Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

411–420 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#411

Post by vor0nwe »

celim307 wrote: post #406
rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?

We use 1password for teams.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#412

Post by HaloZero »

yjftsjthsd-h wrote: post #357
sbuttgereit wrote: post #253

Earlier quoted context omitted.

There's a lot of things we as adults agree to where the consequences can be steep. This is one of the easier ones: we just show up on time. We plan accordingly and we, as responsible adults, manage to pull it off. That's not hard: so why not agree to such a thing? Another perspective on this is why should we expect someone else to bear the consequences of our failing to meet our responsibilities? If we're late pickin…

So you're in a car accident on the way and wake up in the hospital with a few thousand dollars in fines. Or better yet, pass out at home (in spite of being in good health; blood pressure can do weird things) with no witnesses and come to a few hours later.

I imagine the daycare will make an exception in the case of a family emergency.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#413

Post by HaoZeke »

The problem of course is them storing private credentials on Github despite numerous highlights on the site to not do so.

Private github sites are private as in hidden. Not as in digitally encrypted bank vault.

What sort of tech company doesn't go for a self hosted git option anyway!?

Like Gitlab which comes with CI to keep the whole thing private.

Also self hosting allows an arbitrary level of security..

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#414

Post by whyenot »

yjftsjthsd-h wrote: post #357
sbuttgereit wrote: post #253

Earlier quoted context omitted.

There's a lot of things we as adults agree to where the consequences can be steep. This is one of the easier ones: we just show up on time. We plan accordingly and we, as responsible adults, manage to pull it off. That's not hard: so why not agree to such a thing? Another perspective on this is why should we expect someone else to bear the consequences of our failing to meet our responsibilities? If we're late pickin…

So you're in a car accident on the way and wake up in the hospital with a few thousand dollars in fines. Or better yet, pass out at home (in spite of being in good health; blood pressure can do weird things) with no witnesses and come to a few hours later.

If you were in a car accident, chances are that the day care would waive the fee. The fee doesn't exist to be needlessly cruel, it's there to encourage parents to pick up their children before closing.

As far as passing out in your home for a few hours. If that were really an issue for you, then potentially paying $600 might motivate you to actually go see a doctor. Otherwise there could come a day when you pass out and never wake up (and your children never get picked up by you or see you alive again)...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#415

Post by HaoZeke »

Spivak wrote: post #195
comstock wrote: post #162

Earlier quoted context omitted.

To use 2fa on github you need a mobile phone. Do you give every enployee a mobile phone, or do you ask your employees to use their own personal phones? Asking them to use their personal phones seems like a very bad solution. Many software companies do not routinely give developers mobile phones...

> use their personal phones seems like a very bad solution Why? You're not any less secure by using a personal phone. What are the odds that an employee is going to be phished and have their phone compromised by the same entity.

Pretty high actually.. I mean it's a lot of money at stake.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#416

Post by HaoZeke »

tmh79 wrote: post #81
claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

uber engineer here, we have 2fa set up for everything. Starting my day takes about 5 different 2fa checks (ssh access, aws, phabricator, team chat, etc)

That sounds really inefficient

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#417

Post by veidr »

wallace_f wrote: post #399
veidr wrote: post #303

Earlier quoted context omitted.

I think it's more the "anti-fact" wing of the media (which does mostly overlap "conservative" on the Venn diagram). Unabashed alt-right agitprop outlets like Breitbart news, for instance, or climate change deniers. There are a couple different things at play. First, one plank in their infowar strategy is to combat anything that even indirectly propagates any understanding of climate change among the proles. They take…

I personally mostly don't agree with conservative media either, and I even mostly agree with you here, but to be fair the left also has their anti-fact narratives & outlets, and wrongthink, just the same as the right--just on different issues.

I completely agree with you, and didn't mean to imply otherwise.

Although I do think there tends to be a broader overlap on the "conservative" side, for reasons for that are complicated and don't necessarily have a lot to do with being conservative, the "liberal" side does indeed have its vaccine deniers, MSG paranoiacs, and so on. (However, they don't have TV networks dedicated to these things, available in every hotel and airport in the country...)

I try to judge media organizations (and people) based on their commitment to truth and openness to empirical evidence and new information. Their political leanings may be interesting, but are a (much) less significant data point.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#418

Post by Buge »

claudiulodro wrote: post #31
rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

Do we know how the attackers accessed the github repo? If it was via malware on the employee's machine, or cookie theft then 2fa wouldn't have helped.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#419

Post by nevir »

forapurpose wrote: post #392
randerson wrote: post #345

Earlier quoted context omitted.

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…

You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn't be given a pass on everything either. So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence? > A random engineer could make a mistake that gets hackers a step closer That…

> So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence?

By analyzing how they prepared for the inevitable attack (mitigation), as well as how they respond to it after the fact.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#420

Post by navinsylvester »

rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

Totally agree. I am moving secrets onto consul/vault - would like to hear what others use for the same.
Post reply on HN