News for hackers. Stuff that matters.

A comment on Uber Paid Hackers to Delete Stolen Data on 57M People. Parent comment

Re:Uber Paid Hackers to Delete Stolen Data on 57M People by ghostbrainalpha on Wednesday November 22, 2017 @12:13PM (#15758441)
If they have access to the code inside Github, would they have been able to push their own changes to the code without anyone noticing?

Maybe pushing something that was labeled as a "security patch" but was actually a disguised vulnerability? I could see not even checking into that, and just downloading it. But I'm on a small team. Do big companies have procedures to protect against this?

[ Parent | on HN ]
Re:Uber Paid Hackers to Delete Stolen Data on 57M People by diggan on Thursday November 23, 2017 @07:18AM (#15764540)
Depends on how they get access. If they got control of one of the user accounts with push access, they could surely push code (but unsure about "without anyone noticing", depends on their own development processes I guess). However, if they got access to the code by reading some part of the memory/storage holding the code, without actually gaining access through authentication, they wouldn't be able to change it.
[ Parent | on HN ]