Uber’s business model is based on a simple notion: Why employ drivers full time when you can hire them more efficiently as freelancers? It’s no surprise, then, that the company’s come to the same conclusion on cybersecurity, recruiting an army of gig-economy hackers who are paid by the exploit instead of by the hour.

On Tuesday, Uber announced that it’s officially launching a “bug bounty” program that will pay independent security researchers thousands of dollars in rewards for finding hackable bugs in its apps and websites. That makes the ride-sharing firm the latest tech giant to adopt the strategy of crowdsourcing the auditing of its code to shore it up against less benevolent hackers. Finding a bug that could deface Uber’s homepage or expose users’ email addresses earns $5,000, for instance, while one that could fully take over Uber accounts or run malicious code on an Uber production server can earn as much as $10,000.

But Uber, which is launching its program with the help of the bug-bounty-focused firm HackerOne, has gone a step further than older programs run by Google, Facebook and Microsoft: It’s trying out a bug bounty “loyalty system” that gives hackers bonuses for repeated bug discoveries in Uber’s platform. It’s also promised to release a “treasure map” for bug bounty hunters designed to guide them toward potential vulnerabilities in the site—mapping out the company’s code to make bug hunting as efficient as possible.

The idea, says Uber head of product security Collin Greene, is to incentivize security researchers to “go deep” in Uber’s code, instead of flitting between different companies’ bug bounty programs searching for low-hanging fruit. And the “treasure map” is designed to share with external hackers the same systems architecture information that internal staff have access to, a move that can save bug hunters weeks of recon time and help them start uncovering serious vulnerabilities in the company’s code. “We’re saying ‘here are the different portions of the website, the mobile apps and how they work, and the technologies underneath them. If I were a security researcher, here’s where I’d look,’” says Greene. “By giving them a treasure map of the structure of our system, they can spend their time instead looking for really subtle bugs.”

All of that might sound like a particularly aggressive invitation for hackers, and one that could backfire. But Uber argues that it’s not revealing anything in its treasure map that isn’t already public. And given that information is already discoverable by serious hackers incentivized by criminal profits, better to offer it to those seeking to inform the company of its vulnerabilities, too. “It’s in our best interest to make sure that the right people with the right intentions—security researchers who are going to look at our code and report bugs directly to Uber—have the information in an easy to understand way,” Greene says. “We believe a more transparent program will be a more successful [one].”

Uber’s bug bounty program isn’t as new as it sounds. It’s already paid hackers more than a hundred bug bounties in a private beta version of the program that it’s quietly run for a year. And it’s been on a security hiring spree that includes experienced bug bounty managers: Both Greene and Uber chief security officer Joe Sullivan were hired from Facebook, where Greene formerly oversaw a bug bounty program that’s paid out millions of dollars. In fact, Uber’s new features show just how far the culture of bug bounties has evolved: Major tech firms are now competing for independent hackers’ attention—and not just with money, but in Uber’s case, by making the process of bug discovery more efficient. “We want to make this a bug bounty program that researchers adore,” says Greene.

One step Uber has yet to take, however, is to extend its bounties to its actual cars. For now, the program only applies to bugs found in its websites and apps for riders and drivers. That’s a predictable limitation, of course, given that Uber doesn’t actually own drivers’ vehicles. But Uber got a taste of automotive cybersecurity flaws over the summer when a group of researchers at the University of California at San Diego found a vulnerability in a certain Internet-connected insurance dongle offered to Uber drivers; the dongle’s Internet connection allowed the researchers to access vehicles’ internal CAN networks, turning on windshield wipers or cutting their brakes.

Other companies are beginning to experiment with automotive bug bounties. Tesla’s bounty program includes hackable flaws in its vehicles, and GM recently launched a vulnerability disclosure program, albeit one without monetary rewards. But that’s not to say Uber isn’t taking the risk of vehicle cybersecurity seriously, too: in August it hired a pair of hackers who remotely hacked a Jeep over the Internet (at one point while I was driving it on a highway) to show they could cut its transmission and brakes. It may not be long before Uber pays out bounties for hacking not only the computers that run its websites, but the ones on wheels, too.

Go Back to Top. Skip To: Start of Article.

