Uber dismissive about security flaw that lets hackers bypass its 2FA

By Waqas Uber has no plans to fix a critical security flaw This is a post from HackRead.com Read the original post: Uber dismissive about security flaw that lets hackers bypass its 2FA...

partners.uber.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-519863 Description| Value ---|--- Affected Website:| partners.uber.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on IS...

Uber: ubernycmarketplace.com is vulnerable to the Heartbleed Bug

The Heartbleed Bug was a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. This allows attackers to eavesdrop on communications, stea...

New Android Malware Disguised as Uber App

By Waqas It is just another day with just another Android malware targeting This is a post from HackRead.com Read the original post: New Android Malware Disguised as Uber App...

Uber: Hack The World 2017 Top 2 Bonus

Thanks for your participation in Hack the World 2017, @nutellite!...

Uber: muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The muber-id request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src...

Uber: lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The lite:sess request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src...

Uber: SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The ga request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelist at...

Uber: SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The cc request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelist at...

The seven most colossal data breaches of 2017

By Logan Strain If it seems like the words “leak,” “compromised data,” and “breach” are constantly in the news, it’s not just you. The frequency of major data breaches is increasing. According to the Identity Theft Resource Center, the number of breaches is expected to top 1,500 in 2017. That’s a...

Uber: Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication

Summary Configuration file and/or source code information leakage without Uber OneLogin SSO authentication. Security Impact Misconfiguration on the server results in information leakage without authentication. Reproduction Steps...

Uber: Design Issue at riders.uber.com/profile

Summary Hello, This is not actually a security threat but a design issue. When a user logs into rush.uber.com, he will get an option called Account Information, when clicked on it takes the user to page https://riders.uber.com/trips where user can edit his profile information. Here user can...

Cybersecurity Incident Response: Three Lessons from Uber’s Story

The recent news regarding the Uber breach has captured the attention of both the public and legislators. It seems that Ubers security team discovered a breach, paid a ransom, and didnt report the matter to company leaders, law enforcement, personnel, or customers...

Uber Paid 20-Year-Old Florida Hacker $100,000 to Keep Data Breach Secret

Last year, Uber received an email from an anonymous person demanding money in exchange for the stolen user database. It turns out that a 20-year-old Florida man, with the help of another, breached Uber's system last year and was paid a huge amount by the company to destroy the data and keep the...

Uber: The Microsoft Store Uber App Does Not Implement Server-side Token Revocation

Summary The Microsoft Store Uber App Windows Phone Architecture does not properly revoke or expire a rider's x-uber-token upon app signout. Security Impact When a user logs out/signs off of the app, the logout process is handled only locally on the application side, and without any type of...

Uber: The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting

Summary The https://cn-sjc1.uber.com/rt/users/apply-clients-promotions customer endpoint used to apply Uber promotions does not implement multifactor authentication, IP address blacklisting for multiple failed attempts, or IP address-based rate limiting to prevent brute force bearer token...

Uber: The Microsoft Store Uber App Does Not Implement Certificate Pinning

Summary The Microsoft Store Uber App Windows Phone Architecture does not properly implement certificate pinning. Security Impact Layer-2+ network traffic transmitted from and received by the app can be surreptitiously intercepted and transparently modified by an attacker, with no warnings or erro...

Uber: How Not To Handle A Breach

Uber is a company that is embattled on all fronts. From a very public power struggle to labour issues to regulatory challenges to a reportedly toxic culture, Uber sits in a precarious position. Yesterday, a new strike against the company came to light. In October 2016, Uber was hacked resulting i...

Uber Paid Hackers $100k to Hide Massive Theft of 75M Accounts

By Waqas It’s surprising to some and shocking to many. Despite a This is a post from HackRead.com Read the original post: Uber Paid Hackers $100k to Hide Massive Theft of 75M Accounts...

Uber Reveals 2016 Breach of 57 Million User Accounts

Ride-hailing service Uber Technologies revealed Tuesday that the company suffered a breach of 57 million Uber user accounts in 2016. According to reports, Uber then attempted to cover up the incident by paying $100,000 to attackers to keep the hack a secret and delete the data. Dara Khosrowshahi,...