Skip to main content

Uber Vulnerabilities Leak Rider Details And Journey History





A Portuguese security company has found eight security vulnerabilities in Uber’s cab-hailing platform, some of which could allow hackers to identify individual drivers and download passenger journey history.
Uber opened its public bug bounty programme in March, and during a three-week test, Portugal-based penetration tester Integrity found that its researchers were also able to get free ride vouchers using brute force attacks.



Uber security

Uber


The researchers even found a voucher that Uber didn’t know exists: a free ride up to $100 for emergencies.
Bug bounty programmes are becoming increasingly popular in the software industry, and provide companies with the most authentic way of testing the security of their systems. Just this week Google revealed that it had given out almost £400,000 to researchers who found flaws in its Android operating system.

Integrity said that its first pass over Uber only yielded previously reported flaws, but then decided to double back and implement new processes to hunt for bugs.

“In order to implement some kind of methodology, we went back to the Uber bug bounty program to check again [its] scope,” said the researchers.
By this, the researchers meant all of Uber’s software that can be accessed, 

such as rider apps for iOS and Android, driver apps for iOS and Android, and the various Uber websites such as Uber.com and Ubermovement.com.
The researchers then DNS brute-forced all of the Uber subdomains that they could find. This method rewarded Integrity with free promo codes for rides, by brute forcing riders.uber.com.

“Uber has a feature that allows the usage of promotion codes. This codes can be given by other users or companies. The application riders.uber.com had this feature in the payment page, so after adding a new promotion code we grabbed the request and realised that the application didn’t had any kind of protection against brute-force attacks, which helped us to find many different promotion codes,” they explained.

“Uber also gives an option to customize promotion codes, and since all the default codes began with the word “uber”, it was possible to drop the time of the brute force considerably allowing us to find more than 1000 valid codes.
01_web-1024x482

“Initially this issue was not considered valid because the promotions codes are supposed to be public and be given by anyone.

This was true until finding an $100 ERH (Emergency Ride Home) code which they (uber-sec team) had no knowledge about. This ERH codes work differently from all others since even if a promotion code is already applied this ones can still be added.”


Help page

Next, the researchers discovered that user email addresses could be gleaned by emailing Uber through the help page request form on the app. Another bug was found when the researchers realised they could access other rider phone numbers when a rider decides to split a fare, a feature that needs another rider’s phone number to work. Unfortunately, this bug had already been discovered.

In total, Integrity found eight new vulnerabilities: the brute force attack to get free promo codes, a way to view a driver’s ride history by bay of their unique driver ID, a way to view the driver’s email address from their driver’s ID, and view trip information from other users. Four other vulnerabilities were found but they are currently not disclosed by Uber yet.

“This was our first bug bounty program that we really dedicated some time, and we think it had a positive outcome,” said Integrity.
“For the people who are starting the bug bounty programs, our advice is: never give up or be afraid if it is a big company, just have fun and try to learn as much as possible along the way and in time the profits will come.
“With this being said, we think that Uber has one of the best bug bounty programs, with great payouts,” it added.

Comments

Post a Comment

Popular posts from this blog

Security Alert; Bart Ransomware Bypasses Corporate Firewalls

A new ransomware variant has emerged that’s similar to widespread threats such as Dridex 220 and Locky Affid=3, but uses a security-evading technique that may allow it to attack organisations protected from other malware, according to computer security researchers. Ransomware has spread quickly in the last few months, as a number of payouts have attracted cyber-criminals to the technique.
Post a Comment
Read more

Floods Leave Many Dead in Southern Ghana

Four days of heavy and steady rain has left at least 10 people dead in the south of Ghana. The streets of Accra have been left under water after the torrential downpours caused widespread flooding earlier this week. The nation's capital was hit bit 185mm of rain on Sunday, which is more than they would expect for the entire month of June. This is the wettest month of the year with an average rainfall of 178mm. Since the weekend a further 50mm of rain has fallen exacerbating the severe problems already faced. President John Dramani Mahama has surveyed the areas concerned. He was reported to have driven through several neighbourhoods on a motorcycle. Heavy downpours were also recorded 150km to the west of Accra in the Central Regional capital, Cape Coast where 10 people died in floods,  Sandy Amartey, regional coordinator of the National Disaster Management organisation, told AFP. "In all we have 10 to 12 who lost their lives during this rainy season." The rain...
Post a Comment
Read more

Etisalat Has Launched Its Mobile (4G LTE) Services In Nigerian

The Chief Executive Officer, Etisalat Nigeria, Matthew Willsher, who announced the new service roll-out, said the latest offering demonstrates the telco’s unwavering commitment to deliver superior customer experience to its subscribers.
Post a Comment
Read more