8 ms·
Ask HN: How to contact Uber about a rider safety exploit being used in the wild?
I've tried every possible way to contact Uber I can find to only be met with canned answers by what I assume are bots. I was a victim of this so I know it's being exploited by drivers currently.
How to assault/rob your passengers and not get caught:
1. Accept the ride
2. Meet the passenger and lock then in your car.
3. Do not start the ride, but instead assault, extort, etc... Your passenger.
4. Decline the ride when they flee the car.
5. Ride is now routed to the next driver.
6. Profit!!! Because you car and name will never appear in the riders history. The rider safety hotline does not have the ability to see driver canceled rides. You cannot open a help case in the app because driver cancelled rides do not appear. Uber support (if you can get them to respond) do not have the ability to see driver canceled rides. There is no way to escalate this issue. There's no human to talk to about this issue. You are totally safe to do this with impunity as a driver.
For all the tech magic, anything that deviates outside what they have considered as possible leads to a black hole. How do we contact Uber about this massive exploit before it blows up and tanks their already floundering stock price?
- elmerfud 5y agoUber's new tactic now is that simply continually close my case with no response. Does anyone actually work at Uber and understand the seriousness of this exploit? Surely someone who watches hacker News also works at Uber
- elmerfud 5y agoEvery hour like clockwork they try and close the issue with no response at all. They're just asking for this to blow up in their face when this happens to some celebrity with lots of followers.
- crate_barre 5y agoGet a driver willing to help you simulate the situation. Record it, put it on YouTube/TikTok.
- elmerfud 5y agoThat might be an idea, but I'm a nobody with no followers. I guess it could picked up and go viral. It's a trivial exploit. Maybe get a major news outlet to m pick it up.
- toomuchtodo 5y agoContact Brian Krebs of Krebs On Security. https://krebsonsecurity.com/about/ https://krebsonsecurity.com/about/
- crate_barre 5y ago^ Something like this OP. Get your content ready, edit it, and then start contacting specific people that might want to cover this content. It could even be a local newspaper/channel. I think you should do it. I recently felt uncomfortable with a Lyft driver and decided to check my ride history logs. All of the time stamps were completely wrong. That was a little unnerving but it’s something I never did anything about. If I needed to prove I was somewhere at so and so time, Lyft wouldn’t be a reliable source of information. Something actually happened to you, so I encourage you to follow through. That could happen to anyone and it’s not funny it’s being shrugged off.
- remram 5y agoTweet at them?
- elmerfud 5y agoI have hundreds of tweets at them. It's the same mind numbed robot responses they always give. They say open a help request on the ride in the app, note this is the ride history that does not appear because the driver canceled it. Or alternately they will open it for you from Twitter when you provide them a phone number or email address on the account but then again ask you for which ride it was which doesn't exist. Quite literally with this information any driver who wishes to assault or extort someone can pretty much do it with impunity with this knowledge. And there is no way to contact Uber about it or even get Uber to acknowledge that it exists.
- nextaccountic 5y agoOr maybe wait and see if anyone that works on Uber also browse HN
- user100002 5y agohey we see your post and are working on investigating this now.
- petterparker 5y agohave you brought this incident to the polices attention?
- elmerfud 5y agoI did speak to the police about this when it happened and it goes in circles like this. They need to know the driver's information or the car number. Since it's not in the trip history I don't have it. I contact Uber asking them for this information and they say have law enforcement submit a request. Law enforcement doesn't have any thing to submit a request about. And the circle jerk continues like that ad nauseam. I suspect that the number of rideshare assaults is greatly underreported based upon this simple exploit. Because quite literally Uber is entirely ignoring my pleas and not even acknowledging this as a possibility.
- dandelany 5y agoYou know when & where it happened, and have a rough make/model/color of the car and maybe some description of the driver - surely people regularly report crimes based on less than that? I'm not sure why this wouldn't be enough for a police report, at least to have some paper record of it to wave in Uber's face. Sorry to hear this happened to you, sounds a bit scary and traumatic. Good luck.
