How I Accessed Employee Settings on Uber

#1

Post by nathanmock » Fri, Feb 27, 2015, 8:07 PM UTC

How I Accessed Employee Settings on Uber
medium.com

Re: How I Accessed Employee Settings on Uber

#2

Post by nathanmock » Fri, Feb 27, 2015, 9:32 PM UTC

Author here: I was able to access employee settings for Uber Technologies, not just employee driver settings.

Re: How I Accessed Employee Settings on Uber

#3

Post by franklinho » Fri, Feb 27, 2015, 9:59 PM UTC

nathanmock wrote: post #2

Author here: I was able to access employee settings for Uber Technologies, not just employee driver settings.

Very cool. With the same approach were you able to manipulate prices or surge/no surge?

Wouldn't be very useful in real life, but if they have a bug bounty program you could report it.

Re: How I Accessed Employee Settings on Uber

#4

Post by seanieb » Sat, Feb 28, 2015, 1:32 AM UTC

Theres no date on this story.

Re: How I Accessed Employee Settings on Uber

#5

Post by jonursenbach » Sat, Feb 28, 2015, 2:07 AM UTC

seanieb wrote: post #4

Theres no date on this story.

Bottom of the page. Feb 27th.

Re: How I Accessed Employee Settings on Uber

#6

Post by jhgg » Sat, Feb 28, 2015, 2:14 AM UTC

franklinho wrote: post #3

nathanmock wrote: post #2

Author here: I was able to access employee settings for Uber Technologies, not just employee driver settings.

Very cool. With the same approach were you able to manipulate prices or surge/no surge? Wouldn't be very useful in real life, but if they have a bug bounty program you could report it.

I don't think this is the case. Setting this "isAdmin" flag simply caused the UI to be rendered. But I'm pretty sure that require any access to the remote API calls will be rejected.

Re: How I Accessed Employee Settings on Uber

#7

Post by jordanthoms » Sat, Feb 28, 2015, 2:22 AM UTC

This is nowhere near as bad as it seems at first - the impact looks limited to changing things within their own app, it's basically just the debug menu. It's not actually giving them access to any additional information or privileges.