How can they be sure the hackers didn’t have another copy?
Uber Paid Hackers to Delete Stolen Data on 57M People
421–430 of 606 posts
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#422Earlier quoted context omitted.
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...
that doesn't protect you from GitHub employees snooping around.
Or anyone who manages to breach GitHub's defenses.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#423Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known. The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will r…
I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…
I’m not sure the previous comment is saying in all circumstances. I agree with what you’re saying - because higher officials obviously aren’t able to catch every mistake made by every engineer but I think the parent comment really meant that if there is gross negligence or intent to cover up breaches then that seems like a crime that the individual should be punished for.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#424Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known. The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will r…
I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…
Not because you got hacked. No. Hell no. I never suggested that and reject it totally.
We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your board of directors.
CSOs, senior management, boards of directors should be personally responsible for their own actions. They need to have something at stake that they really dread losing when making the decision "perhaps we can get away with this?"
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#425Earlier quoted context omitted.
I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…
Well, day care operators have since learned... ... as I sit in my home office, just over an hour away from day care closing time I assure you I'm watching the clock like a hungry hawk watching a mouse. See, my kid's day care charges a mere $600 per hour late (billed in 1 minute increments). I don't see kids parents late that often :-) and we've come close to missing it, but haven't in two years.
Can I ask where you live?
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#426Thats good , on the contrary Facebook continues to steal data. One of former FB employees has confirmed that the social media giant cares more about data collection than safeguarding your information
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#427Earlier quoted context omitted.
To use 2fa on github you need a mobile phone. Do you give every enployee a mobile phone, or do you ask your employees to use their own personal phones? Asking them to use their personal phones seems like a very bad solution. Many software companies do not routinely give developers mobile phones...
> To use 2fa on github you need a mobile phone. This is incorrect. You only need the ability to generate TOTP or U2F tokens. This is often done using a smartphone app, but can also be done by a desktop app like 1Password or a hardware device like a Yubikey: https://github.com/blog/2071-github-supports-universal-2nd-f...
You can also record the TOTP secret in your automated login script, next to your password, and generate the token on the fly right there.
It's things like that that make me wonder why TOTP tokens are supposed to be conceptually different from passwords. A TOTP scheme involves knowing a master password, and nothing else.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#428Earlier quoted context omitted.
I mean they don't say how they accessed the GitHub repo or whether there was a vulnerability in Github itself that allowed access
I assume it was password reuse from one of their engineers or something similar. If you could compromise GitHub itself there would probably be higher value targets (source code for upcoming AAA games, Coinbase, government organizations, etc.)
> If you could compromise GitHub itself there would probably be higher value targets (source code for upcoming AAA games
I'm intrigued. Why would that be a higher-value target?
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#429> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?
We're using Keepass / MacPass password protected vault shared with the team using Dropbox. It's really good and essentially free to use if you use a free Dropbox account.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#430> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?
Keepass and keybase team repo to sync.