According to this link, https://www.forbes.com/sites/
- The vulnerability could be exploited to track a user’s location and take rides from their account via an application programming interface (API) request
- This involved first acquiring the user universally unique identifier (UUID) of any user by sending an API request that included either their telephone number or email address. “Once you have the leaked Uber UUID from the API request,” Prakash said, “you can replay the request using the victim’s Uber UUID and get access to private information like access token (mobile apps), location and address.”
- The same vulnerability impacted Uber driver accounts and Uber Eats accounts as well
Apps are a great way to conveniently interact with users, especially for companies like Uber which rely heavily on phone functions. But because of the way it functions, it gathers location data, payment information, and journey history – which makes it an ideal candidate for all manner of attackers ranging from espionage or spying, to cybercriminals looking to make money.
It\’s important that companies have good security processes, technology and have the right people in place to ensure security is part of the fabric of the company. Merely adopting two out of three people, process and technology is not enough.