AIRLINK 62.48 Increased By ▲ 2.05 (3.39%)
BOP 5.36 Increased By ▲ 0.01 (0.19%)
CNERGY 4.58 Decreased By ▼ -0.02 (-0.43%)
DFML 15.50 Increased By ▲ 0.66 (4.45%)
DGKC 66.40 Increased By ▲ 1.60 (2.47%)
FCCL 17.59 Increased By ▲ 0.73 (4.33%)
FFBL 27.70 Increased By ▲ 2.95 (11.92%)
FFL 9.27 Increased By ▲ 0.21 (2.32%)
GGL 10.06 Increased By ▲ 0.10 (1%)
HBL 105.70 Increased By ▲ 1.49 (1.43%)
HUBC 122.30 Increased By ▲ 4.78 (4.07%)
HUMNL 6.60 Increased By ▲ 0.06 (0.92%)
KEL 4.50 Decreased By ▼ -0.05 (-1.1%)
KOSM 4.48 Decreased By ▼ -0.09 (-1.97%)
MLCF 36.20 Increased By ▲ 0.79 (2.23%)
OGDC 122.92 Increased By ▲ 0.53 (0.43%)
PAEL 23.00 Increased By ▲ 1.09 (4.97%)
PIAA 29.34 Increased By ▲ 2.05 (7.51%)
PIBTL 5.80 Decreased By ▼ -0.14 (-2.36%)
PPL 107.50 Increased By ▲ 0.13 (0.12%)
PRL 27.25 Increased By ▲ 0.74 (2.79%)
PTC 18.07 Increased By ▲ 1.97 (12.24%)
SEARL 53.00 Decreased By ▼ -0.63 (-1.17%)
SNGP 63.21 Increased By ▲ 2.01 (3.28%)
SSGC 10.80 Increased By ▲ 0.05 (0.47%)
TELE 9.20 Increased By ▲ 0.71 (8.36%)
TPLP 11.44 Increased By ▲ 0.86 (8.13%)
TRG 70.86 Increased By ▲ 0.95 (1.36%)
UNITY 23.62 Increased By ▲ 0.11 (0.47%)
WTL 1.28 No Change ▼ 0.00 (0%)
BR100 6,944 Increased By 65.8 (0.96%)
BR30 22,827 Increased By 258.6 (1.15%)
KSE100 67,142 Increased By 594.3 (0.89%)
KSE30 22,090 Increased By 175.1 (0.8%)
Technology

U.S. charges former Uber security chief with covering up massive 2016 hacking

  • The case was believed to be first time a corporate information security officer has been charged with concealing a hack.
Published August 21, 2020

WASHINGTON: In an unprecedented case, a former chief security officer for Uber Technologies was criminally charged on Thursday with trying to cover up a 2016 hacking that exposed personal information of about 57 million of the ride-hailing company’s customers and drivers.

The U.S. Department of Justice charged Joseph Sullivan, 52, with felony obstruction of justice, saying he took “deliberate steps” to keep the Federal Trade Commission from learning about the hack while the agency was monitoring Uber security in the wake of an earlier breach.

The case was believed to be first time a corporate information security officer has been charged with concealing a hack.

Sullivan, himself a former federal prosecutor, arranged to pay the hackers $100,000 under Uber’s program for rewarding security researchers who report flaws. That amount was by far the most Uber had paid through the bounty program, which was not meant to cover theft of sensitive data.

A former chief of security at Facebook, Sullivan now works as chief information security officer at Cloudflare.

In past interviews, security staff said the Uber payout was intended to force the hackers into the open to accept the money and to ensure that the data, especially driver’s license information on Uber contractors, was destroyed.

The complaint says Sullivan had the hackers sign non-disclosure agreements that falsely stated they had not stolen data. It alleges that then-CEO Travis Kalanick was aware of Sullivan’s actions.

A spokeswoman for Kalanick declined to comment. A spokesman for Sullivan said that the charges had no merit, that Sullivan had worked with his colleagues on the case and that disclosure matters were decided by the legal department.

“If not for Mr. Sullivan’s and his team’s efforts, it’s likely that the individuals responsible for this incident never would have been identified at all,” said spokesman Brad Williams.

Kalanick’s successor as CEO — current Uber chief Dara Khosrowshahi — disclosed the payoff, then fired Sullivan and a deputy after learning the extent of the breach. Uber then paid $148 million to settle claims by all 50 U.S. states and Washington, D.C. that it had been to slow to reveal the hack.

The Uber case will resonate for the increasing number of companies that deal directly with hackers.

Many have bounty programs like Uber’s, which are generally seen as a tool to improve security and provide an incentive for hackers to stay within the law. But some participants do not play by the rules.

In the Uber case, the FBI noted, the two main hackers went on to attack other companies, which the agency said could have been averted if Sullivan had gone first to law enforcement. Both have pleaded guilty and are awaiting sentencing.

The case also suggests that companies that pay hackers to get rid of ransomware, malicious programs that encrypt their files, are not exempt from requirements to report losses of personally sensitive information.

Comments

Comments are closed.