Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

581–590 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#581

Post by ryandrake »

jonatron wrote: post #495
ryandrake wrote: post #469

Earlier quoted context omitted.

> In an organization of about 200 engineers across various products, 1000+ github repos Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.

Agencies may create multiple repos per client / project.

Good point—I can see the point of having numerous repos if you have multiple unrelated clients’ code bases.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#582

Post by sp0rk »

toyg wrote: post #557
diggan wrote: post #529

Earlier quoted context omitted.

> Adobe, Microsoft Office, Salesforce I don't think either of those companies would cease to exist if their code bases leaked online today. Sure, someone might get something to build, but there is surely A LOT of things around the code bases to support all of this, which means the code bases would mostly serve as a study for software in general (and finding holes obviously). Github is a bit unfair comparision, as the…

> I don't think either of those companies would cease to exist if their code bases leaked online today. A serious Photoshop clone that can match PS feature for feature would wipe Adobe, people cannot wait to get rid of them. 25% of MS revenues comes directly from Office and another 25% from Windows or other commercial offerings that are basically driven by Office, so yeah, MS would survive a working Office clone, but…

But a competing company can't just give a copy of the leaked source code to their developers and tell them to go to town. Even by employing clean room design, you can't get around all the patents that likely protect many of the features that Photoshop users consider crucial.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#583

Post by jbob2000 »

harry8 wrote: post #424
randerson wrote: post #345

Earlier quoted context omitted.

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…

Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your…

The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data?

And how do you make that scale? If I miss a semicolon and leak 5 people's data, then I'd hardly get any jail time. If I miss a semicolon and leak 150,000,000 people's data, I will die in prison. In both scenarios, I made the same error, but the outcomes were insanely different!

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#584

Post by Atheros »

jbob2000 wrote: post #583
harry8 wrote: post #424

Earlier quoted context omitted.

Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your…

The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data? And how do you make that scale? If I miss a semicolon and leak 5 people's data, then…

The law as plenty of experience dealing with sufficient nuance to distinguish a mistake from negligence.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#585

Post by lhorie »

drawnwren wrote: post #578
lhorie wrote: post #556

Earlier quoted context omitted.

I think many people don't realize this, but the majority of the leadership team from like a year or two ago is now gone, including Travis. Also, Uber has been hiring a lot of new people - the ratio of new people vs old timers is really high. I'm obviously just one anecdata point, but I believe new hires (and a lot of old timers) want Uber to be an ethical company, and many have joined the company specifically to tack…

This is good for Uber and their employees in the short term, but I can't help but think it's bad for their ideals in the long run. There are a lot of scenarios that look very bad for Uber economically and it would be a shame for a culture shift to coincide with the realization of one of them.

Honestly, I find that a lot of economic discussions on the media are highly speculative (and dissonant to what I've seen circulated internally), and things get just downright sensationalist on some topics, so I've been taking news about Uber with a large grain of salt.

> it would be a shame for a culture shift to coincide with the realization of one of them

I think everyone at Uber has at least some idea about the P&L situation, but there's no doubt in people's minds that we need to drop the go-fast-and-dubiously culture and embrace a do-things-properly culture. If anything, I think it's more likely that a major crisis would continue to drive home that idea.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#586

Post by deathanatos »

uxp wrote: post #546
chimeracoder wrote: post #150

Earlier quoted context omitted.

> I don't know if they were using GHE. If they were, at the time it did not come with a good way for them to enforce 2FA for users. Well, sort of - at the application level, that's true, but GHE is typically run behind a VPN. Certainly that should be the case for a company the size of Uber. Even before GHE added 2FA, it shouldn't have been possible for a leaked set of login credentials to be used to access GHE, witho…

At my company (mostly a Windows and Microsoft shop), my domain credentials are used to log into the VPN, and TFS, and Octopus. Compromising just that one set of credentials could effectively "own" our company. And I'm just a senior-ish developer. Lateral movement by an attacker is a real thing. And while credential reuse is something most security focused web companies are trying to mitigate, a push for "sso"-like ac…

> my domain credentials are used to log into the VPN, and TFS, and Octopus. Compromising just that one set of credentials could effectively "own" our company.

This is why 2FA is important! I worked for a company that had a very similar setup: I essentially had a single "LDAP" password. But: everything web-browser went through a single sign-on site, and it required 2FA (and so, you were never entering your password into even random internal applications: there was exactly one page where you should log in). Terminal stuff had a similar flow that also required 2FA (e.g., for SSH). As a user, the experience was not painful at all.

It does seem like, however, from an operations standpoint, getting such a setup in the first place is not trivial.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#587

Post by deathanatos »

eeZah7Ux wrote: post #246
giobox wrote: post #98

Earlier quoted context omitted.

I really don't think using 2FA and the direct hacking of an individual developer's machine are all that comparable here. Who cares about access to individual dev's machines if the credentials to access code on github are obtained - 2FA at least offers some degree of protection in this scenario. The scope for attack is extremely different.

Laptops and desktops are by far the weakest link and a trove of passwords, tokens, code, logs, chats, emails. They run browsers, communication tools, all sort of product experiments and testbeds, and they even connect to random airport/hotel wifi. Attack a laptop and all software and hardware 2FA tokens are useless. A backdoor can sit around and wait for the user to press the button.

> A backdoor can sit around and wait for the user to press the button.

There exist 2FA protocols[1] that permit tying the 2FA challenge to a particular context: you can't just take the response from the 2FA hardware and use it anywhere. In this regard, the malware doesn't get anything more than what they already have, and the 2FA still adds protection: if the malware is able to compromise your password (e.g., through keylogging) it doesn't immediately get access to everything you have access to. Now, of course, if you 2FA for some resource, then yes, at that point, you're probably doomed, but I don't believe that gets the malware anything new (e.g., once the auth is complete, if that results in a "user is logged in" cookie, the malware could just read that, and go to town.)

Compromise of a local machine is definitely bad, and not what you want, but 2FA tokens are not useless, even in that situation.

[1]: https://developers.yubico.com/U2F/Protocol_details/Overview....

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#588

Post by dboreham »

harry8 wrote: post #424
randerson wrote: post #345

Earlier quoted context omitted.

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…

Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your…

Covering up isn't done by the CSO. It'll be driven by lawyers, or worst-case by a rogue CEO. Mind you the CSO would be expected to resign under those circumstances, if they were kept in the loop on the cover up plan.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#589

Post by dboreham »

Johnny555 wrote: post #566
bo1024 wrote: post #514

Earlier quoted context omitted.

> If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems. I see a big difference between preparing for the event of a hack, and believing that a hack is inevitable no matter what practices are in place.

How do you get your CEO to pay for the monitoring and other breach preparation if you've just told him that "We have air-tight security, we cannot get hacked"? CSO: We have airtight security, we cannot get hacked. CEO: Great! CSO: Please approve and fund this plan to handle a breach in case we are hacked. CEO: But you just told me we can't get hacked. CSO: Right, it's impossible. CEO: So why do we need to spend money…

Probably the CEO would have read the document their Insurance Carrier made him sign that details the measures they need to keep cyber cover valid and therefore this conversation wouldn't happen.
Post reply on HN