Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

141–150 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#141

Post by alexanderstears »

panarky wrote: post #134
alexanderstears wrote: post #118

Earlier quoted context omitted.

It wouldn't. But I'd wager that Uber isn't going to be held accountable (or not very accountable) for this, so why not write the rules so that everyone gets to be as cavalier? It'd save a lot of companies the headaches that go along with I.T security.

Some drivers don't stop at stop signs. Let's remove the stop signs so all drivers can be as cavalier. It'd save a lot of drivers the headaches that go along with traffic laws.

I don't dispute your logic though I would prefer more traffic law enforcement.

But the uber situation would be closer to this - the parking meter costs $20/hr and a parking ticket costs $5. We're creating a situation where people who break the law get ahead of those who obey it. Either we can ramp up enforcement (good luck with that happening) or we can level the playing field.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#142

Post by kelnos »

saganus wrote: post #119
21 wrote: post #61

Earlier quoted context omitted.

> laundered trillions of dollars of mega-organized-crime money While I agree with your sentiment, there is no need to use such inflated and hilarious numbers.

Edit: Thanks for the corrections. I definitely messed up the magnitudes here. Was doing some other calculation on another topic and somehow I mixed them both. Sorry about that. Please disregard this comment as it it way off :( While "trillions" is definitely inflated and hyperbole, I don't think it's THAT far off. According to this The Guardian article [0] "At least $881m in drug trafficking money was laundered throu…

> So 0.88 Tn.

You mean 0.00088 Tn.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#143

Post by ForHackernews »

_m8fo wrote: post #122
Xylakant wrote: post #112

Earlier quoted context omitted.

It’s not a false premise. It’s just not humanly possible to change everything you don’t support. We can’t move all back to self-dug caves and till the land with our bare hands. You need to pick your battles.

It's not about changing things you support, it's just about consistency in your actions. Taking the child labor thing into account, never being brand new electronics again would pretty much take care of that. One could make an argument that buying used goods is still supporting child labor, but I'd argue it's a sunk cost.

> brand new electronics

Why choose this example? Child labour is rife in many sectors, particularly textiles.

It's also rampant in electronics recycling[0]. So even if you never buy any new electronics, you're complicit when you dispose of your old electronics.

The point is you shouldn't allow an impossible quest for perfect ideological consistency and moral purity to prevent you from doing good on a imperfect, inconsistent scale.

[0] http://pulitzercenter.org/reporting/india-rising-tide-e-wast...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#144

Post by codinghorror »

booleanbetrayal wrote: post #140

At what point can we just let a company die? Is there even such a line to be crossed anymore? Personal data leaks and illegal cover-ups, Greyball, utter disregard for regulations, IP theft, a culture systemic harassment and sexism, etc etc etc. Uber just needs to die so that the rest of us can have some semblance of faith in the system left.

The "success at any cost" mentality may have some costs, in retrospect

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#145

Post by [deleted] »

saganus wrote: post #119
21 wrote: post #61

Earlier quoted context omitted.

> laundered trillions of dollars of mega-organized-crime money While I agree with your sentiment, there is no need to use such inflated and hilarious numbers.

Edit: Thanks for the corrections. I definitely messed up the magnitudes here. Was doing some other calculation on another topic and somehow I mixed them both. Sorry about that. Please disregard this comment as it it way off :( While "trillions" is definitely inflated and hyperbole, I don't think it's THAT far off. According to this The Guardian article [0] "At least $881m in drug trafficking money was laundered throu…

[deleted]

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#146

Post by perfmode »

lhorie wrote: post #138
claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake. One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and…

its possible and even likely that this happened post hack.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#147

Post by cdoxsey »

_m8fo wrote: post #131
chadbennett wrote: post #102

Earlier quoted context omitted.

81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches or data leaks. Most organizations believe that 2FA and SSO are the answer but this proves that 2FA/SSO are not enough.

Do you believe this kind of thing is simply unavoidable? I wonder if this could've been avoided by simply making it impossible to access data without being connected to a VPN in addition to having some sort of physical device connected to your computer.

For amazon you can use IAM roles tied to specific EC2 instances, then no credentials are ever stored, you simply make S3 API calls in your code and as long as the machine you're making them from has access to the bucket you can get to the data.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#148

Post by ajsharp »

_m8fo wrote: post #131
chadbennett wrote: post #102

Earlier quoted context omitted.

81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches or data leaks. Most organizations believe that 2FA and SSO are the answer but this proves that 2FA/SSO are not enough.

Do you believe this kind of thing is simply unavoidable? I wonder if this could've been avoided by simply making it impossible to access data without being connected to a VPN in addition to having some sort of physical device connected to your computer.

It's entirely avoidable. Just don't commit secrets to source control. Ever.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#149

Post by kelnos »

philsnow wrote: post #88
claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

You couldn't enforce 2FA on GHE for the longest time. GHE version 2.8.0 lists [0] "Enforce two-factor authentication" as a feature. 2.8.0 was released November 2016. According to the article, > Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said. I don't know if they were using GHE. If they were, at the time it did not come with a good way fo…

If they are/were using GHE, I would expect (hope?) that they require some sort of VPN to get access to it, so my guess would be this was stored on github.com.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#150

Post by chimeracoder »

philsnow wrote: post #88
claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

You couldn't enforce 2FA on GHE for the longest time. GHE version 2.8.0 lists [0] "Enforce two-factor authentication" as a feature. 2.8.0 was released November 2016. According to the article, > Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said. I don't know if they were using GHE. If they were, at the time it did not come with a good way fo…

> I don't know if they were using GHE. If they were, at the time it did not come with a good way for them to enforce 2FA for users.

Well, sort of - at the application level, that's true, but GHE is typically run behind a VPN. Certainly that should be the case for a company the size of Uber.

Even before GHE added 2FA, it shouldn't have been possible for a leaked set of login credentials to be used to access GHE, without some other sort of compromise (VPN cert, physical compromise of hardware, etc.).

Post reply on HN