Uber's in a position where they get flak for breaking the rules while also being painfully aware that following the rules is worse for them. They face opposition, but every time they play nice it doesn't go well for them.

The lesson here is that sometimes, you do much better by breaking all the rules.

I don't know what happened here, but presumably they keep fairly detailed request logs. If they were notified of a security vulnerability like this, they would probably sweep logs for suspicious requests. This way they would become aware of all breaches using that vulnerability, but not until they found the vulnerability, which could be any amount of time after the breaches occurred.

Yeah, I definitely would not do that to a 3rd party system without a specific letter of engagement for penetration test or security review. Now, that being said, it's the first thing I would tell every single developer about as a senior developer and I would insist that test cases be written to verify that no such 'feature' was permitted into the application.

Because it's just the UI, you can't actually use it without an admin account. It's really not an issue at all.

How do you know that he got 8 points?

It's soft language, but I don't think they can stretch it to mean "anything." 5 months is just way too long.

Withholding knowledge of a breach is self-rewarding which is why there needs to be a law stating the time frame for disclosure, and either penalties or liablity (per affected customer, employee, contractor, vendor). Lack of skill in detection is a problem, but I don't know whether Congress is well equipped to legislate that, and also companies aren't exactly incentivized to just let themselves get completely owned. They're just ignorant. There's no question this behavior is changing, even if we're dissatisfied with how slow it's happening.

I mean, the average Congresscritter probably has no idea what the typical answer is to "how do you do a password reset?" other than "call daughter/son". They're not good at establishing competency. They are sorta half way decent at bringing out the hammer "disclose what you know within X days, or we're going to fine you... when we do find out when you knew it."

So that brings up the question how the legislation determines whether and exactly when the company knew they were breached. And I'd say they should learn from history which is not to be such dicks like they were with hackers in the 80's and 90's and instantly criminalize disproportionately. We were learning things as a result of all of that, and by repressing it, we learned a lot less. So with companies I'd say up front the disclosure needs to be civil in nature (fines), and if there's willful hiding of what they know, tampering of evidence, destruction of evidence in an attempt to claim they didn't know they were breached or how badly, then it becomes criminal and lay down the hammer. Ultimately though, the worst punishment is up to the states, since the corporate charter is granted by states, not the feds. Off hand I can't think of a case where a corporation was executed in this manner though (revoking it's charter or articles of incorporation).

Companies are asking Congress to do this because already states are doing it, and it's totally haphazard. If Congresscritters were to get doxxed maybe it'd go faster.

Meanwhile, Australia is about to legislate mandatory data retention :( https://stopthespies.org/