Inside Uber’s $100,000 Cost to a Hacker, and the Fallout


Most of all, the hacking and Uber’s response have fueled a debate about whether or not corporations which have crusaded to lock up their methods can scrupulously work with hackers with out placing themselves on the mistaken aspect of the legislation.


A hacker knowledgeable Uber of a serious vulnerability in November 2016. The corporate disclosed the breach a 12 months later. Credit score Dave Sanders for The New York Instances

Uber is illustrative of a breed of firm that aimed to bulletproof its safety. Whereas many firms had been for years blissfully unaware of the dangerous actors penetrating their methods, Uber and others recruited former legislation enforcement and intelligence analysts and put in layers of technical defenses and password safety. They joined different corporations in embracing the identical hackers they as soon as handled as criminals, shelling out bug bounties as high as $200,000 to report flaws.

But for the reason that fallout from Uber’s disclosure, Silicon Valley corporations have taken a tougher take a look at their bounty applications. Not less than three have put their applications underneath overview, in line with two consultants who’ve confidential relationships with these corporations, which they declined to call. Others mentioned prison prosecutions for not reporting John Doughs would deter moral hackers who would in any other case come ahead.

“Something that causes organizations to take a step backwards and never welcome contributions from the safety group can have a detrimental affect on all of us,” mentioned Alex Rice, a co-founder of HackerOne, a safety firm that works with clients, together with Uber, to handle interactions with and funds to hackers.

The state of affairs is sophisticated by Uber’s monitor report for pushing boundaries, which put it underneath scrutiny final 12 months and helped spur the resignation of Travis Kalanick, its longtime chief govt, in June. Mr. Khosrowshahi has since vowed to alter the way in which the corporate conducts itself.

This account of Uber’s hacking and the corporate’s response was based mostly on greater than a dozen interviews with individuals who had been concerned within the state of affairs, a lot of whom declined to be recognized due to the confidentiality of their exchanges. Many are present or former members of Uber’s safety workforce, who defended their actions as a main instance of how executives ought to reply to safety issues of their methods. The New York Instances additionally obtained greater than two dozen inside Uber emails and paperwork associated to the incident.

In an announcement, Mr. Sullivan disputed the notion that the 2016 episode was a breach and mentioned Uber had handled it as a licensed vulnerability disclosure.


Dara Khosrowshahi, middle, Uber’s chief govt since final summer time, has vowed to alter the way in which the ride-hailing firm conducts itself. Credit score Adriano Machado/Reuters

“I used to be shocked and disillusioned when those that needed to painting Uber in a detrimental gentle shortly prompt this was a cover-up,” he mentioned, including that he was proud its engineers had been capable of repair the problem earlier than it might be abused. He declined to debate disclosure due to the lively state investigations.

Matt Kallman, an Uber spokesman, mentioned, “We stand by our determination to very publicly disclose the 2016 information breach — not as a result of it was straightforward, however as a result of it was the precise factor to do.”

By means of a spokesman, Mr. Kalanick declined to remark.

Uber began its bounty program in March 2016, difficult hackers to seek out bugs that would particularly result in the publicity of delicate person information. The upper threat the bug was, the extra Uber would pay. In Uber’s calculus, the payouts had been higher than studying a few vulnerability solely after attackers had abused it.

By the point Mr. Sullivan obtained John Doughs’s electronic mail, Uber had paid rewards to tons of of hackers. Mr. Sullivan forwarded the John Doughs notice to his workforce for vetting and, if all checked out, patching and fee.

Uber’s safety workforce used monikers for hackers, significantly the colourful, nameless ones who engaged with the corporate. John Doughs was referred to as “Preacher” for his admonitions that Uber must be higher at safety.

“It’s very disappointing to be discovering this vulnerability in such method,” the hacker wrote in an electronic mail to Rob Fletcher, Uber’s product safety engineering supervisor. “Particularly coming from an organization like Uber.”

