How I Accessed Employee Settings on Uber

How I Accessed Employee Settings on Uber(medium.com)

92 points by nathanmock 11 years ago | 6 comments

nathanmock 11 years ago |

Author here: I was able to access employee settings for Uber Technologies, not just employee driver settings.

franklinho 11 years ago | |

Very cool. With the same approach were you able to manipulate prices or surge/no surge?

Wouldn't be very useful in real life, but if they have a bug bounty program you could report it.

jhgg 11 years ago | | |

I don't think this is the case. Setting this "isAdmin" flag simply caused the UI to be rendered. But I'm pretty sure that require any access to the remote API calls will be rejected.

jordanthoms 11 years ago |

This is nowhere near as bad as it seems at first - the impact looks limited to changing things within their own app, it's basically just the debug menu. It's not actually giving them access to any additional information or privileges.

seanieb 11 years ago |

Theres no date on this story.

jonursenbach 11 years ago | |

Bottom of the page. Feb 27th.