Only the XSS one was a real vulnerability, they should have paid $500 at least for that though.
Client side logout with seemingly no token expiration is a very serious vulnerability, especially for something like Uber where payments are involved.
I Got Paid $0 from the Uber Security Bug Bounty
21–30 of 168 posts
Re: I Got Paid $0 from the Uber Security Bug Bounty
#22I'm getting Uber fatigue. This company has been in the news mostly in a negative sense. It 's lost on me what innovation, technologically, or socially, they have brought to the table.
Instead, perhaps we can focus on how we can fix this sharing economy, so that we can all benefit; not just the ones who happened to raise the most money from shareholders.
Re: I Got Paid $0 from the Uber Security Bug Bounty
#23Only the XSS one was a real vulnerability, they should have paid $500 at least for that though.
Client side logout with seemingly no token expiration is a very serious vulnerability, especially for something like Uber where payments are involved.
Yeah that's a big one, and an issue with the core of their entire authentication workflow that they cannot fix without invalidating tens of millions of apps or forcing everyone to upgrade. Whenever you sign off of their mobile app there is no communication with the network, they are just erasing the token on the client side.
Re: I Got Paid $0 from the Uber Security Bug Bounty
#24Only the XSS one was a real vulnerability, they should have paid $500 at least for that though.
I don't understand why he didn't make an alert(document.domain), the universal "this is legit" bat signal. Instead, creating some weird form phishing demo?
I think there is more to this story, it sounds like this wasn't a "Cross Site Scripting", but "Content Injection" or "Content Spoofing", a far less serious bug.
You're gonna hate me, but I would award $0 for Content Injection, it's just not a big deal ¯\_(ツ)_/¯
Re: I Got Paid $0 from the Uber Security Bug Bounty
#25Okay, so for the first 4 bug reports, I'm on Uber's side. In their Hackerone program details it says that one of the valid close states of a report is [1]: > duplicate -- a vulnerability that has previously been found either internally or via Hackerone As much as it sucks to find a bunch of vulnerabilities and not get them paid out, it doesn't make sense for Uber to a) publish a list of current unpatched security vul…
If those were vulnerabilities discovered prior, then surely they could cite to the prior report or an internal ticket to that effect. These weren't previously discovered issues, especially the certificate pinning Surface app one. Their own Bug Bounty Treasure Map specifically states that all requests to that mobile endpoint are certificate pinned, but aren't in the Surface app. But the best part is, when I was report…
> Then they disabled completely the Uber Report Issue button
I don't have enough signal to make a report, but the button doesn't 404 for me, so my guess is you've been shadowbanned.
> then surely they could cite to the prior report or an internal ticket to that effect
Yeah, they should, at least to build the relationship. Public programs have so many erroneous report they probably stopped doing the "nice" thing ages ago.
> But the best part is, when I was reporting various issues to the Bug Bounty, their staff is actively fixing stuff on the backend - that XSS issue they were trying to fix on the backend, but without paying anything for the discovery. I was getting different application responses after the initial report, but only until I gave them more info on the WAF and XSS_Auditor evasion stuff did they finally pull the whole application offline. And then still didn't pay.
If this is true, that's really bad. I'd be curious to hear the other side of the story if there is one.
Re: I Got Paid $0 from the Uber Security Bug Bounty
#26Let me get this straight: there's a company built to exploit the ignorance of people of just how much it costs to drive their own car and the complete disregard of law and you thought while they don't respect their drivers and various governing bodies all over the globe they will respect you ?
I think you will realize, once you have cooled down a bit, that it is exactly people's awareness of how much it costs to own and drive a car in terms of money and mental peace that drives them to use services like Uber.
And yes, I know you were referring to people who drive for Uber.
For many people, the process of owning and driving a car doesn't make overall sense, which is why they pay others to do it for them.
I don't see anyone complaining about how maids have to, oh my gosh, clean houses.
Re: I Got Paid $0 from the Uber Security Bug Bounty
#27This is why I see these programs in general as foolish. Either you're an employee of the company and you're being paid as such or you've got a proper contract that specifies objectives and compensation. But these bounty programs that leave all the power in the hands of the company just aren't really a great idea. I wonder how many times something like this happened and it went unreported because the hacker just didn'…
Lots of bug bounty programs work out great! But there are a couple of companies I would never try to get a bug bounty from, based on their reputations. Oracle is one, for being litigious fuckwads; Uber is another, for literally everything they do and say.
Re: I Got Paid $0 from the Uber Security Bug Bounty
#28This is why I see these programs in general as foolish. Either you're an employee of the company and you're being paid as such or you've got a proper contract that specifies objectives and compensation. But these bounty programs that leave all the power in the hands of the company just aren't really a great idea. I wonder how many times something like this happened and it went unreported because the hacker just didn'…
Are you basing this opinion on this one account? I would like to point out that Uber has a history of sleaze and would absolutely not use their behavior to judge any such programs. Are there other well described, similar instances of such poor behavior from legitimate companies? It seems to me that most of the bigger corps offering bug bounties may be paying too little but at least they follow their own rules.
Khaos Tian published a writeup a few days ago about how he discovered a wide-open HomeKit vulnerability [0]. He reported it properly months prior, but Apple ignored his followups and was unresponsive. After this extended radio silence, Tian reached out to a media contact. Within hours of being contacted by the website, Apple finally pushed a hotfix for the vulnerability.
Apple subsequently denied Tian access to their bug bounty program because going to the press "voided the qualification for the invitation." [1]
[0]: https://medium.com/@khaost/your-home-was-not-so-secure-after...
Re: I Got Paid $0 from the Uber Security Bug Bounty
#29Only the XSS one was a real vulnerability, they should have paid $500 at least for that though.
I don't understand why he didn't make an alert(document.domain), the universal "this is legit" bat signal. Instead, creating some weird form phishing demo? I think there is more to this story, it sounds like this wasn't a "Cross Site Scripting", but "Content Injection" or "Content Spoofing", a far less serious bug. You're gonna hate me, but I would award $0 for Content Injection, it's just not a big deal ¯\_(ツ)_/¯
Initially JavaScript was being escaped with their WAF.
The second POC demonstrated the ability to evade both their WAF and XSS_Auditor.
Their development team then verified the ability to execute arbitrary JavaScript from any *.cloudfront.net host.
That's pretty much the whole story.
Re: I Got Paid $0 from the Uber Security Bug Bounty
#30I'm gonna need a response from HackerOne on this one. It's a very bad look for both Uber (yet again) but also HackerOne.