in

Uber ‘ignored’ bug in its two-factor authentication

Ride-hailing app Uber has reportedly ignored a security flaw — discovered by a New Delhi-based security researcher — that can allow an attacker to hack into user accounts via bypassing its two-factor authentication feature

Ride-hailing app Uber has reportedly ignored a security flaw — discovered by a New Delhi-based security researcher — that can allow an attacker to hack into user accounts via bypassing its two-factor authentication feature. “Two-factor authentication is a vital part of protecting online accounts that adds a second layer of security on top of your username and password — which can be be stolen — by sending a code by text message to your phone which only you would have access to,” tech website ZDNet reported late on Sunday.

Uber, cab aggregator

“That two-factor code can be bypassed, making the second layer of security protection effectively useless,” security researcher Karan Saini was quoted as saying by ZDNet.

The security bug works by exploiting a weakness in how the app authenticates a user when they log in to the platform, thereby letting the user log in to an account and easily defeat the two-factor prompt, without entering the correct code.

Uber reportedly said the security bug “is not a particularly severe” issue.

“This isn’t a particularly severe report and is likely expected behaviour,” Rob Fletcher, Security Engineering Manager at Uber, said in his correspondence with Saini about the bug report. Uber began testing two-factor authentication on its systems in 2015 but the company has yet to widely push the security feature to its users.

Catch up on all the latest Mumbai, National and International news here

Download the new mid-day Android and iOS apps to get updates on all the latest and trending stories on the go

The content/reporting displayed on our website www.mid-day.com is provided “AS-IS,” “AS AVAILABLE, by us from third party, agencies, sources, without any verification from our side. It may contain error, bugs and other limitations. The reader’s can rely on the content at their own will. Mid-day accepts no responsibility or liability for its dependability, trustworthiness, reliability, data, text, images, video, messages, or any other material whatsoever or for any claims/loss/action that the reader may suffer as a result of relying on the content on our site. Mid-day management/mid-day.com reserves the sole right to alter, delete or remove (without notice) the content in its absolute discretion for any reason whatsoever.

Comments

comments

Written by Anadkat Madhav

I am a software engineer, project manager, and Mobile Application Developer currently living in Rajkot, India. My interests range from technology to entrepreneurship. I am also interested in programming, web development, design, Mobile Application development.

You can also contact me through my website
madhavanadkat.com

Leave a Reply

Your email address will not be published. Required fields are marked *

Toyota Vios Sedan Spied Testing In India

Survivor In Rape Case Involving Asaram Bapu To Be Examined From January 29