Uber Paid Hackers to Delete Stolen Data on 57M People • Hacker News Board

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#591

Post by toyg » Thu, Nov 23, 2017, 2:29 AM UTC

sp0rk wrote: post #582

toyg wrote: post #557

Earlier quoted context omitted.

> I don't think either of those companies would cease to exist if their code bases leaked online today. A serious Photoshop clone that can match PS feature for feature would wipe Adobe, people cannot wait to get rid of them. 25% of MS revenues comes directly from Office and another 25% from Windows or other commercial offerings that are basically driven by Office, so yeah, MS would survive a working Office clone, but…

But a competing company can't just give a copy of the leaked source code to their developers and tell them to go to town. Even by employing clean room design, you can't get around all the patents that likely protect many of the features that Photoshop users consider crucial.

> you can't get around all the patents

Just open a shop in China and obfuscate a bit. Job done.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#592

Post by ryanwaggoner » Thu, Nov 23, 2017, 3:00 AM UTC

harry8 wrote: post #106

Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known. The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will r…

What's the largest group of people you've managed?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#593

Post by tonystubblebine » Thu, Nov 23, 2017, 3:32 AM UTC

lhorie wrote: post #556

msh wrote: post #396

Earlier quoted context omitted.

Uber will not tolerate unethical behavior, you got to be joking!?!?

I think many people don't realize this, but the majority of the leadership team from like a year or two ago is now gone, including Travis. Also, Uber has been hiring a lot of new people - the ratio of new people vs old timers is really high. I'm obviously just one anecdata point, but I believe new hires (and a lot of old timers) want Uber to be an ethical company, and many have joined the company specifically to tack…

I really like how your description gets at these policies creating a tipping point in the culture. Hearing about any one individually always sounded like a bandaid, but hearing about them together and then how you and other employees react to them is very encouraging. Good luck to you and the rest of the company.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#594

Post by JumpCrisscross » Thu, Nov 23, 2017, 3:49 AM UTC

nroets wrote: post #567

harry8 wrote: post #235

Earlier quoted context omitted.

No, don't get hung up on unnecessary details. The reasonable company director should have known X and when found out was bound to report it. Person Y did not report it, should have known as it was their job to know and there aren't extenuating circumstances. Guilty. 6 months. Next case. "I don't know anything about this company I accept 7 figure sums to oversee as a director." Should never be any kind of legal defenc…

So person Y read an email late at night and forgot about it. So you send a director to jail. Tomorrow many of the "good" directors feel scared and they simply do not accept any new appointments. Who will fill the void ? People who are overconfident and people who are not scared of going to jail. It's much better to impose financial penalties. Should the directors or the shareholders pay ? Let them figure it out betwe…

> So person Y read an email late at night and forgot about it. So you send a director to jail

We do this for CFOs, Chief Compliance Officers and many other roles for many other things.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#595

Post by ihattendorf » Thu, Nov 23, 2017, 4:47 AM UTC

gejjaxxita wrote: post #490

claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

2FA wouldn't have necessarily solved this, if the hackers had access to an engineer's ssh keypair (e.g stolen laptop) they could clone repos as they pleased. 2FA isn't a silver bullet.

Could use a Yubikey (or similar) for SSH access.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#596

Post by whack » Thu, Nov 23, 2017, 5:35 AM UTC

harry8 wrote: post #424

randerson wrote: post #345

Earlier quoted context omitted.

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…

Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your…

IANAL but isn't it already the case that if you knowingly break a law, you can be convicted and sentenced to jail? In this case, I'm assuming that it's not against the law to cover up a hacking incident, in which case there's no basis to suggest putting someone in jail.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#597

Post by hvidgaard » Thu, Nov 23, 2017, 8:54 AM UTC

randerson wrote: post #345

harry8 wrote: post #106

Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known. The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will r…

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…

If you can demonstrate due process and reasonable effort to secure against breaches, your doing your job. For instance with described procedures, sane defaults, locked down environments ect. But if you're a CSO and have not described threatmodels, workflows, and security practices, then you've not done your job and should be held accountable for data breaches.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#598

Post by hvidgaard » Thu, Nov 23, 2017, 8:56 AM UTC

qznc wrote: post #454

nevir wrote: post #419

Earlier quoted context omitted.

> So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence? By analyzing how they prepared for the inevitable attack (mitigation), as well as how they respond to it after the fact.

(In the EU) companies are already required to tell where my personal data goes to. There is no specific fine for violations as far as I know though. Essentially we need a price tag on personal data. Let's say 1$ for each email and password leaked to an unknown number of entities. That would be a 114M$ incentive for Uber to keep their data secure.

GDPR will come into effect in about half a year. Everyone is sitting duck about exactly how to implement things. When this gets into effect, companies will take it seriously - the fine is astronomical if you fail.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#599

Post by slackingoff2017 » Thu, Nov 23, 2017, 10:22 AM UTC

lhorie wrote: post #138

claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake. One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and…

Found the newest marketing hire...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#600

Post by diggan » Thu, Nov 23, 2017, 12:18 PM UTC

ghostbrainalpha wrote: post #555

diggan wrote: post #488

Earlier quoted context omitted.

Yeah, but hopefully they can't do much if they just have your code base. If the secrecy of your code is the only thing stopping hackers from exploiting you, you're missing some gaping holes in your infrastructure. With that said, nothing wrong with using secrecy as a additional barrier, but shouldn't be the only, and if it's not the only, you're not "so owned at that point".

If they have access to the code inside Github, would they have been able to push their own changes to the code without anyone noticing? Maybe pushing something that was labeled as a "security patch" but was actually a disguised vulnerability? I could see not even checking into that, and just downloading it. But I'm on a small team. Do big companies have procedures to protect against this?

Depends on how they get access. If they got control of one of the user accounts with push access, they could surely push code (but unsure about "without anyone noticing", depends on their own development processes I guess). However, if they got access to the code by reading some part of the memory/storage holding the code, without actually gaining access through authentication, they wouldn't be able to change it.