Taking over Uber accounts through voicemail

[infosecau]

https://blog.assetnote.io/2021/06/27/uber-account-takeover-voicemail/

[dns]

I know as shubs, this post interesting and good writeup. thanks! I follow you on twitter!

[mechboy]

Uber will never know the severity of this bug until several user accounts got compromised by someone

[zealsham]

I’ll say Uber rejected this due to highly unlikely user interaction required .

[infosecau → zealsham]

There's not really much user interaction required. You just have to engage the victims cell phone when sending the OTP. The voicemail hack doesn't require any user interaction.

[fzionism]

Very interesting,