Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

491–500 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#491

Post by lhinds »

Garbage wrote: post #310
rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

You can use tools like Talisman which registers a Git hook to check if you are checking in anything that looks like secret. https://github.com/thoughtworks/talisman

We use a tool under a Linux Foundation project called anteater https://github.com/opnfv/releng-anteater, which does the same thing (but is for a jenkins / gerrit workflow). A key difference from looking at talisman, is anteater uses standard RegEx rather then code to seek out strings, so anyone can add their own strings / file names easily into a simple yaml file. Like wise they can use regex to provide a waiver, should something be incorrectly reported.

I am thinking now would be a good time to port it to working with webhooks as well.

The tool would have blocked the aws credentials from being checked in: https://github.com/opnfv/releng-anteater/blob/master/master_...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#494

Post by 6d6b73 »

ryandrake wrote: post #469
ctennis1 wrote: post #200

Earlier quoted context omitted.

Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source. In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to s…

> In an organization of about 200 engineers across various products, 1000+ github repos Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.

There are just three of us in my company and after 10 years I worked on close to 80 projects for 30 different clients. Each project has its own repo. So +3 per engineer is really not that much;)

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#495

Post by jonatron »

ryandrake wrote: post #469
ctennis1 wrote: post #200

Earlier quoted context omitted.

Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source. In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to s…

> In an organization of about 200 engineers across various products, 1000+ github repos Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.

Agencies may create multiple repos per client / project.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#496

Post by ransom1538 »

diggan wrote: post #488
ransom1538 wrote: post #479

Earlier quoted context omitted.

"Don't check secrets into VCS, folks! " I suppose? But at this point they have your code base . You are so owned at that point.

Yeah, but hopefully they can't do much if they just have your code base. If the secrecy of your code is the only thing stopping hackers from exploiting you, you're missing some gaping holes in your infrastructure. With that said, nothing wrong with using secrecy as a additional barrier, but shouldn't be the only, and if it's not the only, you're not "so owned at that point".

"If the secrecy of your code is the only thing stopping hackers from exploiting you"

I hate these types of arguments. Yeah no one said that ever.

Losing your code base is terrible. I view it as losing a journal. What your company tries, tests you run, funny comments, or funny mistakes. I mean they post it on the net, blackmail team members, imposter team members, forge for leaks, sell it, pushes to prod from compromised accounts, CI systems, -- seems bad to me. Sure don't have aws keys in there.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#497

Post by gutnor »

gjjrfcbugxbhf wrote: post #477
ryandrake wrote: post #469

Earlier quoted context omitted.

> In an organization of about 200 engineers across various products, 1000+ github repos Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.

It depends upon the culture. Some places favour a project repo others a repo per microservice/job.

Could also be a company using clone - pull request workflow. 10-20 project repo an then each developer has a bunch of projects clones, including a few shared one - like the common infrastructure stuff, ...

I can see that with a company that has grown day 1 around Github, especially during early startup stages with a variety of contributors but no formalised "organization".

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#498

Post by bringtheaction »

Xylakant wrote: post #446
thaumasiotes wrote: post #427

Earlier quoted context omitted.

You can also record the TOTP secret in your automated login script, next to your password, and generate the token on the fly right there. It's things like that that make me wonder why TOTP tokens are supposed to be conceptually different from passwords. A TOTP scheme involves knowing a master password, and nothing else.

Recording a TOTP secret next to your password would make 2FA worthless, true. That’s why you should use hardware generators whenever possible. However, Github supports Fido/u2f which is conceptually superior to TOTP: The authentication secret is bound to the domain and the token generator verifies this. So even a software u2f implementation protects against phishing for example, while TOTP does not.

Do you know of any open source software implementations of u2f.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#499

Post by Xylakant »

bringtheaction wrote: post #498
Xylakant wrote: post #446

Earlier quoted context omitted.

Recording a TOTP secret next to your password would make 2FA worthless, true. That’s why you should use hardware generators whenever possible. However, Github supports Fido/u2f which is conceptually superior to TOTP: The authentication secret is bound to the domain and the token generator verifies this. So even a software u2f implementation protects against phishing for example, while TOTP does not.

Do you know of any open source software implementations of u2f.

Firefox includes one IIRC and there’s githubs SoftU2F for Mac https://github.com/github/SoftU2F

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#500

Post by danenania »

celim307 wrote: post #406
rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?

We launched EnvKey[1] a couple months ago to offer an easy-to-integrate solution to this issue.

1 - https://www.envkey.com

Post reply on HN