FRAUD! Uber PAID RANSOM to Conceal IDIOTIC Data Breach

In 2014, Uber's data was stolen after their passwords were discovered in plaintext. The FTC opened an investigation and Chief Security Officer Joe Sullivan testified. He "forgot" to mention that it had happened again.

#uber #hack #sullivan

Thank you, supporters!
(The new list will begin on the 2nd)

August 2020 Supporters!
$50+ supporters: Nicely Done Defense, Joe Tyson, Wes delj, Citizen of the Sovereign, John Steel, Gavin Barnard, Eevi , Kyle Mudrak, Spirit Bear, Jan Negrey, Benjamin Hitov, Stephen , blackleaf, Cute Grills in your area..., Longreach Jones, Definitely not Prenda Law, Ugly Grill, Shielo T, Rudolph Bescherer Jr, Oscar The Phrophet , J. Dixon, HotGrillsInYourArea, Ameknight, engi , Brandyn Abel, torpedan, Creative Corruptions

[Ceece]

All companies should be held criminally and financially liable for any data they collect, including data they sell to 3rd parties. No getting out of it with damn ToS agreements.

[mthiffau]

When you did the bit about "black van with a red stripe", I had to pause and go back to check the text. It's sad that a bunch of incompetent Uber execs thinking enough of themselves to ride around in an A-Team van is actually believable.

[lexslate]

Notoriously exploitative company does something stupid, reckless and unethical? I will try to control my surprise.

[deriamis]

Just to clarify something that was apparently garbled in the complaint - AWS access IDs are not secrets. Access *keys* are. What AWS users will usually do is put the access ID for a "user" (it's not really a user, but whatevs) in their code somewhere and then use one of the AWS secret management services to pull the access key that corresponds to the ID. The ID is really just like a username, and the key is a random password AWS generates for you once and only once.

That said, part of the point of using an AWS secret management service is that you are able to automatically rotate the keys regularly with zero effort. It takes almost no effort to implement that, which was by purposeful choice in the design AWS used. So the confusion doesn't save the situation for them anyway. DUMB, DUMB, DUMB.

[kempokiai]

Oh the irony of an Uber pre-roll ad on this video really hits hard hahaha

[Fastollis]

Man all this stuff about Uber (and Lyft) lately has me feeling pretty vindicated about never trusting them.

[Axius]

Oh my God, I KNEW about that flaw! I saw some programmers talking about it online. I talked to an Uber driver about it and couldn't convince him that it was real.

I feel very vindicated right now :)

[MrShoward]

FYI: “Misprision” is the deliberate concealment of one’s knowledge of a treasonable act or felony. A rare word these days, I’d say!

[DahVoozel]

Unencrypted database... in 2020. After how many high profile breaches?

[hive_indicator]

It's shocking that a company that has repeatedly shown itself to be both incompetent and evil is incompetent and evil. <SNARK>

[ScorpiusZA.]

Well, that was stupid trying to cover that up.

EDIT: Another breach, there was more than one?

[DontScareTheFish]

For non technical people
S3 (simple storage service) is a place to store files. It's very slow (compared to hard disks / SSD's) but it's plenty fast enough for http type requests. S3 is about 1/3 - 1/10th the cost of disk based storage (EBS). You typically use http to interact with the content (think posting a form rather than the file on disk). The storage is also not bound to a VM within AWS. In short it's good for backups, or similar that don't require alot of I/O, It would be really bad if you try and use it as the storage for a running database.

You NEVER write keys (or any other credentials) in code. That's software development 101. Anyone who has either done software development professionally or worked in a similar environment would know 9:03 was a complete lie. I'd expect an intern to know better. EVERY programming language has ways of getting values from a config file or the environment they are running in.

If you need to store those credentials in a repo (because you're doing CI/CD) then you use GPG or similar to encrypt the content and only decrypt either during deployment or at runtime. There are alternatives

[CombatZAK]

As a former GitHub employee who has also worked on other code-management products, secrets in the repo happens a lot, and it's a major problem for companies of any size - there are credscan tools available that will prevent commits that include credentials/secrets - definitely a must-have.

*"Fired Sullivan"* so how much did Uber give him as a severance? LMAO

[volodyanarchist]

Wonderful sunflowers. Interesting story. Thank you.

[depleteduraniumcowboy]

Many companies break the rules and just pay the fines if it is profitable. Wells Fargo anyone?

[xCAFEFD]

4:25
I feel it's really awkward when a company does its own investigation and sends its own 'police' to enforce their own version of justice.

[na]

Not to mention all the sex assault claims against them for not background checking their drivers nor the coverup and defamation they did against one of the victims in Asia.

[konstantinkh]

Yeah, there are ways to create secrets on a cloud platform that prevent keys from being present in code specifically for these kinds of situations, which is a standard practice. This is beyond simple negligence.

[katrinabryce]

I guess you don't cover English court cases, but there are two rulings pending for Über London which could be interesting. There was a (UK) Supreme Court hearing just over a month ago regarding employment status of their drivers, similar to California. If that goes against them, they could owe their drivers about £120m in back pay. The other is in Westminster Magistrates Court hopefully later this month if there are no more Covid ajournments, regarding Transport for London's decision to revoke their licence to operate.