Taking over Uber accounts through voicemail (opens in new tab)

(blog.assetnote.io)

15 pointsinfosecau4y ago5 comments

5 comments

dns4y ago

I know as shubs, this post interesting and good writeup. thanks! I follow you on twitter!

mechboy4y ago

Uber will never know the severity of this bug until several user accounts got compromised by someone

zealsham4y ago

I’ll say Uber rejected this due to highly unlikely user interaction required .

infosecauOP4y ago

There's not really much user interaction required. You just have to engage the victims cell phone when sending the OTP. The voicemail hack doesn't require any user interaction.

fzionism4y ago

Very interesting,

j / k navigate · click thread line to collapse