> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
Really surprising to see that sensitive credentials were checked in to VCS. Apart from peer code review, how can a company avoid developers checking in sensitive data to VCS?
Uber Paid Hackers to Delete Stolen Data on 57M People
461–470 of 606 posts
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#462Earlier quoted context omitted.
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...
Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake. One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and…
Are you using Github Enterprise? Is it available from outside of the uber network?
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#463> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?
I think that something like Stack's Blackbox is the best idea. This ansible-based setup also explains the concepts pretty well: http://ansiblecookbook.com/html/en.html#how-do-i-store-priva...
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#464Earlier quoted context omitted.
I personally mostly don't agree with conservative media either, and I even mostly agree with you here, but to be fair the left also has their anti-fact narratives & outlets, and wrongthink, just the same as the right--just on different issues.
I completely agree with you, and didn't mean to imply otherwise. Although I do think there tends to be a broader overlap on the "conservative" side, for reasons for that are complicated and don't necessarily have a lot to do with being conservative, the "liberal" side does indeed have its vaccine deniers, MSG paranoiacs, and so on. (However, they don't have TV networks dedicated to these things, available in every ho…
That used to be the tendency, yes, but according to Jonathan Haidt at https://heterodoxacademy.org, "the left" has caught up to "the right"/conservatives in the number of scientific topics they deny outright, and it has happened in the last 5 years.
So very recently, and unless you've been to college in those years, you won't be aware of it.
I forget where he said it, or I would link to it. It might have been in a recent conversation he had with Jordan Peterson.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#465Earlier quoted context omitted.
I never quite know how to think about them. On the one hand, they’d changed an entire industry in a way that people wanted but was getting serious resistance from the entrenched players. They had to break a lot of rules and go around a lot of people with a whole lot of connections to get where they are and in the process made a lot of enemies. I expect blowback. I expect negative news. They essentially pulled it off…
AirBnb had to fight a very similar path and the only bad press I can remember about them was that tone deaf/ offensive political marketing campaign they had.
There's been several articles about them shafting apartment owners, offering very little from their "insurance" for trashed apartments. In most cases the renters are sane people, but if you get the drug-fueled orgy, you can probably safe in betting that AirBnB will not compensate you for the cleanup.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#466Earlier quoted context omitted.
I never quite know how to think about them. On the one hand, they’d changed an entire industry in a way that people wanted but was getting serious resistance from the entrenched players. They had to break a lot of rules and go around a lot of people with a whole lot of connections to get where they are and in the process made a lot of enemies. I expect blowback. I expect negative news. They essentially pulled it off…
AirBnb had to fight a very similar path and the only bad press I can remember about them was that tone deaf/ offensive political marketing campaign they had.
AirBnb have their own issues, and plenty of bad press about cities popular with tourists crumbling under the load AirBnB are causing on their communities.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#467Earlier quoted context omitted.
Why would you respond like this to someone putting forward plain facts.
Because it was in response to a post about how low the fines were: "i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor" $1.9b may sound like a lot, but there's a lot of blood attached to it.
Perhaps you should start reading this thread once more, starting with untog's daycare story. Then you might see why the financial facts are important.
It's not because any specific fine can ever be adequate compensation for all the suffering caused by the cartels. It's because you want the fine to be large enough to actually deter bad behavior in the future.
In this particular case I believe the fine (perhaps in combination with the threat of other regulatory action) has changed HSBC's behavior as there are many stories about erroneously frozen HSBC business accounts.
I just wonder if any number of deaths will ever change the behavior of the politicians who designed the disastrous war on drugs policies that have so utterly failed. I fear that won't happen as long as voters don't care about facts.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#468... so honestly, at this point, we basically have another Uber thing every 2nd week.
I do not get why there is no legal action taken against Uber or even steps to shut it down.
So much of the stuff violate basic laws how to run a business, apart from the humongous flaws in Ubers ethics and damaging effects on society.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#469Earlier quoted context omitted.
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...
Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source. In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to s…
> In an organization of about 200 engineers across various products, 1000+ github repos
Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#470Earlier quoted context omitted.
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...
This is so gob-smackingly uncommon I started asking "do you require 2fa for your github accounts" as part of my interview questions when I was looking for jobs (i.e. I'd ask my interviewers). I don't know how to feel knowing that there is even one software-focused company out there that doesn't enforce 2fa on its github accounts. Like... how?! Why?!
Unless you're talking about a 3 person start-up, wouldn't the use of github itself be a red flag? If you're a software company, you live and die by your source code. Why on earth would you rely on some other company to hold it for you? This seems as ridiculous as doing your bookkeeping on Google Docs.
I've never once worked in a company that permitted source code to leave the company network.