form of services, subsidies, and assistance than they pay in taxes (and I'm not suggesting this is necessarily a bad thing).

Post reply on HN