Cloud

4/27/2018
02:02 PM
50%
50%

'Don't Extort Us': Uber Clarifies its Bug Bounty Policy

Updated parameters should help avoid future extortion incidents.

Uber this week outlined more specific guidlelines for its bug bounty program in the wake of its 2016 data breach that demonstrated gaping holes in its vulnerability disclosure policy.

The ride-sharing company last fall revealed that it had paid two hackers $100,000 to destroy driver and rider data they had stolen from a cloud storage location, and that it had failed to disclose the breach for a year. Since then, the company has been working on retooling its bug bounty program to encourage proper disclosure.

The new policy states, in part: "Don't extort us. You should never illegally or in bad faith leverage the existence of a vulnerability or access to sensitive or confidential information, such as making extortionate demands or ransom requests or trying to shake us down. In other words, if you find a vulnerability, report it to us with no conditions attached."

Read more here.

 

 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
homekitchenary
50%
50%
homekitchenary,
User Rank: Apprentice
5/2/2018 | 11:11:09 PM
Don't Export Us
It is healthy for the <a href="https://homekitchenary.com/">business</a> to strive. It will Help uber for the long run.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2018 | 9:01:35 PM
Re: Don't extort us
@jeremy. This also struck me as quite odd.
jconerly
50%
50%
jconerly,
User Rank: Apprentice
4/30/2018 | 2:28:17 PM
Re: Don't extort us
I think it is more about making it easier to ethically go after malicous actors using the bounty program as their method to ask for a ransom.  Publicly viewable hall of fame entries will be more valueable to whitehats since it can be used as a line on a resume and blackhats don't care because the value of security bugs from selling/using/ransoming it will almost always be higher than a bounty anyway.
jeremy_wittkop
50%
50%
jeremy_wittkop,
User Rank: Author
4/30/2018 | 11:45:00 AM
Re: Don't extort us
Agreed. A bounty program insinuates there is compensation for privately disclosed vulnerabilities. I would argue that the bounty program is designed to attract white hats. If someone is extorting you, they're not participating in the bounty program, they are simply black hats who exploited your vulnerabilities. I'm a little confused about why a bounty program would have to clarify that it is not encouraging people to commit a crime.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:10:30 PM
Re: Paid two hackers $100,000
There are no guarantees and thats why it is bad practice to pay the ransom. I agree. The act of hacking in itself is not trustworthy, so never pay them, that would only make things worse.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:08:46 PM
Re: Paid two hackers $100,000
No matter what, you should disclose and follow the correct security protocols. I agree, and never pay hackers and trust them, that is not what they are about.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:07:11 PM
Re: Don't extort us
Don't Extort Us It may kot apeal most people, it say Do not a smart person would know that would result in an anti-reflection.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:04:49 PM
Re: Don't extort us
Is there compensation for their bug bounty program? Most offer incentive to help ensure that their exposures are not publicly disclosed. I agree, I was just mentioning this in the other post.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:03:41 PM
bug bounty program
The bug bounty program works best when there is a compansation, nobody would care otherwise.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/28/2018 | 7:51:06 PM
Paid two hackers $100,000
Many of the employees at the executive level paid dearly for this debacle. No matter what, you should disclose and follow the correct security protocols. Even if you take a hit towards brand reputation inititially, you will typically see that impact as much more detrimental if it is found that you tried to sweep it under the rug...

Also, who in their right mind trusts malcious actors to do the right thing? There are no guarantees and thats why it is bad practice to pay the ransom.
Page 1 / 2   >   >>
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17182
PUBLISHED: 2018-09-19
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations...
CVE-2018-17144
PUBLISHED: 2018-09-19
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...