Uber Account Takeover Vulnerability Discovered

By   ISBuzz Team
Writer , Information Security Buzz | Sep 12, 2019 05:27 am PST

According to this link, https://www.forbes.com/sites/daveywinder/2019/09/12/uber-confirms-account-takeover-vulnerability-found-by-forbes-30-under-30-honoree/#16085ecf9b87, a security vulnerability has been discovered that could allow attackers to compromise and control any Uber account.

  • The vulnerability could be exploited to track a user’s location and take rides from their account via an application programming interface (API) request
  • This involved first acquiring the user universally unique identifier (UUID) of any user by sending an API request that included either their telephone number or email address. “Once you have the leaked Uber UUID from the API request,” Prakash said, “you can replay the request using the victim’s Uber UUID and get access to private information like access token (mobile apps), location and address.”
  • The same vulnerability impacted Uber driver accounts and Uber Eats accounts as well
Notify of
1 Expert Comment
Oldest Most Voted
Inline Feedbacks
View all comments
Javvad Malik
Javvad Malik , Security Awareness Advocate
September 12, 2019 1:30 pm

Apps are a great way to conveniently interact with users, especially for companies like Uber which rely heavily on phone functions. But because of the way it functions, it gathers location data, payment information, and journey history – which makes it an ideal candidate for all manner of attackers ranging from espionage or spying, to cybercriminals looking to make money.

It\’s important that companies have good security processes, technology and have the right people in place to ensure security is part of the fabric of the company. Merely adopting two out of three people, process and technology is not enough.

Last edited 4 years ago by Javvad Malik

Recent Posts

Would love your thoughts, please comment.x