Taking over Uber accounts through voicemail (opens in new tab)

(blog.assetnote.io)

15 pointsinfosecau4y ago5 comments

5 comments

5 comments · 4 top-level

zealsham4y ago· 1 in thread

I’ll say Uber rejected this due to highly unlikely user interaction required .

There's not really much user interaction required. You just have to engage the victims cell phone when sending the OTP. The voicemail hack doesn't require any user interaction.

dns4y ago

I know as shubs, this post interesting and good writeup. thanks! I follow you on twitter!

mechboy4y ago

Uber will never know the severity of this bug until several user accounts got compromised by someone

fzionism4y ago

Very interesting,

j / k navigate · click thread line to collapse