Slashdot Mirror
Uber Used Secret Spyware To Try To Crush Australian Startup GoCatch (abc.net.au)
Uber used a secret spyware program, codenamed Surfcam, to steal drivers from an Australian competitor with the aim of putting that company out of business. The startup was backed by high-profile investors including billionaire James Packer and hedge fund manager Alex Turnbull. ABC News reports: GoCatch was a major competitor to Uber when the U.S. company launched in Australia in 2012. At the time, both companies were offering a new way to book taxis and hire cars using a smartphone app. Surfcam was developed in Uber Australia's head office in Sydney in 2015. A former senior Uber employee has told Four Corners that the idea behind the use of the Surfcam spyware was to starve GoCatch of drivers.
"Surfcam when used in Australia was able to put fledgling Australian competitors onto the ropes," the former employee with direct knowledge of the program said on the condition of anonymity. "Surfcam allowed Uber Australia to see in real time all of the competitor cars online and to scrape data such as the driver's name, car registration, and so on." It allowed Uber to directly approach the GoCatch drivers and lure them to work for Uber. "GoCatch would lose customers due to poaching of its drivers draining their supply. With fewer and fewer drivers, GoCatch would eventually fold," the former Uber employee said. GoCatch's co-founder and chief executive, Andrew Campbell, said Uber's tactics damaged the company. He said: "The fact that Uber used hacking technologies to steal our data and our drivers is appalling. It had a massive impact on our business. It sets a really dangerous precedent for the Australian economy and Australian businesses as well. It tells every multinational company to come to Australia and follow the same practice. As an Australian small business, a technology start-up business based in Australia that's improving efficiency and service levels in the taxi industry, to have a company come to Australia and get away with that type of behavior is ... it's disgusting."
A senior Uber source has confirmed the existence of Surfcam, saying it was developed by a staff member in the Sydney head office who modified off-the-shelf data scraping software. "They said the Sydney employee did it under his own authority, and that once Uber discovered this, they requested he stop," the report says.
"Surfcam when used in Australia was able to put fledgling Australian competitors onto the ropes," the former employee with direct knowledge of the program said on the condition of anonymity. "Surfcam allowed Uber Australia to see in real time all of the competitor cars online and to scrape data such as the driver's name, car registration, and so on." It allowed Uber to directly approach the GoCatch drivers and lure them to work for Uber. "GoCatch would lose customers due to poaching of its drivers draining their supply. With fewer and fewer drivers, GoCatch would eventually fold," the former Uber employee said. GoCatch's co-founder and chief executive, Andrew Campbell, said Uber's tactics damaged the company. He said: "The fact that Uber used hacking technologies to steal our data and our drivers is appalling. It had a massive impact on our business. It sets a really dangerous precedent for the Australian economy and Australian businesses as well. It tells every multinational company to come to Australia and follow the same practice. As an Australian small business, a technology start-up business based in Australia that's improving efficiency and service levels in the taxi industry, to have a company come to Australia and get away with that type of behavior is ... it's disgusting."
A senior Uber source has confirmed the existence of Surfcam, saying it was developed by a staff member in the Sydney head office who modified off-the-shelf data scraping software. "They said the Sydney employee did it under his own authority, and that once Uber discovered this, they requested he stop," the report says.
What Uber did was abhorrent for sure.
However, WHY did that other company have all of these details of drivers that could be scraped? I feel like they had an API that could be arbitrarily queried for cars on the road that gave out way too much information.
Server API designers seem to never consider the importance of what they send, and how to protect the contents of what is being sent from a user that can easily install certificates or man in the middle attacks to inspect all traffic. How do you not expect competitors are trying to look at this information? Even if it were not officially sanctioned you know some software engineer at Uber would have been trying to see hit competitive apps did just to understand how other people made systems work...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Merge them with Nvidia to become "Uberscumbags" - seriously what the fuck.
