Uber Database Breach Exposed Information of 50,000 Drivers, Company Confirms

Re:Uber Database Breach Exposed Information of 50,000 Driver... by martin_ on Friday February 27, 2015 @08:04PM (#9122339)

I find it unlikely they have a database explicitly for driver names/license plates. Unless it was some flat-file dump compromised. I'm curious how much data was really obtained. If only 50k were truly stolen, it could be a shard too. The lack of technical details is sketchy to me

[ Parent | on HN ]

Re:Uber Database Breach Exposed Information of 50,000 Driver... by froseph on Friday February 27, 2015 @11:40PM (#9122815)

I also find it unlikely it's just the name and license number. They used to return all of a driver's information (name, phone, address, drivers license, license plate, etc) from the rest endpoint they were using on their website. They closed that hole it after it we disclosed it to them.

[ Parent | on HN ]

Re:Uber Database Breach Exposed Information of 50,000 Driver... by imnewhere on Friday February 27, 2015 @11:34PM (#9122799)

Why wouldn't they? I imagine there's some driver signup form that saves to some database table on their site.

[ Parent | on HN ]

Re:Uber Database Breach Exposed Information of 50,000 Driver... by MBlume on Friday February 27, 2015 @08:15PM (#9122362)

Maybe they have query logging turned on and saw what queries the attacker ran?

[ Parent | on HN ]

Re:Uber Database Breach Exposed Information of 50,000 Driver... by martin_ on Friday February 27, 2015 @09:23PM (#9122531)

Definitely plausible, and I hope so --- but there's no clarification of that or technical insight.

[ Parent | on HN ]