Uber security flaw compromised two-factor authentication
It isn't much of a security measure if there's a workaround.
Two-factor authentication only works if it's strictly enforced in software, and it sounds like Uber might have fallen short of that goal for a while. In a chat with ZDNet, security researcher Karan Saini has revealed a flaw in Uber's two-factor verification that reportedly rendered it useless. Saini has been keeping the exact details of the exploit under wraps to prevent abuse, but it revolved around a vulnerability in how Uber authenticates users when they sign in. The net effect was clear: an intruder might have only needed your username and password to sign in, giving them the chance to swipe personal info or misuse services.
Saini characterized Uber's response as dismissive, although Uber is telling a different story. The ridesharing company initially told him that the issue wasn't "particularly severe" and was expected, marking it as "informative" -- that is, notable but not pressing. When we reached out to Uber, however, it said that it had fixed the flaw (Saini had previously been informed about this) and that it applied the "informative" label because it was already working on a solution.
The odds are that your data is safe as a result. All the same, this illustrates the fragility of two-factor security. It's much better than a basic sign-in, but it can be defeated in the right circumstances. You still need to keep an eye on your account activity in case intruders are particularly determined to hijack your account.
Update: Saini disputed Uber's claim that it notified him about the fix, and said that a solution only showed up about an hour after ZDNet's piece.
