Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

541–550 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#541

Post by mfrye0 »

ryandrake wrote: post #469
ctennis1 wrote: post #200

Earlier quoted context omitted.

Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source. In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to s…

> In an organization of about 200 engineers across various products, 1000+ github repos Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.

Depends on the company you work at, but most tech companies I've been at have gone the "micro" services approach.

Example:

- 1 repo for the frontend - 1 for each api - 1 for the infrastructure terraform scripts

It's good for CI / CD and general code base organization. Also easier to track changes and handle security. You give devs access only to the repos they need to do their job.

Our team has a product with multiple integrations and internal apis, so we easily have 40+ repos.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#542

Post by odammit »

Private repo or not, checking your credentials into git is amateur.

I’d normally say eventually it’d bite you if you fall into the habit and do it on a public repo by accident but it looks like it can bite you on a private one too.

Manage your secrets. Use something like Vault[1] or Pass[2] they’re free and awesome projects.

I keep all of my secrets even non-prod ones in one of these two because if you think about it, even your “non-prod” github credentials are kinda prod since you have access to code.

1- https://www.vaultproject.io/

2- https://www.passwordstore.org/

Also when it comes to AWS secrets, give your developers read only access, make them turn on MFA and assume a role that scopes permissions to the work they need to do.

Leaking AWS secrets is really asking for it. The amount of bots that consistently scan public git repos and then use the credentials to spin up massive instances to mine crypto currency is impressive. I’ve seen it do upwards of $10000 in AWS usage within five minutes of the commit containing the credentials.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#543

Post by xedarius »

Missing a trick these hackers, they don't want to ask for a one of payment, they want to turn this business of theirs into a cashflow. Pay X a month and we will keep the data safe. X could be a much smaller number than 100k. As we all know they haven't deleted the data. Think of it as a security tax levied by the internets.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#544

Post by sillysaurus3 »

odammit wrote: post #542

Private repo or not, checking your credentials into git is amateur. I’d normally say eventually it’d bite you if you fall into the habit and do it on a public repo by accident but it looks like it can bite you on a private one too. Manage your secrets. Use something like Vault[1] or Pass[2] they’re free and awesome projects. I keep all of my secrets even non-prod ones in one of these two because if you think about it…

It may be amateur, but it's one of the most common mistakes. Even at top companies.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#545

Post by zanedb »

odammit wrote: post #542

Private repo or not, checking your credentials into git is amateur. I’d normally say eventually it’d bite you if you fall into the habit and do it on a public repo by accident but it looks like it can bite you on a private one too. Manage your secrets. Use something like Vault[1] or Pass[2] they’re free and awesome projects. I keep all of my secrets even non-prod ones in one of these two because if you think about it…

If you still want to use a Git repo, at least use an encrypted Keybase teams repo[0].

[0]: https://keybase.io/blog/encrypted-git-for-everyone

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#546

Post by uxp »

chimeracoder wrote: post #150
philsnow wrote: post #88

Earlier quoted context omitted.

You couldn't enforce 2FA on GHE for the longest time. GHE version 2.8.0 lists [0] "Enforce two-factor authentication" as a feature. 2.8.0 was released November 2016. According to the article, > Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said. I don't know if they were using GHE. If they were, at the time it did not come with a good way fo…

> I don't know if they were using GHE. If they were, at the time it did not come with a good way for them to enforce 2FA for users. Well, sort of - at the application level, that's true, but GHE is typically run behind a VPN. Certainly that should be the case for a company the size of Uber. Even before GHE added 2FA, it shouldn't have been possible for a leaked set of login credentials to be used to access GHE, witho…

At my company (mostly a Windows and Microsoft shop), my domain credentials are used to log into the VPN, and TFS, and Octopus. Compromising just that one set of credentials could effectively "own" our company. And I'm just a senior-ish developer.

Lateral movement by an attacker is a real thing. And while credential reuse is something most security focused web companies are trying to mitigate, a push for "sso"-like account management is seemingly undoing most of that effort inside the network if not done properly (specifically, auditing and monitoring of behavior).

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#547

Post by alehul »

Although obviously wrong on Uber's part, I'm curious: If they had informed law enforcement, could it be possible to legally pay the hackers to delete the data?

Hacks of this magnitude, especially in other cases where they involve credit card information, cause millions in damages ultimately, however the black hats involved (the initial part of that chain of events) sell that data for much less. Could we cut the losses there, by paying the hackers? Would it be legal? It could be a more serious version of a bug bounty.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#548

Post by johnhenry »

lhorie wrote: post #138
claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake. One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and…

Just curious, are you speaking as an Uber employee

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#549

Post by WillReplyfFood »

brianpan wrote: post #409
msh wrote: post #396

Earlier quoted context omitted.

Uber will not tolerate unethical behavior, you got to be joking!?!?

I think the commenter meant the new CEO will not tolerate unethical behavior.

Americano Saviour Complex at work: Someone will come, a stranger in our midst, and will make the problems go away. Preferably with a gun and a swoard.

Its always a person, its never a institution, or organisation, never a boring measurement like bureacratic oversight or well made laws.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#550

Post by Zenbit_UX »

bo1024 wrote: post #513
randerson wrote: post #373

Earlier quoted context omitted.

Our company cares more about security than anyone in our space, if you look at how much we invest relative to the others. We have full time penetration testers on staff. We contract out to countless third party security vendors. We take their advice. This has nothing to do with not valuing security, it's just about being realistic. Can you guarantee that your company is hacker-proof? No? Then we're on the same page.

I'm not sure why we have to accept a dichotomy between guaranteeing hacker-proofness and throwing up your hands and saying you're bound to get hacked no matter what you do. It's great that you take all those steps and investment. The fact that you still don't believe you can control whether or not you get hacked is a sad reflection of modern software practices, which are akin to throwing together a house out of plywo…

I don't think your metaphor applies here.

I believe it's more like getting into a car accident. You can be the best driver in the world, you can always drive under the speed limit and take all precautions but you are bound to be in an accident at one point or another.

You may go decades without incident but it's almost a certainty that you will find yourself in a situation where another driver collides with you in a way that couldn't have been forseen. This driver could have hit you accidentally or on purpose, it doesn't matter. You could be teaching another how to drive during the incident, you could have had a momentary lapse in judgment...it doesn't matter. What matters is how you handle the situation after the fact and the steps you took to mitigate the damage.

If you spend enough time on the road the likelihood of an incident approaches 100%.

Post reply on HN