Did anyone else read this title and assume that it meant Uber had stolen the data of 57M people and then paid hackers to delete it? I feel like the word "ransom" should probably be used somewhere in the title.
Uber Paid Hackers to Delete Stolen Data on 57M People
481–490 of 606 posts
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#482Earlier quoted context omitted.
>and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers I don't think the average Joe is up to date with this news, or even care about.
I don't know. I've received a lot of flak for even using Uber from non-tech friends/dates recently. I think the continual tide of negative publicity is definitely having a material effect on their brand image.
Do you live outside of the bay area or seattle?
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#483Earlier quoted context omitted.
> So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence? By analyzing how they prepared for the inevitable attack (mitigation), as well as how they respond to it after the fact.
(In the EU) companies are already required to tell where my personal data goes to. There is no specific fine for violations as far as I know though. Essentially we need a price tag on personal data. Let's say 1$ for each email and password leaked to an unknown number of entities. That would be a 114M$ incentive for Uber to keep their data secure.
> There is no specific fine for violations as far as I know though.
It's a shame this happened pre-GDPR because that has steep fines - 4% of worldwide revenue - which would be north of $260M going off their 2015 numbers. And that's assuming they get off with a single fine.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#484I lost my job few months back before i notice my wife started acting up, she changed passwords to every account that she has, put a pin lock on her phone which she has never done before, i have been searching for ways to retrieve her text messages without installing any software on her phone or having access to it, I was introduced to this wonderful hacker and he hacked into my partner mobile with just her phone number only. i get to know she was cheating and all.i felt very sad about this,but it over now.all thanks to murphy.c8990@gmail.com if you need help regarding to issues like this contact him.let him know philip referred you in.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#485Earlier quoted context omitted.
Some drivers don't stop at stop signs. Let's remove the stop signs so all drivers can be as cavalier. It'd save a lot of drivers the headaches that go along with traffic laws.
I don't dispute your logic though I would prefer more traffic law enforcement. But the uber situation would be closer to this - the parking meter costs $20/hr and a parking ticket costs $5. We're creating a situation where people who break the law get ahead of those who obey it. Either we can ramp up enforcement (good luck with that happening) or we can level the playing field.
I would prefer smarter drivers over more laws. Mandatory defensive driver education programs and stricter tests. Few people ever intend to break the laws that get them into accidents, so making sure they don't accidentally break them by being, smarter, more aware drivers would ideal.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#486Earlier quoted context omitted.
Unless you're talking about a 3 person start-up, wouldn't the use of github itself be a red flag? If you're a software company, you live and die by your source code. Why on earth would you rely on some other company to hold it for you? This seems as ridiculous as doing your bookkeeping on Google Docs. I've never once worked in a company that permitted source code to leave the company network.
What makes you think you (or most devs for that matter) know more about security than Github's security team?
It's not just about who knows more about security. It's a trade-off, and you need to account for other factors like cost, availability/uptime, data integrity, total attack surface area and others. Honestly, I'm surprised this is such a controversial point of view, but judging by the downvotes it appears it is. You learn something new every day, I guess.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#487Earlier quoted context omitted.
Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?
We're using Keepass / MacPass password protected vault shared with the team using Dropbox. It's really good and essentially free to use if you use a free Dropbox account.
Then make sure you use 2FA on the Dropbox account. And you should use a key + password to unlock keepass.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#488> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
"Don't check secrets into VCS, folks! " I suppose? But at this point they have your code base . You are so owned at that point.
Yeah, but hopefully they can't do much if they just have your code base. If the secrecy of your code is the only thing stopping hackers from exploiting you, you're missing some gaping holes in your infrastructure. With that said, nothing wrong with using secrecy as a additional barrier, but shouldn't be the only, and if it's not the only, you're not "so owned at that point".
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#489Earlier quoted context omitted.
Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?
There are a few SaaS offerings that will let you do that. LastPass or onepassword are two commonly used. One you can use something like keypass to store a database in a shared location if you don't trust the SaaS offerings. If you are looking at storing credentials for automation purposes, and don't have a secret store built in, you could look at something like Hashicorp Vault to help provide this for you
LastPass has a terrible track record in security, that was nicely edited out from wikipedia by a fresh user: https://en.wikipedia.org/w/index.php?title=LastPass&action=h...
The user in question has some specific interest in editing LogMeIn, parent of LastPass, pages: https://en.wikipedia.org/w/index.php?limit=50&title=Special%...
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#490> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...
2FA wouldn't have necessarily solved this, if the hackers had access to an engineer's ssh keypair (e.g stolen laptop) they could clone repos as they pleased. 2FA isn't a silver bullet.