At Uber implies this is culturally ingrained and expected of employees even if executives find 'weasel word' ways to claim they did not endorse it 'on the record'.
It really is time Uber gets shut down, its executive bros get executed, and a reminder is made to all corporations, both those operating in Australia and those worldwide that conduct such as this won't just be frowned upon, but will have harsh and permanent if not fatal consequences for the executives endorsing, allowing, or making it happen.
It's so hate to figure out who I hate more, Uber or the Packers.
Maybe I will just hope that the "billionaire James Packer" (the one who inherited all he has) gets scammed out of all his money and winds up living in a cardboard box, and all the Uber executives get prosecuted for fraud and thrown in prison.
Yes, I know.
Seriously, Uber is the Facebook of the ridesharing world.
AC comments get piped to
Would not have worked if GoCatch wasn't using its drivers' lower ability to have full market knowledge against them.
Crimes are things that are generally agreed by the community to be things in the community's best interest to minimize.
Using spyware to succeed in business is a crime.
A crime's punishment should be related to the amount of actual damage, thus spying on countless people is a very grave crime indeed.
Here is a wild idea. Prosecute the scumbags in charge to the maximum possible by law and get those who would harm the community off the streets.
Too many people abuse power to harm, or not care about the harm they do. Let the punishment fit the crime including the scale of the crime.
I don’t know what the laws are like in Australia, but this seems to me like a clear case of it.
AC comments get piped to
Kendall seriously, you have to be the dumbest apologist troll on slashdot - and that's truly saying something.
The source stated that the spyware program was developed by a staff member in the Sydney head office who modified off-the-shelf data scraping software.
They said the Sydney employee did it under his own authority, and that once Uber discovered this, they requested he stop.
According to the former senior employee, the Sydney developer of the spyware had moved from Sydney to Singapore at the time when Uber and Grab were fighting it out for dominance of the massive rideshare market in South-East Asia.
They "requested" that he stop? Why didn't Uber fire him?
Instead, it looks like they sent him to Singapore to help grow Uber's market share there, using the same dirty tactics.
I bet if any of the programmers suggested encrypting all the data sent to and from the app, the managers would claim it would take too long, cost too much money and if they did approve it go for a cheap and fast to develop in-house program that would be easy to break.
How convenient that it was a rogue employee that implemented this. First of all it should be two employees if they're code reviewing properly. Secondly the code review should have raised questions about what was going into the source. What they'll do here is find a relatively poor performing employee and pin this on them to deflect attention away from the company. They were going to fire them anyway so this is a win-win and Uber doesn't have to admit guilt.
It's also more than a little suspicious that Uber responded by "requesting he stop". Planting malware is a breach of ethics on the shallow end, and its' outright criminal hacking at the deep end. I would have expected any such actions to receive a swift dismissal or Uber would be complicit in illegal behavior. Also, how the heck did just one person manage to do all of this? This person likely isn't a hiring manager so they'd at least have to be working with a manager and someone in HR. Let's say he was fielding all the recommendations himself...I think HR would be a little suspicious that one person is making hundreds of recommendations.
This explanation doesn't seem remotely plausible.
That's a first mover advantage, as they would describe it for impression management purposes
I am positive lyft would behave the same way if they could
Shut the fuck up, you ignorant, mouth-breathing Trumptard.
typical capitalism... if the project had worked and nobody figured it out, that employee would've been promoted.
Feel the Bern, deplorable!
I would guess for safety and usability. If everyone can see where your taxi is, it's harder for a driver to kidnap you.
You can have that without giving away the whole store. How can you claim a system is designed to be "Safe" when it somehow reveals personal details enough about a driver for Uber to find them and try to hire them? What is to stop a stalker from finding female drivers and doing whatever they like to them...
I am jus saying the company had a responsibility to the drivers that it sounds like they shirked, if Uber had enough data to find drivers that a very bad sign for how well the company protected data. Who is to say they were not equally lax in protecting client data too...
