Slashdot Mirror
IP Address May Associate Lyft CTO With Uber Data Breach (reuters.com)
An anonymous reader writes: According to two unnamed Reuters sources the IP address of Lyft CTO Chris Lambert has been revealed by Uber's investigations to be associated with the accessing of a security key that was accidentally deposited on GitHub in 2014 and used to access 50,000 database records of Uber drivers later that year. However, bearing in mind that the breach was carried out through a fiercely protectionist Scandinavian VPN, and that Lambert was a Google software engineer before become CTO of a major technology company, it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
If RIAA and CSI taught us anything is that both IP and DNA are definitive proof of guilt. Since Chris Lambert was shown to have both, we can be certain he did it.
Uber has long proven themselves to be eminently trustworthy and never scheming up shady ways to try to drive their competition out of business, so we can just take them at their word on this.
The human body can be drained of blood in 8.6 seconds given adequate vacuuming systems.
However, bearing in mind that the breach was carried out through a fiercely protectionist Scandinavian VPN, and that Lambert was a Google software engineer before become CTO of a major technology company, it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
What a great defense... there's no way it's me.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Sounds exactly like something from Mr Robot, IP address CTO of organisation found in logs related to hacking server farm.
Like, we trust the logs, after someone has Owned the system, sure let me know how that goes!
A company run by crooks with a scam as their business model. Uber is the one that blundered its own key then failed to secure its databases. Now they are blame shifting.
All the smarts in the world won't fix a fat finger. You accessed the DB from your super secure VPN, disconnected your VPN, forgot it was disconnected, reconnected -- and, oh shit, there you are: Your personal IP has been revealed. This is why you use things like Tails, folks, or you do your dirty work in a VM -- then securely delete the VM. :)
it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
No fucking shit...
So some doofus posted the keys to the kingdom on Github, and they're crying foul if a competitor picks them up to take a peek behind the curtain?
I mean, yeah, sure, that's not the gentlemen's way of doing things, but waddaya expect?!
Bitten Apples are still better than dirty Windows...
Shocking! Harumph!
SJW's don't eliminate discrimination. They just expropriate it for themselves.
I don't know why a VPN provider would favour trade tariffs.
Perhaps "protective" was meant?
https://en.wikipedia.org/wiki/...
In the sense of "there's no way this can be real, can it?".
Elliot changed the IP address to implicate him. No surprise!
--hongpong.com
So wait. Not only does Uber choose to commandeer Slashdot at every opportunity to spout off how great it is through increasingly vehement sockpuppet ACs and the pushing of clickbait articles, it ALSO feels the need to pull you aside and fill you in on its paranoid fantasies?
Man, 'corporate personhood' is weird. This is distinctly a personality that's consistent and recognizable. Just yeah.
Excuse me, Uber. I think I see somebody over there that I know D:
Apparently they leaked the key on GitHub, and allege that this IP address visited the page - along with tens of thousands of other visitors.
If I were CTO of a company, and I saw a Slashdot posting about "YourCompetitor leaked all of their keys on GitHub!", I would probably click through. ESPECIALLY if I were in charge of preventing similar leaks from the company I worked for.
Reuters Routers Rout Russian (probably)
Apparently Uber leaked the keys on GitHub, and allege that this IP address visited the page - along with tens of thousands of other visitors. It wasn't some sort of Mission Impossible nighttime raid or anything, they published things publicly.
If I were CTO of a company, and I saw a Slashdot posting about "YourCompetitor leaked all of their keys on GitHub!", I would probably click through. ESPECIALLY if I were in charge of preventing similar leaks from the company I worked for.
Hell, I'd probably keep an eye on what kinds of things my competitor published on GitHub simply to inform what kinds of things my company might want to publish, simply to stay competitive.
Don't know how it works in other countries. But, some USA ISP's will give you a static public facing IP and then release every so often. Just curious...
According to documents filed in the case, the company learned months after the hack that someone had used an Uber digital security key to access the driver database. A copy of the key was inadvertently posted by Uber on one of its public pages on the code development platform GitHub in March of 2014, prior to the breach, the court filings show, and remained there for months.
After Uber discovered the unauthorized download, it examined the Internet Protocol addresses of every visitor to the page during the time between when the key was posted and when the breach occurred, according to court documents. The Uber review concluded that "the Comcast IP address is the only IP address that accessed the GitHub post that Uber has not eliminated" from suspicion, court papers say.
So for months this key was sitting on a public website and they've managed to eliminate every other address from suspicion?
Unless the actual URL was somehow hidden that sounds very unlikely, I'd wager there are hacking groups who write robots to crawl around the web looking for private keys.
We don't even know in what form the key was posted, if it were sitting in some chunk of code that Uber had posted to GitHub I wouldn't be in the least surprised that the Lyft CTO decided to checkout the project to see what the rival company was doing.
I stole this Sig
Would I be stupid enough to leave my home address near the murder weapon?!
I move to drop this investigation immediately it's obviously nonsense because I am a really smart person.
As you know, smart people do not do stupid things(tm)
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
Accessing Github is crime?
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
ONE?
Everyone knows you have to go through 7 proxies.
Accessing Github is crime?
no, but using the information found there for cyber warfare against your competition is.
Chris Lambert has been revealed by Uber's investigations to be associated with the accessing of a security key that was accidentally deposited on GitHub in 2014 and used to access 50,000 database records of Uber drivers later that year.
or maybe you are suggesting the "you made it easy for me to commit the crime" defense? like, you left your bike unlocked, therefore it's mine for the taking?
It's that he needs to be imprisoned without bail, tried, sentenced, and all assets stripped from him and any trusts he set up.
-- Tigger warning: This post may contain tiggers! --