- elmerfud 5y agoI think in the USA I would have better luck doing that. I'm on vacation in the Dominican Republic. There's a lot of sympathy but without information they said they can't take any action. The fact that Uber hides driver canceled rides but not customer cancelled rides allows for this possibly to even happen. You would think they would want to address this quietly. If it's happened to me, then it will happen to someone with a million Twitter followers and it will blowup in their face.
- GauntletWizard 5y agoUber is aware of this. They have taken explicit steps to protect their drivers "privacy" against police requests for data, even given investigation #s and warrants . I don't really understand what their motivation is, but my experience in the brief period I worked there is that they're lead by scummy people. They do not take reports of crimes seriously.
- sorethescore 5y agoYou're definitely going to want to make a police report.
- elmerfud 5y agoUnfortunately since nothing appears in the ride history without the plate number or the person's name or anything there is nothing to have the police report about. That's the real problem there is this big circle between Uber saying law enforcement needs to make a request and law enforcement saying I need to know what to make the request about. Having an actual human on the other side of uber that understands the seriousness of this driver exploit would be the easiest way to get it corrected. Or Uber needs to publish complete ride history including driver cancellations.
- Kinrany 5y agoIn these cases law enforcement should be the ones making the request. This isn't different from "unknown person punched me in the face and ran away, but the Starbucks' camera was pointing at them".
- elmerfud 5y agoUnfortunately this is in the Dominican Republic (pleasant vacation I'm having) and they are sympathetic but without information they're said they have nothing to file.
- 908B64B197 5y agoWhat are the odds they already know who mugged you but won't do anything without a (bigger) bribe than what the Uber driver is paying them not to investigate?
- ghayes 5y agoYou could contact a lawyer who can use legal methods to request the information from Uber. You should probably file the criminal complaint, even if you don't have sufficient information for the police to move forward right now.
- pkrotich 5y agoThat's truly a blindspot for everyone - you'll have to assume they have logs of accepted & canceled rides. The only thing I can think about for now is taking screenshot of accepted rides as a record.
- vimax 5y agoI had to do the same with uber eats until I stopped using it. They do everything they can to make sure there's no recorded timestamp of when you place an order so it's that much harder to dispute a bad delivery.
- elmerfud 5y agoYes, do this every time! This will be your only protection that I can think of. It's insane that Uber even hides driver canceled rides. Because I guess no on would ever need to report a problem with a driver cancelled ride.
- behnamoh 5y agoIf you have Android, can you check your notification history? There might be the driver's name on one of them, like "xyz is on route" or sth. Going to the police, they might have access to security cameras in that neighborhood to check the car's plate. If they touched your belongings and you still have them, it might be worth giving them to the police to run finger print tracing.
- elmerfud 5y agoI'm using a One Plus 5T... Still a great phone but sadly no notification history. I did contact the airport (which is where it happened). They are looking at camera footage but haven't gotten back to me yet. Driver was bold, just didn't care. I've traveled the world and never seen someone so bold right in the middle of so many people. Must have done it many times to know he could get away with it.
- behnamoh 5y agoSorry to hear that. I know there used to be a "trick" to get notification history on Androids that don't show it. It involved installing a widget, if I'm correct. If I were you and had time, I'd create another account and keep requesting for an Uber around the same area where that driver showed up until I see the same driver again. From what you describe, chances are he's still out there doing it.
- Kaze404 5y agoI'm sorry but they will not do a single thing about it. Just recently in Brazil a pregnant, transgender man was almost killed by an Uber driver and he didn't even get so much as a response back from the platform. There are public videos of the man threatening to kill them (he was with his girlfriend) while they were still in the car and Uber did nothing. On a more similar note, my girlfriend last year called an Uber, and after 30 minutes of waiting for it to arrive, the person simply canceled the ride claiming she wasn't wearing a mask (they never even came close to my girlfriend, and she was definitely wearing a mask). We tried contacting support to at the very least refund us the ridiculous fee, but nothing was ever done. Avoid Uber like the plague.
