Live data from Hacker News

Someone hacked YandexTaxi and ordered all available taxis to the same location

twitter.com

131–140 of 163 posts

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#131

Earlier quoted context omitted.

Better question is, will they be able to outlaw t-shirts with 20km/h speed limit signs on the back or people walking on the sidewalk wearing them.

Pfft. I’ve already got my collection of t shirts ready: -1km/h NULL km/h false km/h alert() km/h

:-D don't forget "undefined"!

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#132
post #57

Back in the day (1960s?) two relatives of mine had a prank battle going on. One of them posted an add in the local newspaper offering to buy old Christmas trees, at the address of their adversary. Half the city showed up, were told trees were not in fact being bought, and everybody dumped the trees at their door.

It reminds me of a newspaper ad I saw 20 years ago which read "Free monkey and 10 pounds of monkey food. call 555-555-5555". Well the gentleman that answered did not have a monkey for sale, and was quite rude about it.

And Wouldn’t monkeys eat regular human food?

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#133
post #21
post #6

This is what happens when optimists win and the realists are cut out of the conversation. As a taxi service, I believe I would want to know if I'm about to have a shortage of taxis in any one area of town, and I'd better only have a concentration in one area of town for an event the entire world is talking about, like a reunion tour or a championship game. Even with the hack, the moment all of the taxis started conve…

It’s already so hard to build a large company, you just don’t have the resources to chase super rare, low pain outcomes. This is the first time this has happened and the total cost of it is at most a few hours revenue. They’ll likely add safeguards to prevent such a thing now, but if they ran the company preparing for every possible way things could go wrong, they’d get absolutely nothing done.

Nobody asks you to build a large company

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#134
post #19

I'd like to think Ukrainan hackers were behind this.

It being the work of Russian dissidents would be much better in my opinion

There actually are some Russian Anarchists doing some very risky sabotage ops inside Russia, so it's not out of the question: https://www.vice.com/en/article/5d3den/russian-anarchists-ar...

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#135
post #6

This is what happens when optimists win and the realists are cut out of the conversation. As a taxi service, I believe I would want to know if I'm about to have a shortage of taxis in any one area of town, and I'd better only have a concentration in one area of town for an event the entire world is talking about, like a reunion tour or a championship game. Even with the hack, the moment all of the taxis started conve…

Yandex in particular has a system where it would dynamically adjust the price to prevent that sort of thing happening. When many people want to order a taxi to the same place, it gets really expensive, really fast. Uber does that too. This normally works well, but I feel like this hack bypassed the normal ordering system entirely and just sent bogus orders straight to drivers.

New customers are allowed to pay in cash to the driver, which makes it effectively anonymous. Nothing was at stake.

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#136
post #6

This is what happens when optimists win and the realists are cut out of the conversation. As a taxi service, I believe I would want to know if I'm about to have a shortage of taxis in any one area of town, and I'd better only have a concentration in one area of town for an event the entire world is talking about, like a reunion tour or a championship game. Even with the hack, the moment all of the taxis started conve…

Yandex.Taxi, like Uber (in fact, they merged with Uber in Russia), is not really a 'taxi service', they're a marketplace.

A real taxi firm would notice and stop taking new calls to the address, but Yandex.Taxi aren't really 'dispatching' taxis, they're just advertising jobs, and letting drivers respond in real time.

In fact, I'd imagine that almost none of the orders placed are reviewed in realtime, and the only indicator that anyone would have had for this to begin with would have been a higher than average number on the dashboard for 'trips requested today' - an interesting metric, but not something that I would expect to be monitored closely in real time.

I'd imagine there's a 'no show' procedure that doesn't involve human oversight, so the first couple of drivers likely arrived at the address, waited a few minutes, then coded in the no show and moved on to different jobs.

This is also likely a metric on a dashboard which would have been the second indicator - booking cancellations/no-shows/driver rejections. But again, it's an analytics metric, rather than realtime actionable business intelligence, so it's the sort of thing that gets put into weekly reports. Maybe someone would have seen it and thought 'huh, that's a bit high', but probably didn't trigger any alarms.

Eventually a curious taxi driver would start to question why there are so many taxis outside this address, and would get out of his car and chat to his colleagues. They'd identify that they'd all been asked to the same address, and probably all cancel together and drive off.

MAYBE the third indicator here would be a call from one of the drivers to customer support, letting them know about the 'system glitch' that meant multiple taxis were waiting at the same address, but it's equally possible that the drivers just moved onto their next fare without reporting any issue.

So potentially, the first time that anyone at YT realised there was a serious issue was already 10-15 minutes after the incident occurred, by which time, it's already late. On top of that, it's unlikely that they have a way to easily and effectively cancel all bookings to a particular address.

I don't have any details on the hack itself or YT's infrastructure, so it may have been very difficult to identify and cancel the fraudulent bookings en masse (e.g.: fuzzed addresses, booking times, different users, card details not stored or different card numbers used, etc.).

By the time it got escalated to any technical teams, we're already likely 30-40 minutes into the incident itself, at which point they have to analyse what is happening, trace how it happened, and identify a fix.

With the immediate nature of taxi booking (I want a taxi NOW, not in 45 minutes), it doesn't surprise me that an incident like this can occur before any technical measures can be put in place to stop or mitigate it.

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#137
post #9
post #6

This is what happens when optimists win and the realists are cut out of the conversation. As a taxi service, I believe I would want to know if I'm about to have a shortage of taxis in any one area of town, and I'd better only have a concentration in one area of town for an event the entire world is talking about, like a reunion tour or a championship game. Even with the hack, the moment all of the taxis started conve…

This is more of what happens when you do the least effort to build a product to make a buck. They're probably optimized for the average happy path, however flooding isn't a concern until someone gets upset.

Not necessarily. Despite us armchair critics, it is also very easy to miss an attack vector when building your software. We find stuff after years that we can't believe we missed like a missing auth check.

Not that unusual at all when you are talking about 10s of 1000s of lines of code written by different people over the span of about 8 years.

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#138
The title is kind of misleading.

Yandex has thousands of cars here in Moscow. There were around 60 in this jam on the prospect.

So most likely not "ordered all avaiable", but "the order was forwareded for all available in the radius" or something like that.

Surely you can't order a car in Yadex Taxi much less order all of them or even a car from another part of the city.

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#139
post #87

Earlier quoted context omitted.

Had a roommate in graduate school whose friend listed his car (and phone number) on craigslist for a ridiculously low price. His phone was ringing off the hook for like two days until he was able to get it taken down.

How do people find out who did these things though? Is there a big reveal where the cape is whipped aside?

Find the "friend" who can't look at you anymore without breaking into a fit of giggles / falling over laughing?

Re: Someone hacked YandexTaxi and ordered all available taxis to the same location

#140
post #65

Earlier quoted context omitted.

Pine is really smokey and burns fast

Here in Sweden at least, christmas trees are not pines but spruce. These small ones with lots of branches - probably not worth the work effort unless you are desperate. And you'll get a lot of residue branches. You also want them to dry for a season before you burn them. Other than that, they burn just like any other log. Maybe a bit less energy per log. Maybe more smokey than some, but smoke should go out the chimne…

Granved är ren skit. Förstör skorstenen o pannan, kåda o inge energivärde. Elda björk istället!!!
Post reply on HN