Uber dares hackers to find flaws, offers up to $10K bounty

Biggest bounties are for being able to find employee Social Security and customer credit card numbers, among other data

Creative Commons Lic.

On-demand car service Uber is offering from $3,000 to $10,000 to hackers who can find flaws in its computer and communications systems.

HackerOne, a company that connects white-hat hackers to companies who want to use them to test the security of systems, is running Uber's "bounty program."

The amount of the reward is based on the severity of the flaw discovered by a hackers, i.e., security researchers.

HackerOne has established three categories of rewards; $10,000 for a "critical flaw," $5,000 for a "significant flaw" and $3,000 for "medium issues."

"Chaining of bugs is not frowned upon in any way, we love to see clever exploit chains!" Uber stated in its online challenge. "If you get access to an Uber server, please report it us and we will reward you with an appropriate bounty taking into full consideration the severity of what could be done. Chaining a CSRF vulnerability with a self-XSS? Nice! Using AWS access key to dump user info? Not cool."

In 2014, Uber's servers were hacked and as many as 50,000 driver accounts were compromised. Immediately upon discovering the breach, Uber said it changed the access protocols for the database, "removing the possibility of unauthorized access."

It said it had not received any reports of actual misuse of information as a result of the 2014 breach.

Because it delayed informing its employees of the data breach, however, Uber was forced to pay a $20,000 penalty in a settlement with New York Attorney General Eric T. Schneiderman.

This story, "Uber dares hackers to find flaws, offers up to $10K bounty" was originally published by Computerworld.


Copyright © 2016 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)