2 ms·
This actually seemed way worse than the monetary details. Uber offered TFA via SMS, and then apparently failed to require it. That's really bad, and sparks conc
by Bartweiss 9y ago
This actually seemed way worse than the monetary details. Uber offered TFA via SMS, and then apparently failed to require it. That's really bad, and sparks concern about all of their other security practices.
Assuming this is accurate, I guess it's time to assume there's an unexplained failure in Uber's security/login rules?
- URSpider94 9y agoI assume that the attacker did one of two things: either they were somehow cloning the SMS messages so they came to both the customer's phone and to them, or they jumped the gun on an SMS redirect they had set up and the first TFA got sent to the customer; they then retried later and got the message on their channel. The logical fallacy in your answer is in assuming that, just because the customer got an SMS with a TFA code, an attacker did not get the same or subsequent code and use it. We don't know that. Of course, it's also possible that Uber's TFA is broken ...
- Bartweiss 9y agoI had been assuming that cloning was very unlikely, yeah. It seems substantially harder than actual redirection or capture would be. But honestly, I hadn't considered the possibility that they triggered an SMS and then got access later, maybe with a second (rerouted) SMS. That's a good point.