Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

4/27/2018
02:02 PM
50%
50%

'Don't Extort Us': Uber Clarifies its Bug Bounty Policy

Updated parameters should help avoid future extortion incidents.

Uber this week outlined more specific guidlelines for its bug bounty program in the wake of its 2016 data breach that demonstrated gaping holes in its vulnerability disclosure policy.

The ride-sharing company last fall revealed that it had paid two hackers $100,000 to destroy driver and rider data they had stolen from a cloud storage location, and that it had failed to disclose the breach for a year. Since then, the company has been working on retooling its bug bounty program to encourage proper disclosure.

The new policy states, in part: "Don't extort us. You should never illegally or in bad faith leverage the existence of a vulnerability or access to sensitive or confidential information, such as making extortionate demands or ransom requests or trying to shake us down. In other words, if you find a vulnerability, report it to us with no conditions attached."

Read more here.

 

 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
homekitchenary
50%
50%
homekitchenary,
User Rank: Apprentice
5/2/2018 | 11:11:09 PM
Don't Export Us
It is healthy for the <a href="https://homekitchenary.com/">business</a> to strive. It will Help uber for the long run.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2018 | 9:01:35 PM
Re: Don't extort us
@jeremy. This also struck me as quite odd.
jconerly
50%
50%
jconerly,
User Rank: Apprentice
4/30/2018 | 2:28:17 PM
Re: Don't extort us
I think it is more about making it easier to ethically go after malicous actors using the bounty program as their method to ask for a ransom.  Publicly viewable hall of fame entries will be more valueable to whitehats since it can be used as a line on a resume and blackhats don't care because the value of security bugs from selling/using/ransoming it will almost always be higher than a bounty anyway.
jeremy_wittkop
50%
50%
jeremy_wittkop,
User Rank: Author
4/30/2018 | 11:45:00 AM
Re: Don't extort us
Agreed. A bounty program insinuates there is compensation for privately disclosed vulnerabilities. I would argue that the bounty program is designed to attract white hats. If someone is extorting you, they're not participating in the bounty program, they are simply black hats who exploited your vulnerabilities. I'm a little confused about why a bounty program would have to clarify that it is not encouraging people to commit a crime.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:10:30 PM
Re: Paid two hackers $100,000
There are no guarantees and thats why it is bad practice to pay the ransom. I agree. The act of hacking in itself is not trustworthy, so never pay them, that would only make things worse.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:08:46 PM
Re: Paid two hackers $100,000
No matter what, you should disclose and follow the correct security protocols. I agree, and never pay hackers and trust them, that is not what they are about.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:07:11 PM
Re: Don't extort us
Don't Extort Us It may kot apeal most people, it say Do not a smart person would know that would result in an anti-reflection.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:04:49 PM
Re: Don't extort us
Is there compensation for their bug bounty program? Most offer incentive to help ensure that their exposures are not publicly disclosed. I agree, I was just mentioning this in the other post.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:03:41 PM
bug bounty program
The bug bounty program works best when there is a compansation, nobody would care otherwise.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/28/2018 | 7:51:06 PM
Paid two hackers $100,000
Many of the employees at the executive level paid dearly for this debacle. No matter what, you should disclose and follow the correct security protocols. Even if you take a hit towards brand reputation inititially, you will typically see that impact as much more detrimental if it is found that you tried to sweep it under the rug...

Also, who in their right mind trusts malcious actors to do the right thing? There are no guarantees and thats why it is bad practice to pay the ransom.
Page 1 / 2   >   >>
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28973
PUBLISHED: 2021-04-21
The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to reconfig...
CVE-2021-29456
PUBLISHED: 2021-04-21
Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any...
CVE-2021-31523
PUBLISHED: 2021-04-21
The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges because this is arguably incompatible with the design of the Mesa 3D Graphics library dependency.
CVE-2020-23907
PUBLISHED: 2021-04-21
An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution.
CVE-2020-23912
PUBLISHED: 2021-04-21
An issue was discovered in Bento4 through v1.6.0-637. A NULL pointer dereference exists in the function AP4_StszAtom::GetSampleSize() located in Ap4StszAtom.cpp. It allows an attacker to cause Denial of Service.