Uber Paid 20-Year-customary Florida Man $100,000 To withhold soundless approximately Data Breach


SAN FRANCISCO/WASHINGTON – A 20-year-customary Florida man was responsible for the large data breach at Uber Technologies Inc final year and was paid by Uber to extinguish the data through a so-called “bug bounty” program normally used to identify small code vulnerabilities, three people familiar with the events absorb told Reuters.

Uber announced on Nov. 21 that the personal data of 57 million users, including 600,000 drivers in the United States, were stolen in a breach that occurred in October 2016, and that it paid the hacker $100,000 to extinguish the information. But the company did not reveal any information approximately the hacker or how it paid him the money.

Uber made the payment final year through a program designed to reward security researchers who report flaws in a company’s software, these people said. Uber’s bug bounty service – as such a program is known in the industry – is hosted by a company called HackerOne, which offers its platform to a number of tech companies.

Reuters was unable to set up the identity of the hacker or another person who sources said helped him. Uber spokesman Matt Kallman declined to comment on the matter.

Newly appointed Uber Chief Executive Dara Khosrowshahi fired two of Uber’s top security officials when he announced the breach final month, saying the incident should absorb been disclosed to regulators at the time it was discovered, approximately a year before.

It remains unclear who made the final decision to authorize the payment to the hacker and to withhold the breach secret, though the sources said then-CEO Travis Kalanick was aware of the breach and bug bounty payment in November of final year.

Kalanick, who stepped down as Uber CEO in June, declined to comment on the matter, according to his spokesman.

A payment of $100,000 through a bug bounty program would be extremely strange, with one former HackerOne executive saying it would represent an “every single-time record.” Security professionals said rewarding a hacker who had stolen data also would be well external the prevalent rules of a bounty program, where payments are typically in the $5,000 to $10,000 range.

HackerOne hosts Uber’s bug bounty program but does not manage it, and plays no role in deciding whether payouts are appropriate or how large they should be.

HackerOne CEO Marten Mickos said he could not discuss an individual customer’s programs. “In every single cases when a bug bounty award is processed through HackerOne, we receive identifying information of the recipient in the form of an IRS W-9 or W-8BEN form before payment of the award can be made,” he said, referring to U.S. Internal Revenue Service forms.

According to two of the sources, Uber made the payment to confirm the hacker’s identity and absorb him sign a nondisclosure agreement to deter further wrongdoing. Uber also conducted a forensic analysis of the hacker’s machine to acquire certain the data had been purged, the sources said.

One source described the hacker as “living with his mom in a small domestic trying to back pay the bills,” adding that members of Uber’s security team did not want to pursue prosecution of an individual who did not appear to pose a further threat.

The Florida hacker paid a moment person for services that involved accessing GitHub, a site widely used by programmers to store their code, to obtain credentials for access to Uber data stored elsewhere, one of the sources said.

GitHub said the attack did not involve a failure of its security systems. “Our recommendation is to never store access tokens, passwords, or other authentication or encryption keys in the code,” that company said in a statement.

‘SHOUT IT FROM THE ROOFTOPS’

Uber received an email final year from an anonymous person demanding money in exchange for user data, and the message was forwarded to the company’s bug bounty team in what was described as Uber’s routine practice for such solicitations, according to three sources familiar with the matter.

Bug bounty programs are designed mainly to give security researchers an incentive to report weaknesses they uncover in a company’s software. But complicated scenarios can emerge when dealing with hackers who obtain information illegally or seek a ransom.

Some companies choose not to report more aggressive intrusions to authorities on the grounds that it can be easier and more effective to negotiate directly with hackers in order to limit any harm to customers.

Uber’s $100,000 payout and silence on the matter at the time was extraordinary under such a program, according to Luta Security founder Katie Moussouris, a former HackerOne executive.

“whether it had been a valid, lega bug bounty, it would absorb been ideal for everyone involved to shout it from the rooftops,” Moussouris said.

Uber’s failure to report the breach to regulators, even though it may absorb felt it had dealt with the problem, was an error, according to people inside and external the company who spoke to Reuters.

“The creation of a bug bounty program doesn’t allow Uber, their bounty service provider, or any other company the ability to settle that breach notification laws don’t apply to them,” Moussouris said.

Uber fired its chief security officer, Joe Sullivan, and a deputy, attorney Craig Clark, over their roles in the incident.

“nonexistent of this should absorb happened, and I will not acquire excuses for it,” Khosrowshahi, said in a blog post announcing the hack final month.

Clark worked directly for Sullivan but also reported to Uber’s legal and privacy team, according to three people familiar with the arrangement. It is unclear whether Clark informed Uber’s legal department, which typically handled disclosure issues.

Sullivan and Clark did not respond to requests for comment.

In an August interview with Reuters, Sullivan, a former prosecutor and Facebook Inc security chief, said he integrated security engineers and developers at Uber “with our lawyers and our public policy team who know what regulators care approximately.”

final week, three more top managers in Uber’s security unit resigned. One of them, physical security chief Jeff Jones, later told others he would absorb left besides, sources told Reuters. Another of the three, senior security engineer Prithvi Rai, later agreed to stay in a current role.


The Huffington Post

Uber Paid 20-Year-customary Florida Man $100,000 To withhold soundless approximately Data Breach



Source link

You might also like More from author