Uber Paid 20-Year-Old Florida Hacker $100,000 to Keep Data Breach Secret

Last year, Uber received an email from an anonymous person demanding money in exchange for the stolen user database. It turns out that a 20-year-old Florida man, with the help of another, breached Uber's system last year and was paid a huge amount by the company to destroy the data and keep the...

Uber: The Microsoft Store Uber App Does Not Implement Server-side Token Revocation

Summary The Microsoft Store Uber App Windows Phone Architecture does not properly revoke or expire a rider's x-uber-token upon app signout. Security Impact When a user logs out/signs off of the app, the logout process is handled only locally on the application side, and without any type of...

Uber: The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting

Summary The https://cn-sjc1.uber.com/rt/users/apply-clients-promotions customer endpoint used to apply Uber promotions does not implement multifactor authentication, IP address blacklisting for multiple failed attempts, or IP address-based rate limiting to prevent brute force bearer token...

Uber: The Microsoft Store Uber App Does Not Implement Certificate Pinning

Summary The Microsoft Store Uber App Windows Phone Architecture does not properly implement certificate pinning. Security Impact Layer-2+ network traffic transmitted from and received by the app can be surreptitiously intercepted and transparently modified by an attacker, with no warnings or erro...

Uber: How Not To Handle A Breach

Uber is a company that is embattled on all fronts. From a very public power struggle to labour issues to regulatory challenges to a reportedly toxic culture, Uber sits in a precarious position. Yesterday, a new strike against the company came to light. In October 2016, Uber was hacked resulting i...

Uber Paid Hackers $100k to Hide Massive Theft of 75M Accounts

By Waqas It’s surprising to some and shocking to many. Despite a This is a post from HackRead.com Read the original post: Uber Paid Hackers $100k to Hide Massive Theft of 75M Accounts...

Uber Reveals 2016 Breach of 57 Million User Accounts

Ride-hailing service Uber Technologies revealed Tuesday that the company suffered a breach of 57 million Uber user accounts in 2016. According to reports, Uber then attempted to cover up the incident by paying $100,000 to attackers to keep the hack a secret and delete the data. Dara Khosrowshahi,...

After Getting Hacked, Uber Paid Hackers $100,000 to Keep Data Breach Secret

Uber is in headlines once again—this time for concealing last year's data breach that exposed personal data of 57 million customers and drivers. On Tuesday, Uber announced that the company suffered a massive data breach in October 2016 that exposed names, e-mail addresses and phone numbers of 57...

Uber: No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts

A lack of rate limiting on the "/confirm" endpoint made it possible for an attacker to add themselves to arbitrary business.uber.com accounts by brute forcing confirmation codes. If they were able to successfully brute force the correct confirmation code, this would allow an attacker to take ride...

Apple Allows Uber to Use a Powerful Feature that Lets it Record iPhone Screen

If you are an iPhone user and use Uber app, you would be surprised to know that widely popular ride-hailing app can record your screen secretly. Security researcher Will Strafach recently revealed that Apple selectively grants what's known as an "entitlement" Uber a powerful ability to use the...

Uber users beware; Faketoken Android malware hits ride-sharing apps

By Waqas The new version of Faketoken Malware Targets Uber-Like Apps to This is a post from HackRead.com Read the original post: Uber users beware; Faketoken Android malware hits ride-sharing apps...

Uber Drivers Hacking the System to Cause Surge Pricing

Interesting story about Uber drivers who have figured out how to game the company's algorithms to cause surge pricing: According to the study. drivers manipulate Uber's algorithm by logging out of the app at the same time, making it think that there is a shortage of cars. ... The study said drive...

uber-moose.com XSS vulnerability

Open Bug Bounty ID: OBB-269198 Description| Value ---|--- Affected Website:| uber-moose.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Uber Patches Authentication Bypass Vulnerability on Custom SSO Solution

Uber has addressed a vulnerability that allowed attackers to steal session tokens and hijack accounts. Researcher Arne Swinnen disclosed details Monday after confirming late last week that the issue had been resolved; he earned $5,000 in bounties from Uber. Swinnen said that if exploited at a lar...

How Can I dig to a value of $ 8000 Uber vulnerability-vulnerability warning-the black bar safety net

I study Uber vulnerability has been there for some time, and this is the first time I posted about the Uber vulnerability discovery report, I hope can give you some interesting burrowing ideas. In this article, I will share with you the one I'm in the Uber system in the discovery of interesting...

Uber: Session not expired When logout [partners.uber.com]

Hi, Summary ========= partners.uber.com website is not expiring the user's session immediately after logout. when user logout, the session not expired, and still can send request and the server respond response with OKAY Steps to Reproduce: - Log into the website - partners.uber.com - Capture any...

The Uber platform coming out of authentication vulnerabilities, exploit the vulnerability can reset any account password-loophole warning-the black bar safety net

Italian security expert Vincenzo C. Aka found the Uber platform authentication vulnerabilities, any account can use this vulnerability to reset the password, this discovery yesterday officially announced. In fact, the initiator of the“authentication crisis”the vulnerability is in the seven months...

Uber Driver - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Uber Driver published at the 'play' market has multiple vulnerabilities...

Uber - Certificates or keys found, Dynamic Code Loading, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Uber published at the 'play' market has multiple vulnerabilities...

Uber: SAML Authentication Bypass on uchat.uberinternal.com

Due to improper SAML verification it was possible to bypass the OneLogin authentication on https://uchat.uberinternal.com and gain unauthorized access to internal chats. We enjoyed working with @mishre on this report and look forward to receiving more submissions from them in the future!...