Arne Swinnen

TL;DR: Uber was vulnerable to subdomain takeover on saostatic.uber.com via Amazon CloudFront CDN. Moreover, Uber’s recently deployed Single Sign-On (SSO) system at auth.uber.com, which is based on shared cookies between all *.uber.com subdomains, was found vulnerable to session cookie theft by any compromised…

Popular posts: 1
Total points: 384
HN comments: 65
Rank: #6,942 personal

Visit arneswinnen.net → RSS feedOn Hacker News Jul 2016 – Jul 2016

Security & Privacy 1 Tech Industry & Business 1

Most points Most discussed Most cited Newest

How I Could Steal Money from Instagram, Google and Microsoft

2016384 points65 comments Security & Privacy details

TL;DR: Instagram ($2000), Google ($0) and Microsoft ($500) were vulnerable to direct money theft via premium phone number calls. They all offer services to supply users with a token via a computer-voiced phone call, but neglected to properly verify whether supplied phone numbers were legitimate, non-premium numbers…