Hacker News Reader

Comment by adrr | Hacker News Reader

I really don't understand how this is a crime. Bug bounty is basically hiring consultants to find bugs. They found a bug that allowed consultant to download all the data. Uber paid the consultant the designated bounty. It is a done deal.

Implications that this is an actual breach are large. Does that mean if I hire a red team of independent consultants and they managed to gain access to one of my backups, i have to report it as a breach? Thats the worst case scenario.

The best case scenario is all companies have to pull bug bounty programs because any bug found is now considered a breach. This actually very bad for the industry. Bug bounties are very effective part of a comprehensive strategy to safe guard customer data.

View on HN

> During this time, two hackers contacted Sullivan by email and demanded a six-figure payment in exchange for silence. [...] The criminal complaint alleges that Sullivan took deliberate steps to conceal, deflect, and mislead the Federal Trade Commission about the breach.

https://www.justice.gov/usao-ndca/pr/former-chief-security-o...

Doesn't seem like a bug bounty when you're being demanded to pay something, and when you're later asked about it you conceal, deflect and mislead about it.

In a bug bounty program, you agree to the terms before participating and in particular those terms include not exfiltrating data.

These hackers were not participants in the bugbounty program, and extorted money from Uber. They were not in anyway "consultants", even retroactively.

But that's not the issue at hand here, the issue at hand is the cover-up while Uber was being investigated about a similar breach.

It is also curious that HackerOne was the middleman here. I do wonder how much they knew of what was going on.

I can see it - a trusted 'intermediary' who has trust and expertise to both clients.

Yes and no. The indictment explicitly mentions the hackers got paid through HackerOne but didn't have a HackerOne account. HackerOne manually sending a payout so large manually via Bitcoin no less is strange to say the least.

https://www.hackerone.com/resources/reporting/the-2020-hacke... says they paid out $40mil in 2019 and undoubtedly would have been much smaller in 2016. This would have been a whale for them and their cut.

>those terms include not exfiltrating data

Is there a way to determine that your credentials are sufficient to download an S3 object without actually downloading it?

How would you know whether you'd found an information disclosure vulnerability without peeking at the information?

Bounty programs explicitly tell you to only to target accounts that belong to you.

Outside of that, if you're "peeking" at information that doesn't belong to you, you immediately stop, document, and submit the report. You do not download 14,000 files as the Uber hackers did.

This is a non-trivial amount of nuance that clearly shows the hackers were not acting in good faith.

It wasn't a bug bounty submission. He used the bug bounty program as a slush fund to pay off criminals so they wouldn't disclose that Uber customers personal data had been stolen.

Exactly. The 'it was a bug bounty' defense is completely laughable. If anything, allowing these types of hush money payments would be more dangerous to the concept of bug bounty programs because the public would lose faith they would be adequately notified of data breaches.

Plus, I think the messaging between Sullivan and Kalanick more than proves mens rea. It's possible Sullivan does have a "it was someone else's decision" argument, but not that everybody at Uber thought that what they were doing was above board.

There is no mens rea or actual harm involved in legit white hat hacking, including white hat hacking that is incentivized through bug bounties, so this activity is not criminal.

We don't know all of the specifics here, but for the feds to go after it one must assume that there was mens rea for the underlying offense (i.e., the hackers were in fact black hat) and there was actual harm (i.e., the hackers kept the stolen data and either intended to or did in fact use it for criminal purposes).

And in order to go after charges of obstruction and misprision, the DoJ must also believe that Sullivan was clearly aware that this behavior was criminal, and he intentionally sought to cover it up. This isn't much of a stretch because the FTC was probing it, so there was ample opportunity for him to respond incorrectly (and, allegedly, criminally) to FTC's questions during their probe.

In practice the line between bug bounties and extortion can often be a bit blurry, as well as the line between proving an exploit exists and actually exploiting it.

I think you’d need a lot more information to draw a reasonable conclusion. That said the prosecutors arguments that $100,000 is so much that it implies criminality, and that NDAs are non-standard (or that they also imply criminality) is complete and utter BS, and instantly makes me incredibly skeptical of the theories they’re operating on.

The same two people that carried out the Uber hack also hit Lynda.com while after using basically the exact same methodology. So, it would seem possible that they had credible evidence of a felony with intent to commit future ones.

The stuff you mentioned isn't really what's "criminal" here.

IMO, the "real" crime stems from his actions to hide / cover up the hack and payoffs and -- probably more importantly -- explicitly and outright lying to the federal government.

They really don't like that at all.

---

It's possible that this is also, at least in part, an attempt to go after others at Uber (if they have reason to believe there was other criminal behavior taking place).

From another reply here: U.S. Code § 1505 mandates that you do not obstruct procedures of departments, agencies, and committees of the US government. In this case, if you've just testified before the FTC on your data protection practices and a past data breach you do not keep quiet on a current breach but Give Them A Call.

I cannot imagine how doing business in the US is like given that I feel there are many more laws they can throw at you than where I live, but I know that in my firm have we many meetings on all kinds of levels with supervisors that are frankly quite open. You need good relationships with supervisors and good relationships build on openness. If we were ever to have a serious data breach the first call would be an impact assessment and notification under GDPR, the second call nearly at the same moment would be reaching out to our other (mostly financial) supervisors.

Reply on news.ycombinator.com