

How I Accessed Employee Settings on Uber - nathanmock
https://medium.com/@nmock/accessing-employee-settings-on-uber-a3ecc5542315

======
nathanmock
Author here: I was able to access employee settings for Uber Technologies, not
just employee driver settings.

~~~
franklinho
Very cool. With the same approach were you able to manipulate prices or
surge/no surge?

Wouldn't be very useful in real life, but if they have a bug bounty program
you could report it.

~~~
jhgg
I don't think this is the case. Setting this "isAdmin" flag simply caused the
UI to be rendered. But I'm pretty sure that require any access to the remote
API calls will be rejected.

------
jordanthoms
This is nowhere near as bad as it seems at first - the impact looks limited to
changing things within their own app, it's basically just the debug menu. It's
not actually giving them access to any additional information or privileges.

------
seanieb
Theres no date on this story.

~~~
jonursenbach
Bottom of the page. Feb 27th.

