Uber Flaw Discovery Shows Why Bug Bounty Programs Are Important

Love it or hate it, Uber has helped transform many people's lives and the way they travel in urban areas. At its core, Uber is not a taxi company; it's a technology service, and one of its primary assets is user information.

Uber recently closed a high-impact flaw in its platform that could potentially have put user information at risk.

Although the vulnerability is interesting, so too is the means and method by which it was discovered in the first place. Although Uber is a technology company, it didn't discover the flaw on its own, but rather by way of a third-party researcher, participating in a bug bounty program. "Through the endpoint at /rt/users/passwordless-signup it is possible to change the password of any Uber user, given knowledge of their phone number (or by just enumerating phone numbers until one is found that is registered with Uber—not too hard given the number of Uber users)," the HackerOne bug report 143717 details show.