Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

401–410 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#401

Post by tehlike »

Spivak wrote: post #195
comstock wrote: post #162

Earlier quoted context omitted.

To use 2fa on github you need a mobile phone. Do you give every enployee a mobile phone, or do you ask your employees to use their own personal phones? Asking them to use their personal phones seems like a very bad solution. Many software companies do not routinely give developers mobile phones...

> use their personal phones seems like a very bad solution Why? You're not any less secure by using a personal phone. What are the odds that an employee is going to be phished and have their phone compromised by the same entity.

IANAL, but here is my thinking: The problem with personal phones is they are hard to audit. When a phone belongs to the corp, corp owns the phone, and "probably" can audit it as it wished.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#402

Post by kinkrtyavimoodh »

kbenson wrote: post #213
tedunangst wrote: post #59

Earlier quoted context omitted.

If HSBC was making profits of $4 trillion, they were also lying on their financial statements.

If ever you need evidence that people see really large numbers and lose perspective, look to this conversation and how many people completely glossed over the use of trillions instead of billions , a mistake so small it puts HSBC revenue in the realm of well developed nation states...

Apparently, when wielding numbers for outrage, the quantitative details are merely a trivial annoyance.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#404

Post by bdamm »

dgacmu wrote: post #211
bdamm wrote: post #165

Earlier quoted context omitted.

You're kidding, right?

It's actually kind of brilliant -- you're fining them in time instead of money. They've already demonstrated that they value being able to use money to buy time flexibility, so this is a fine that hurts.

No... it’s an invitation for harried parents to show up with an IOU, a store card, or the cheapest ripest milk they could find.

Charging them double fees is more like it.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#405

Post by fiddlerwoaroof »

ajsharp wrote: post #148
_m8fo wrote: post #131

Earlier quoted context omitted.

Do you believe this kind of thing is simply unavoidable? I wonder if this could've been avoided by simply making it impossible to access data without being connected to a VPN in addition to having some sort of physical device connected to your computer.

It's entirely avoidable. Just don't commit secrets to source control. Ever.

I don’t think many people intentionally commit secrets to source control. Frequently, it’s a matter of committing a bunch of work and accidentally missing the credentials you stuck in some prototype code.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#406

Post by celim307 »

rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#407

Post by yuvalmer »

It seems they didn't learn from their mistakes. It sounds that the 2014 breach was caused by the same mistake.

"That gist is believed to have contained a login key used by a hacker to access an internal Uber database of 50,000 drivers."

https://www.theregister.co.uk/2015/02/28/uber_subpoenas_gith...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#408

Post by rbag »

mewmew wrote: post #18
jtchang wrote: post #10

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.

This would have been interesting if GDPR was applied. https://www.gdpr.associates/data-breach-penalties/ "There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher.…

Something nice is also the fact that the people impacted by the breach must be told 72 hours max after the company is aware of the hack.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#409

Post by brianpan »

msh wrote: post #396
lhorie wrote: post #138

Earlier quoted context omitted.

Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake. One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and…

Uber will not tolerate unethical behavior, you got to be joking!?!?

I think the commenter meant the new CEO will not tolerate unethical behavior.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#410

Post by T-Winsnes »

celim307 wrote: post #406
rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?

There are a few SaaS offerings that will let you do that. LastPass or onepassword are two commonly used.

One you can use something like keypass to store a database in a shared location if you don't trust the SaaS offerings.

If you are looking at storing credentials for automation purposes, and don't have a secret store built in, you could look at something like Hashicorp Vault to help provide this for you

Post reply on HN