Slashdot Mirror
IP Address May Associate Lyft CTO With Uber Data Breach (reuters.com)
An anonymous reader writes: According to two unnamed Reuters sources the IP address of Lyft CTO Chris Lambert has been revealed by Uber's investigations to be associated with the accessing of a security key that was accidentally deposited on GitHub in 2014 and used to access 50,000 database records of Uber drivers later that year. However, bearing in mind that the breach was carried out through a fiercely protectionist Scandinavian VPN, and that Lambert was a Google software engineer before become CTO of a major technology company, it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
If RIAA and CSI taught us anything is that both IP and DNA are definitive proof of guilt. Since Chris Lambert was shown to have both, we can be certain he did it.
Uber has long proven themselves to be eminently trustworthy and never scheming up shady ways to try to drive their competition out of business, so we can just take them at their word on this.
The human body can be drained of blood in 8.6 seconds given adequate vacuuming systems.
However, bearing in mind that the breach was carried out through a fiercely protectionist Scandinavian VPN, and that Lambert was a Google software engineer before become CTO of a major technology company, it does seem surprising that he would have accessed such sensitive data with his own domestic IP address.
What a great defense... there's no way it's me.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Sounds exactly like something from Mr Robot, IP address CTO of organisation found in logs related to hacking server farm.
Like, we trust the logs, after someone has Owned the system, sure let me know how that goes!
A company run by crooks with a scam as their business model. Uber is the one that blundered its own key then failed to secure its databases. Now they are blame shifting.
So some doofus posted the keys to the kingdom on Github, and they're crying foul if a competitor picks them up to take a peek behind the curtain?
I mean, yeah, sure, that's not the gentlemen's way of doing things, but waddaya expect?!
Bitten Apples are still better than dirty Windows...
I don't know why a VPN provider would favour trade tariffs.
Perhaps "protective" was meant?
https://en.wikipedia.org/wiki/...
do your dirty work in a VM -- then securely delete the VM. :)
Or run the VM like a LiveCD from a read-only filesystem - what happens in RAM stays in RAM...
"When information is power, privacy is freedom" - Jah-Wren Ryel
It depends on your definition of a sensitive IP address.
Well my IP address cries at the slightest thing, so yeah.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)
So wait. Not only does Uber choose to commandeer Slashdot at every opportunity to spout off how great it is through increasingly vehement sockpuppet ACs and the pushing of clickbait articles, it ALSO feels the need to pull you aside and fill you in on its paranoid fantasies?
Man, 'corporate personhood' is weird. This is distinctly a personality that's consistent and recognizable. Just yeah.
Excuse me, Uber. I think I see somebody over there that I know D:
Apparently they leaked the key on GitHub, and allege that this IP address visited the page - along with tens of thousands of other visitors.
If I were CTO of a company, and I saw a Slashdot posting about "YourCompetitor leaked all of their keys on GitHub!", I would probably click through. ESPECIALLY if I were in charge of preventing similar leaks from the company I worked for.
According to documents filed in the case, the company learned months after the hack that someone had used an Uber digital security key to access the driver database. A copy of the key was inadvertently posted by Uber on one of its public pages on the code development platform GitHub in March of 2014, prior to the breach, the court filings show, and remained there for months.
After Uber discovered the unauthorized download, it examined the Internet Protocol addresses of every visitor to the page during the time between when the key was posted and when the breach occurred, according to court documents. The Uber review concluded that "the Comcast IP address is the only IP address that accessed the GitHub post that Uber has not eliminated" from suspicion, court papers say.
So for months this key was sitting on a public website and they've managed to eliminate every other address from suspicion?
Unless the actual URL was somehow hidden that sounds very unlikely, I'd wager there are hacking groups who write robots to crawl around the web looking for private keys.
We don't even know in what form the key was posted, if it were sitting in some chunk of code that Uber had posted to GitHub I wouldn't be in the least surprised that the Lyft CTO decided to checkout the project to see what the rival company was doing.
I stole this Sig