- elmerfud 5y agoSad, but I believe you're correct,. especially in regards to Uber in other countries. I'm glad Grab bought it Uber in most Asian markets. Grab has some annoying security checks of you get flagged but they are much better in their customer service.
- ipaddr 5y agoA pregnant transgendered man? How does that work.. if the person was a female but become a male the parts wouldn't be available for a baby. Without surgery they are female with female parts but identify as male so dressing up as a male. How does someone identify as a male but still want a baby.
- elmerfud 5y agoTransgender woman, is a biological (is this the correct terminology?) That is transitioning to a woman. So a transgender man or trans man as I've heard referred to, is a biological female transitioning to a man. So yes they can get pregnant, because it's only very late in the process (and optional) to have a hysterectomy and a male genitals created. Many/some do not opt for this as the male genitals aren't really functional in the way you'd expect. They use a prosthetic instead.
- UncleMeat 5y agoLoads of people don't get bottom surgery.
- natch 5y agoBut they probably sell your marketing data so if this guy, the driver, was previously googling football (soccer) gear, and now Uber has a record of your phones being in proximity for 10 minutes, now they will add your info to a list of people interested in football (soccer) gear by association, and Uber can reap a reward by selling this info to ad companies. But track down a bad driver??? Oh no, can’t do that.
- Jugurtha 5y agoThe rider goes to law enforcement/security services, they take the appropriate measures to get the data from Uber even if it's not possible to do so from the app. Reverse scenario: - Rider requests a ride - Rider meets driver - Rider assaults and extorts driver - Rider cancels the ride.
- elmerfud 5y agoYour first scenario only works if the police take the complaint and follow up. As I mentioned in other replies, I'm vacationing in the Dominican Republic. The police will not take the complaint without more information, thus they will not make a request to Uber because they don't know what to request. Uber refuses to disclose the same trip history for driver canceled rides as they do for passenger canceled rides. Thus your reverse scenario and your forward scenario do not match. Because in your reverse scenario both driver and Rider have a history of it in your forward scenario neither driver or Rider have a history to refer to. This is the Crux of the exploit. Without this information showing up in the trip history of the rider drivers are free to exploit them with impunity. Perhaps if you find a very zealous law enforcement officer in the USA who's willing to pursue this you might get somewhere. Even then if you cannot show that you actually had a ride they may drop the investigation entirely as well.
- ianmabie 5y agoWhich market are you in and who did you end up getting in touch with in support? Did you try the Safety Incident Support Line? At least in the US that is 1 (800) 285-6172. Without getting into specifics they absolutely do have a way to track down the driver regardless of the state of the trip / who cancelled.
- elmerfud 5y agoYes I specifically called that line. They informed me that they had no ability to see driver canceled rides. They could only see the same rides I have in my history. They were sympathetic and took my complaint but ultimately it ended up nowhere. The same Uber support black hole of nothingness. No response, no follow-up nothing. Pretty much this driver exploit can be executed with impunity and Uber does not care and there is no way for customers to report it.
- AnimalMuppet 5y agoIf they actually want to, most databases keep some kind of history. The problem is that they don't want to be able to deal with it.
- noduerme 5y agoI highly doubt they dispose of any information in the sequence of requests, acceptance/decline and cancellation. That would require actually deleting things that were already in their database, and they have no incentive to do that. They certainly have an incentive to make those things inaccessible to the riders, but not to actually flush them.
- YeBanKo 5y agoIf the ride has been accepted, there most certainly is a log on Uber’s side. It may not show up in your history, but it is there. I hope you are safe now and your health is intact, but please consider filing a police report. Even if you did not note the license plate, location, time, vehicle info, description and name of the driver, etc - this all can help identify the driver. On top of that, your state may have a consumer protection agency or even contacting a state’s attorney office maybe useful, if it is a systematic issue. Also, see if it is worth filing a civil lawsuit. Maybe even in a small claims, depends on the damage.
