Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

291–300 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#291

Earlier quoted context omitted.

Indeed they are: https://arstechnica.com/science/2017/11/breitbart-other-cons...

Interesting. Thanks for the source.

It's been going on for years. Here is another article from last year: https://www.theguardian.com/technology/2016/dec/04/elon-musk...

Also, Rush Limbaugh hates Musk (he has the #1 talk show since 1987... Since record-keeping began, so a lot of people are exposed to that negativity)

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#292
post #57

I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story. I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the cover up.

Regarding Joe's previous behaviour: https://www.theverge.com/2016/7/10/12127638/uber-ergo-invest... https://lawyerist.com/ubers-secret-encrypted-far-reaching-in...

A lot more will likely leak out now. Iceberg tip located.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#293

Earlier quoted context omitted.

Speaking of politics, media influence and tech, a fair number of average joes have a terrible opinion of Musk/Tesla/SpaceX; but these same people are unaware, or maybe vaguely aware the US Gov spent >10billion, just in direct financial losses, bailing out GM. If everyone in the country was told "write a check to GM for $50 or go to jail," and conservative media wasn't berating Tesla/Musk, public opinion would be a lo…

This is news to me, I've never come across an average person having a negative opinion of Musk. On the contrary they think of him as some iron-man like figure.

How many people do you know that listen to Rush Limbaugh or read Breitbart? Apparently none.

Personally, I like him quite a bit, but to be fair I know that outside of my own echo chamber of my news and social media feeds, that there are a lot of people who don't like him, and where that negativity is coming from.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#295

The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for? If it was paid to hackers it's unlikely that finance cut a check. I'm imagining this was paid in bitcoin or similar. How was this able to be approved? I'm guessing someone created a fake invoice? Wouldn't that constitute fraud?

IIRC Uber has had a very large bug bounty program with substantial payouts. It seems possible this was billed under the guise of a bounty.

Yes, this is spot-on, the just published New York Times article details this: https://www.nytimes.com/2017/11/21/technology/uber-hack.html

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#296
post #69

Earlier quoted context omitted.

I mean they don't say how they accessed the GitHub repo or whether there was a vulnerability in Github itself that allowed access

I assume it was password reuse from one of their engineers or something similar. If you could compromise GitHub itself there would probably be higher value targets (source code for upcoming AAA games, Coinbase, government organizations, etc.)

I mean 100k is a lot of money and there is no saying they didn't hit those guys also

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#297
From https://www.nytimes.com/2017/11/21/technology/uber-hack.html

> Two hackers had stolen data about the company’s riders and drivers — including phone numbers, email addresses and names — from a third-party server, putting the personal data of more than 57 million people at risk. The hackers approached Uber and demanded $100,000 to delete their copy of the data [...].

> Uber acquiesced to the demands. Under the orders of Travis Kalanick, who was then its chief executive, and Joe Sullivan, the chief security officer, the company paid the ransom.

> Then Uber went further. The company tracked down the hackers and pushed them to sign nondisclosure agreements [...]. To further conceal the damage, Uber executives also made it appear as if the payout had been part of a “bug bounty” [...].

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#299
post #40

Earlier quoted context omitted.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

Well, day care operators have since learned... ... as I sit in my home office, just over an hour away from day care closing time I assure you I'm watching the clock like a hungry hawk watching a mouse. See, my kid's day care charges a mere $600 per hour late (billed in 1 minute increments). I don't see kids parents late that often :-) and we've come close to missing it, but haven't in two years.

And here I thought the $90/hour late fee that my child's school imposes was steep (they charge $15 for every 5 minutes after 5:45 PM).

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#300

Earlier quoted context omitted.

Does anybody have a link to a good source on this? I'm behind on this myself.

https://www.nytimes.com/2017/04/23/technology/travis-kalanic... https://www.nytimes.com/2017/03/03/technology/uber-greyball-... https://www.washingtonpost.com/news/innovations/wp/2017/02/2... https://www.theguardian.com/technology/2017/jun/06/uber-fire... https://www.bloomberg.com/news/articles/2017-02-28/in-video-... https://www.engadget.com/2017/09/08/uber-federal-investigati... http://abcnews.go.com/US/uber-allowe…

Amazing, Thanks!

Funny, they opened a satellite office right near my apartment and I'd considered applying. Then I heard pretty disconcerting stuff about the environment, and now this. Dodged a bullet, I guess.

Post reply on HN