Slashdot Mirror
Uber Discloses Database Breach, Targets GitHub With Subpoena
New submitter SwampApe tips news that Uber has revealed a database breach from 2014. The company says the database contained names and diver's license numbers of their drivers, about 50,000 of which were accessed by an unauthorized third party. As part of their investigation into who was behind the breach, Uber has filed a lawsuit which includes a subpoena request for GitHub. "Uber's security team knows the public IP address used by the database invader, and wants to link that number against the IP addresses and usernames of anyone who looked at the GitHub-hosted gist in question – ID 9556255 – which we note today no longer exists. It's possible the gist contained a leaked login key, or internal source code that contained a key that should not have been made public."
Now, why would they be asking about a gitHub gist?
I'll bet one of Uber's own developers leaked the key. Presumably, by accident.
Any hacker with any decent opsec would not be showing their actual IP address. The subpoena request is just smoke and mirrors to hide Uber's own security fail. Even if GitHub were to hand over the data, they would likely find nothing useful. Uber know that GitHub will not hand over that data without a fight. I am willing to bet that Uber are going to start claiming that the hack isn't their fault because GitHub won't hand over the data. If Uber already know the public IP of the hacker, why do they need the info from GitHub to proceed? Meanwhile the actual security fail of Uber making their database access info publicly accessible gets overlooked.
Because they think it was a crime of opportunity, which sounds like a reasonable supposition -- the hacker stumbled across the key in Github, then either gave (or sold) the key to someone else to do the hack, or did the hack himself. Clearly he wouldn't have downloaded the data using his own IP address, but it's entirely possible that when he found the key on Github, he was using a traceable IP.
By admitting that one of their developers leaked the key himself on Github, it seems a little late for them to claim that they have no responsibility for the breach.
"If Uber already know the public IP of the hacker, why do they need the info from GitHub to proceed?"
The answer in the summary: "to link that number against the IP addresses and usernames." Right now they just have an IP, but it's possible that the attacker was logged into their Github account, another piece of information that could help identify him.
"Any hacker with any decent opsec would not be showing their actual IP address."
There's tons of very skilled and usually-careful criminals in prison. Everyone makes mistakes sooner or later. Maybe the attacker did this time.
"Meanwhile the actual security fail of Uber making their database access info publicly accessible gets overlooked."
Yes, Uber messed up if they posted a key in a gist. If someone suffers harm from the data breach, they could sue Uber for that negligence. That doesn't change the fact that the attacker committed a crime and illegally accessed private information. Weak security and leaked access codes don't change the fact that unauthorized access is illegal. The principle is the same in cyberspace as in meatspace. Uber is doing nothing wrong or atypical in trying to identify the hacker.
It is a very common occurrence. despite what many like to believe, the vast majority of developers are completely clueless when it comes to security and handling secrets.