- thatcat 5y agoEven if they have the history, they will generally do nothing about complaints against riders or drivers more than review data and possibly cancel account
- quickthrower2 5y agoHopefully someone here can hack the data stored in the Uber app (in storage) or site (json responses) and see if the registration number is in there somewhere. It wouldn’t surprise me if the meta data is in there even if inaccessible via normal means. The data would have flowed through the app to show you the name of the driver and plate number at the point they agreed to the pickup. Obviously they can only hack their own app but then once successful they could publish how they did it so you can repeat it for yourself. Also try this https://help.uber.com/riders/article/request-a-copy-of-your-personal-data?nodeId=2c86900d-8408-4bac-b92a-956d793acd11 https://help.uber.com/riders/article/request-a-copy-of-your-... and see what they send. A long shot perhaps. Another long shot - was there any nest cams in the near vicinity? Do your own police work, but a silver platter, and hand it all over to the police.
- GianFabien 5y agoIt's very hard to do something after the event. But it is important that this is a warning to others. Perhaps taking some precautions is a good idea. Take a photo of the Uber, including the plate number. If you can, a photo of the driver and screenshots of the booking, etc. Then you have some evidence to file with the police.
- csmattryder 5y agoGo to the media, you're not doing anything @'ing Uber or filing a police report. If Uber PR has to deal with a growing news story being put in front of potential customers, they'll do something about it.
- codingdave 5y agoYou don't call Uber, you call 911. Being locked in a car and assaulted or extorted is crime, not a software exploit. Get the license plate if you can, but even after the fact, file a police report with as much info as you can remember.
- elmerfud 5y agoThank you for the advice but if you read the other comments you'll see that this happened in the Dominican Republic. The police while sympathetic declined to take any kind of official report without a plate number or anything else. That is the Crux of the exploit that drivers can use against passengers. When you're panicked and running away from someone assaulting you you don't have time to memorize a plate number or take a picture of it. Uber conveniently route you to the next available driver completely of allowing this initial driver to vanish from your ride history. You're then left with zero information to go back on and Uber support has no way for you to contact them about this ride. You're left with zero information to give the police for them to follow up on. What you have is drivers that can exploit passengers with impunity and no recourse and no evidence.
- codingdave 5y agoIf the police refuse to take a report, they are not sympathetic. They are hiding crime. You should add that to your list of problems, and take it over their heads. I know there is a US Embassy there if you are American. Tell them.
- elmerfud 5y agoUber is ultimately the one shielding their driver by not publishing the same information for driver canceled rides as they do for passenger cancel rides. And well I am exploring other aspects of dealing with this the core problem in here is that Uber has a massive exploit that is being used in the wild against people and there is zero way to get assistance with or from Uber on this. Specifically Uber's contact methods and reporting methods do not allow you to have any way to know who this person was or even to open a support case with Uber. So the real exploit here that we're talking about is with and against Uber.
- jpl56 5y agoDoesn't Uber show the car model and licence plate when the ride is accepted? Looks useful to make a screenshot and have it uploaded to the cloud in case such a driver steals your phone on top of harassing you. Hope you are safe now.