From the Emails

Different emails obtained by The Instances present Mr. Fletcher handled the incident as a bounty and inspired Preacher to offer proof of the vulnerability, together with sending a number of traces of knowledge from the database he had breached.

Based on the emails obtained by The Instances, Uber quickly found that a few of its staff had left keys on a programming web site referred to as Github. These keys had allowed Preacher to achieve entry to Uber’s Amazon net servers, the place it saved supply code in addition to 57 million buyer and driver accounts, together with driver’s license numbers for some 600,000 Uber drivers. It was a serious oversight. To repair it, Uber needed to inform everybody on the firm that it was briefly shutting down entry to Github.

In the meantime, emails between the hacker and Mr. Fletcher continued. In some, Mr. Fletcher thanked the hacker for serving to the corporate repair the oversight. In two emails, Preacher’s motivations appeared much less altruistic. In a single, he demanded “excessive compensation” for his findings. After Mr. Fletcher wrote that the corporate’s most bounty was $10,000, Preacher mentioned he and his workforce would solely settle for “six digits.”

Mr. Fletcher mentioned he would wish to hunt authorization for a $100,000 fee, and would wish Preacher’s reassurances that he would delete the information he had downloaded. Mr. Fletcher additionally pushed the hacker to take fee by means of HackerOne, which requires bounty recipients to reveal their actual identities for tax necessities.

Mr. Fletcher drew additional particulars in regards to the hacker out by means of emails, together with tidbits about his identification, his web internet hosting supplier, the situation of his pc and proof that he deleted his copy of Uber’s downloaded information by a digital copy of his system offered by his host.

“I’d prefer to thanks and your workforce in your excellence in coping with this difficulty,” Preacher wrote in a single electronic mail.


Uber invited the hacker, whom it referred to as Preacher, to go to its headquarters in San Francisco. He declined. Credit score Ryan Younger for The New York Instances

Based on the emails, Uber at one level prolonged Preacher an all-expenses paid journey to San Francisco, the place the corporate relies. Uber requested the hacker to debate his safety methods and supplied to introduce him to corporations that could be desirous about his expertise. Preacher declined.

Preacher’s path of digital bread crumbs ultimately led to a 20-year-old whose first title was Brandon and who was residing in a Florida trailer park along with his household, in line with the emails. In a single electronic mail, Uber supplied to ship somebody to satisfy Brandon at a neighborhood espresso store. Brandon declined to depart his residence and prompt that the worker meet him there. It was there that Brandon signed agreements assuring Uber that he had deleted the information he had downloaded.

The Instances was unable to study Brandon’s full title. An electronic mail to the John Doughs account bounced again.

By then, Uber’s safety workforce was celebrating its response to what may have been a serious safety breach. Mr. Sullivan and his colleagues had been praised in year-end efficiency opinions, together with by Mr. Kalanick, in line with present and former staff.

What’s now at difficulty is whether or not Uber executives broke the legislation with the $100,000 fee and will have shortly notified clients or officers of the invention. The problem is just not legally clear lower.

Legal guidelines regarding bug bounties — significantly those who let hackers view or save delicate buyer information — are ambiguous. The Justice Division weighed into bug disclosure applications for the primary time in July and largely left it to organizations to determine what entry they’ll authorize for hackers and what they’ll do with the information. In Uber’s case, its bounty tips licensed and inspired hackers to search for vulnerabilities that uncovered its most delicate person information.

Breach disclosure legal guidelines additionally differ state to state. The state legal guidelines most related to Uber’s case require disclosure if names are uncovered together with driver’s license numbers in a “breach of safety.”

Brandon acquired two funds of $50,000 every from Uber on Dec. eight, 2016, in line with the emails. Uber continued buying and selling emails with Brandon throughout 2017, till the dialog ultimately dwindled.

The matter appeared settled — till Mr. Sullivan acquired a cellphone name whereas getting ready Thanksgiving dinner, in line with two folks conversant in the matter. He was being fired, efficient instantly, for failing to reveal the incident to the right authorities on the time.

Continue reading the main story


Please enter your comment!
Please enter your name here