Slashdot Mirror
IP Address May Associate Lyft CTO With Uber Data Breach (reuters.com)
An anonymous reader writes: According to two unnamed Reuters sources the IP address of Lyft CTO Chris Lambert has been revealed by Uber's investigations to be associated with the accessing of a security key that was accidentally deposited on GitHub in 2014 and used to access 50,000 database records of Uber drivers later that year. However, bearing in mind that the breach was carried out through a fiercely protectionist Scandinavian VPN, and that Lambert was a Google software engineer before become CTO of a major technology company, it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
If RIAA and CSI taught us anything is that both IP and DNA are definitive proof of guilt. Since Chris Lambert was shown to have both, we can be certain he did it.
Uber has long proven themselves to be eminently trustworthy and never scheming up shady ways to try to drive their competition out of business, so we can just take them at their word on this.
The human body can be drained of blood in 8.6 seconds given adequate vacuuming systems.
However, bearing in mind that the breach was carried out through a fiercely protectionist Scandinavian VPN, and that Lambert was a Google software engineer before become CTO of a major technology company, it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
What a great defense... there's no way it's me.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Sounds exactly like something from Mr Robot, IP address CTO of organisation found in logs related to hacking server farm.
Like, we trust the logs, after someone has Owned the system, sure let me know how that goes!
A company run by crooks with a scam as their business model. Uber is the one that blundered its own key then failed to secure its databases. Now they are blame shifting.
All the smarts in the world won't fix a fat finger. You accessed the DB from your super secure VPN, disconnected your VPN, forgot it was disconnected, reconnected -- and, oh shit, there you are: Your personal IP has been revealed. This is why you use things like Tails, folks, or you do your dirty work in a VM -- then securely delete the VM. :)
it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
No fucking shit...
So some doofus posted the keys to the kingdom on Github, and they're crying foul if a competitor picks them up to take a peek behind the curtain?
I mean, yeah, sure, that's not the gentlemen's way of doing things, but waddaya expect?!
Bitten Apples are still better than dirty Windows...
Shocking! Harumph!
SJW's don't eliminate discrimination. They just expropriate it for themselves.
I don't know why a VPN provider would favour trade tariffs.
Perhaps "protective" was meant?
https://en.wikipedia.org/wiki/...
In the sense of "there's no way this can be real, can it?".
1. Leak security key on Internet
2. Discover key has been leaked
3. Sit on ass and don't revoke the key
4. ?????
5. Profit
WTF? Some security engineer needs to lose their job over this.
Elliot changed the IP address to implicate him. No surprise!
--hongpong.com
So wait. Not only does Uber choose to commandeer Slashdot at every opportunity to spout off how great it is through increasingly vehement sockpuppet ACs and the pushing of clickbait articles, it ALSO feels the need to pull you aside and fill you in on its paranoid fantasies?
Man, 'corporate personhood' is weird. This is distinctly a personality that's consistent and recognizable. Just yeah.
Excuse me, Uber. I think I see somebody over there that I know D:
Apparently they leaked the key on GitHub, and allege that this IP address visited the page - along with tens of thousands of other visitors.
If I were CTO of a company, and I saw a Slashdot posting about "YourCompetitor leaked all of their keys on GitHub!", I would probably click through. ESPECIALLY if I were in charge of preventing similar leaks from the company I worked for.
Reuters Routers Rout Russian (probably)
Apparently Uber leaked the keys on GitHub, and allege that this IP address visited the page - along with tens of thousands of other visitors. It wasn't some sort of Mission Impossible nighttime raid or anything, they published things publicly.
If I were CTO of a company, and I saw a Slashdot posting about "YourCompetitor leaked all of their keys on GitHub!", I would probably click through. ESPECIALLY if I were in charge of preventing similar leaks from the company I worked for.
Hell, I'd probably keep an eye on what kinds of things my competitor published on GitHub simply to inform what kinds of things my company might want to publish, simply to stay competitive.
Don't know how it works in other countries. But, some USA ISP's will give you a static public facing IP and then release every so often. Just curious...
According to documents filed in the case, the company learned months after the hack that someone had used an Uber digital security key to access the driver database. A copy of the key was inadvertently posted by Uber on one of its public pages on the code development platform GitHub in March of 2014, prior to the breach, the court filings show, and remained there for months.
After Uber discovered the unauthorized download, it examined the Internet Protocol addresses of every visitor to the page during the time between when the key was posted and when the breach occurred, according to court documents. The Uber review concluded that "the Comcast IP address is the only IP address that accessed the GitHub post that Uber has not eliminated" from suspicion, court papers say.
So for months this key was sitting on a public website and they've managed to eliminate every other address from suspicion?
Unless the actual URL was somehow hidden that sounds very unlikely, I'd wager there are hacking groups who write robots to crawl around the web looking for private keys.
We don't even know in what form the key was posted, if it were sitting in some chunk of code that Uber had posted to GitHub I wouldn't be in the least surprised that the Lyft CTO decided to checkout the project to see what the rival company was doing.
I stole this Sig
Would I be stupid enough to leave my home address near the murder weapon?!
I move to drop this investigation immediately it's obviously nonsense because I am a really smart person.
As you know, smart people do not do stupid things(tm)
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
Ubers claim is that IP address X accessed Github and that that IP address belongs to Lyfts Chris Lambert because they found it on the internet associated with him.
So there is a claim we can check right there, simply by trying to find Chris Lamberts IP address on the internet:
"The two sources, however, said Uber researched the address and discovered that it showed up elsewhere in Internet postings associated with Lambert, and that the address was assigned to his name. "
I can't find a forum (the only place I can think would publicly list an IP address) with a post from Chris Lambert, perhaps you can do better?
Seriously, why would I vandalize something leaving traces that it was me, massive impossible to miss traces that place blame directly on me?
Because my defense would be "I'd never be that inept or stupid as to implicate myself".
I'm sorry I just don't buy some "hacker" cracking into this guys wifi then using that connection to attack it's competitor? No, that's a little bit of a stretch IMO.
He did it, and either figured my first answer would get him out of hot water, or he's so obtuse and full of himself he didn't think to try to cover his tracks.
How does Uber know what the IP address of Lyft's CTO is?
Also, even if they did know the CTO's IP address, since when was brosing a GitHub repo prove guilt in a a data breach?
This whole story is pure bullshit.
ONE?
Everyone knows you have to go through 7 proxies.
It's that he needs to be imprisoned without bail, tried, sentenced, and all assets stripped from him and any trusts he set up.
-- Tigger warning: This post may contain tiggers! --