- MrWiffles 5y agoI’m really sorry this happened to you, and I hope you’re safe now (and that it stays that way). One possible safety precaution for the future might be to make it a personal habit to always photograph the car with plate and driver when they show up, if possible, before you get in. This isn’t the “right” fix for the problem, but it’s potentially something you can do to at least create the theory of consequences/evidence, in hopes that it’ll be enough of a deterrent. Two other things come to mind, though I don’t know how feasible they’d be outside the US. Still, might be worth a shot: 1. Contract an attorney and see if you can file a private suit against Uber in court, or maybe even against local law enforcement. That MIGHT open up the possibility of forcing Uber to turn over data to comply with a subpoena depending on how the law might work there. Not great, I know, but it might be enough to get their attention at least. This next one requires faith in humanity, and I fully recognize that fact damn near kills it at the outset, but here goes… 2. ASK OTHER UBER DRIVERS AND PASSENGERS TO FILE SUPPORT REQUESTS ABOUT THE ISSUE. If enough people raise enough hell about it, maybe someone capable of independent thought, someone who can do more than copy and paste canned responses, will become aware of this and have “the feels” as they DAMN WELL SHOULD. And maybe then something can get done. Like I said, requires faith in humanity so it’s probably the longest of long shots. But right now it sounds like a long shot might be the only shot ya got. Good luck to you, and stay safe out there! PS - Fellow hackers o’ the news, if you can do this without major consequences, maybe voice some concern for your fellow (hu)man, over Twitter, or whatever. Not much we can do individually by ourselves, but with enough voices, maybe we can form a chorus loud enough to help. It’s a small ask, IMO, and we can hopefully save future victims from harm.
- elmerfud 5y agoMy faith in humanity is very low at this point especially considering many of the replies to this. There seems to be a lot of victim blaming a lot of uber defense. The fact that Uber does not have any method at all to contact them in regards to this kind of incident is ridiculous. The fact that people believe that this is a defensible behavior by Uber is even more insane. I just hope nothing happens to them where they feel powerless. Currently Uber just repeatedly closes my issue with no response at all. Surely somebody at Uber reads hacker News and can reach out about this exploit. But that does not seem to be the case for how Ubers modus operandi is. They typically just ignore passenger assaults until it rises to the level that they have to get embarrassed into action.
- elmerfud 5y agoJust want to add an update. I finally got a call from someone at Uber who was interested in taking this seriously. So far it's been a positive experience. They listened and understood the mechanics of this exploit that drivers can use. They are working to assist me, but also it seems they do grasp that there is an an ongoing exploit here that drivers are using in the field. While my incident involved assault, there are other incidents that do not. For example, I've had several drivers message me before they picked me up asking for additional money or my destination. This is explicitly against the driver's terms of service to be an Uber contractor. Just uses the same exploit mechanism of when the driver cancels the ride you can no longer report inappropriate driver behavior. The driver failing to pick you up is annoying behavior but still is the exact same exploit mechanism. I believe now that Uber has the information to validate that this exploit is going on currently. It may not be used in the US as I've never seen it there but it is definitely happening in the Dominican Republic. For everyone who's insisting this is 100% of police matter I think you're missing the greater point here. You need to get outside of your local bubble and deal with police and other countries and other locales they do not operate on the same set of ideals and principles as they do in most of the United States. Also that argumentation ignores Uber's responsibility in this matter which is to provide an efficient mechanism to report bad drivers. That mechanism was completely missing here and is cause for the exploit that I was trying to report here on hacker News. It's important that this exploit be made known and that Uber finds a way to address it because if it can happen to me it will happen to other people and it has happened to other people. It may just be the annoyance of canceled rides so far for others but at least in one instance it did rise to the level of assault. Uber should have a vested interest in ensuring that their drivers are of the highest caliber. Since I had at least three rides where the driver accepted and then canceled after a message where I refused to pay them additional I would think it would be trivial for Uber to use monitoring on messages between riders and drivers and detect this kind of thing. After all detecting a driver demanding a tip prior to pick up or requesting a destination prior to pick up is a much easier prospect than a self-driving car. I wish it didn't take 3 days to get to this point but I'm currently very satisfied with how Uber is handling this now.
- deleted 5y ago[deleted]
- JohnHaugeland 5y agoThey did this to me for three years, including after I talked to humans. In 2017, a policy change meant that when a rider reported a driver, the driver rating stayed. Prior to that, things were being handled. Afterwards, a five year five star account dropped to 2.6 in two months. The only solution was to stop using Uber. I've been gone for four years. What I learned is that Uber is needed in tiny towns, but in every decent sized city, I have better experiences with lyft and flywheel anyway. What originally brought me to Uber was faster, lower hassle rides with fewer scams. No loss, it turns out