Taking over Uber accounts through voicemail

#1

Post by infosecau » Sun, Jul 04, 2021, 2:07 AM UTC

Taking over Uber accounts through voicemail
blog.assetnote.io

Re: Taking over Uber accounts through voicemail

#2

Post by mechboy » Sun, Jul 04, 2021, 4:57 AM UTC

Uber will never know the severity of this bug until several user accounts got compromised by someone

Re: Taking over Uber accounts through voicemail

#3

Post by fzionism » Sun, Jul 04, 2021, 11:04 AM UTC

Very interesting,

Re: Taking over Uber accounts through voicemail

#4

Post by zealsham » Sun, Jul 04, 2021, 1:13 PM UTC

I’ll say Uber rejected this due to highly unlikely user interaction required .

Re: Taking over Uber accounts through voicemail

#5

Post by infosecau » Mon, Jul 05, 2021, 9:19 PM UTC

zealsham wrote: post #4

I’ll say Uber rejected this due to highly unlikely user interaction required .

There's not really much user interaction required. You just have to engage the victims cell phone when sending the OTP. The voicemail hack doesn't require any user interaction.

Re: Taking over Uber accounts through voicemail

#6

Post by dns » Tue, Jul 06, 2021, 8:18 AM UTC

I know as shubs, this post interesting and good writeup. thanks! I follow you on twitter!