How is everyone OK with this? We must wake up and punish companies anywhere that leak personal data, for either employees or customers. It is way past time we stopped letting this kind of no-security bullshit slide, even (especially?) if the information is used against that company.
Seriously, how can you support the lax security policies of this company as being OK?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Uber did the same thing in the US too Lyft and got away with it. God mode, anyone?
Lyft culture abhors these practices, so I fundamentally disagree with your assertion.
So if I'm reading this correctly, Uber offered work to GoCatch drivers, drivers they identified using information published by GoCatch themselves. The fact that GoCatch didn't intend to be used that way doesn't make the tool "spyware" or otherwise nefarious. And the fact that it worked implied that Uber offered the drivers a good deal.
No. That would take forever and your call history would wind up full of those stupid disposable temporary numbers.
For both Uber and Lyft, do this:
If you are a passenger, open the door or look through the window and say "What's your name?"
Your driver's name is right there on the app. With their picture. And I know the picture's not always great, but it's good enough to verify you have the right driver. And they will say their name.
Drivers should do the same thing, although almost none of mine ever do. "What's the name on the account?"
Allowing an incorrect passenger in your car is a surefire way to get cheated, and maybe robbed/raped/kidnapped/murdered as well.
For both passengers and drivers, do not ask them to confirm their name: "Are you So-and-so?" Make them provide it: "What's your name/name on the account?"
It's too easy for an opportunistic scammer to just go "Yep, that's me."
If they take the safely driver to an criminal trial then all kinds of dirt can come out in it.
https://www.azcentral.com/stor...
It's popcorn-worthy to watch the usual "IF YOU WERE DUMB ENOUGH TO PUBLISH THE BITS, I CAN FREELY USE THOSE BITS HOWEVER I WANT" crowd get all up in arms about a corporation they don't like doing some competitive data scraping.
Mod me down all you want -- it will remain hilarious.
If Uber used information that was freely available on their app/website to poach drivers etc. that's not illegal. Unethical perhaps but not illegal.
It's a different matter if GoCatch want to sue Uber for damage done to their business.
Kendall is security-retarded on every level. You have to be the dumbest apologist troll on slashdot - and that's truly saying something.
Translation: GoCatch didn't use business-class encryption.
The spyware could use a OS-level MitM attack, duplicating the data before it was sent to GoCatch. But it is unlikely that a majority of drivers (with iOS or Android) would download the same malware, making this vector, unfeasible.
The obvious answer is a single point of entry, where GoCatch servers were cracked (not 'hacked') and data duplicated "in real time".
Nothing new here except the method to do it with.
The ride share industry is sketchy at best, saves the rider money but the unregulated part of it is problematic.
Odd coincidence how things like this just seem to keep happening to Uber. Darn shame that there are so many rogues in their organization; you'd think the world's largest monitoring and tracking system could identify and root out that sort of stuff.
But why don't the drivers keep both applications installed on their smartphones?
In several countries (FR, CH), I've seen drivers using several parralel means to catch clients: Uber Driver, some other network popular locally, and even an actual *taxi* dispatcher.
local law about competition should prevent Uber from offering a different pay depending on if a driver works for another dispatcher or is exclusive to Uber.
(And remember, Uber strongly wants to believe that the drivers are *contractros*, not *employee* - the drivers should legally be allowed to work with whom ever they want)
and local security features of android should be able to block the Uber Driver app trying to crash other apps / block phonecalls from taxi dispatcher. (On would be considered unacceptable practice if they somewhat managed anyway).
Aussie drivers could be install both Uber's and GoCatch (And whatever else is popular downunder) and serve rides as requests come.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This is what happens when you combine capitalism, a lack of ethics, and technology. The end result is companies like Uber and Facebook. Unfortunately, the reality of modern times is that we value ethical companies as much as we value ethical leaders (in other words, we don't give a shit).
"The cause of fear is ignorance."
So...the great Firewall of China?
Or did you mean the NSA?