Speculation—no matter how baseless—that online black markets for weapons helped make the terrorist attacks in Paris and Brussels possible hasn’t helped the reputation of the dark web’s anonymous corner of the internet. But one new study shows that even before that dubious link between online anonymity and terror attacks, global opinion on the dark web was already overwhelmingly negative.

On Tuesday, the Canadian think tank the Center for International Governance Innovation released the results of a survey of more than 24,000 individuals in 24 countries, asking their opinion of the dark web—the collection of anonymous web sites that can only be accessed via tools like the anonymity software Tor. In total, 71 percent of the respondents—and 72 percent of Americans in particular—said they believed the “dark net” should be shut down. “The basic perception is that it’s not a good thing,” says Eric Jardine, a CIGI fellow who specializes in research on the dark web and Tor. “For your average Joe or Jane, the dark web is not perceived as a very useful technology, and in fact it’s seen as harmful.”

Rather than depend entirely on survey respondents’ prior knowledge of what the dark web or darknet might be, CIGI’s researchers offered a three-sentence description of it as an anonymous part of the web accessible through only “special web browsers,” mentioning that “journalists, human rights activists, dissidents and whistleblowers can use these services to rally against repression, exercise their fundamental rights to free expression and shed light upon corruption,” while “hackers, illegal marketplaces (eg. selling weapons and narcotics), and child abuse sites can also use these services to hide from law enforcement.” With that prompting in mind, a majority of respondents in all of the two dozen countries surveyed said that the darknet should be shut down. In the most negative countries, like Mexico, India and Indonesia, at least four out of five respondents were opposed to the dark web’s existence, while in even the most darknet-friendly countries, such as Sweden and Hong Kong, 61 percent of respondents came out against it.

CIGI’s Jardine argues that recent media coverage, focusing on law enforcement takedowns of child porn sites and bitcoin drug markets like the Silk Road, haven’t improved public perception of the dark web. But he also points out that an immediate aversion to crimes like child abuse overrides mentions of how the dark web’s anonymity also has human rights applications. “There’s a knee-jerk reaction. You hear things about crime and its being used for that purpose, and you say, ‘let’s get rid of it,’” Jardine says.

Responding to CIGI’s survey, Tor Project spokesperson Kate Krauss defended Tor’s value for privacy and free speech in a statement to WIRED. “Tor is part of the infrastructure of the Internet and provides people in horribly repressive countries with the ability to read and write freely. Tor ensures human rights,” Krauss wrote. “If you poll people about whether or not they support the right to free expression—some will say no. That doesn’t mean that free expression isn’t precious. Tor allows free expression.”

In fact, Jardine points out that countries with a stronger tradition of protest do show more support for the dark web. In Hong Kong, for instance, only 62 percent respondents believed the dark web should be shut down, while in mainland China, those numbers reached 79 percent. And opinion of the dark web was lowest in countries with recent histories of terrorist- or drug-related violence, like Indonesia, India, and Mexico.

Belgium wasn’t included in the CIGI survey, which was carried out before the recent Brussels and Paris attacks. But 76 percent of French respondents said they wanted to see the dark web shut down. And those numbers are likely higher after last week, when the French Interior Minister Bernard Cazeneuve mentioned the darknet in remarks following the deadly bombing of the Brussels airport. Cazeneuve argued last Wednesday that “criminal uses…can be made of ​​darknet types of informal networks, or, in general, the part of the Internet that is not indexed by traditional search engines and which circulates a large mass of information issued by criminal organizations, including jihadists.” The Germany newspaper Bild in November also reported that ISIS’ Paris attackers used weapons purchased from a dark web black market. But that account was later discredited as a misreading of a German customs agency analysis, according to other German media.

Although the dark web does have troubling applications, the anonymous whistleblowing tools and privacy protections it offers have been adopted by organizations as mainstream as the New Yorker, the Guardian, and Facebook. Somewhat paradoxically, CIGI’s survey found that among the same respondents who tended to oppose the dark web’s existence, only 38 percent trusted that they weren’t being monitored online, and only 46 percent believed that information they accessed wasn’t being censored—two of the exact problems the dark web’s tools are meant to counteract. “It’s a weird scenario: people don’t trust that governments aren’t looking into their activities online, and yet the technologies that allow you to get around these concerns…they’re advocating to get shut down,” Jardine says. “There’s a contradiction here.”

Go Back to Top. Skip To: Start of Article.