According to this link, https://www.forbes.com/sites/daveywinder/2019/09/12/uber-confirms-account-takeover-vulnerability-found-by-forbes-30-under-30-honoree/#16085ecf9b87, a security vulnerability has been discovered that could allow attackers to compromise and control any Uber account.

  • The vulnerability could be exploited to track a user’s location and take rides from their account via an application programming interface (API) request
  • This involved first acquiring the user universally unique identifier (UUID) of any user by sending an API request that included either their telephone number or email address. “Once you have the leaked Uber UUID from the API request,” Prakash said, “you can replay the request using the victim’s Uber UUID and get access to private information like access token (mobile apps), location and address.”
  • The same vulnerability impacted Uber driver accounts and Uber Eats accounts as well
Subscribe
Notify of
guest

1 Expert Comment
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
Javvad Malik
Javvad Malik , Security Awareness Advocate
InfoSec Expert
September 12, 2019 1:30 pm

Apps are a great way to conveniently interact with users, especially for companies like Uber which rely heavily on phone functions. But because of the way it functions, it gathers location data, payment information, and journey history – which makes it an ideal candidate for all manner of attackers ranging from espionage or spying, to cybercriminals looking to make money.

It\’s important that companies have good security processes, technology and have the right people in place to ensure security is part of the fabric of the company. Merely adopting two out of three people, process and technology is not enough.

Last edited 3 years ago by Javvad Malik
Information Security Buzz
1
0
Would love your thoughts, please comment.x
()
x