Uber dares hackers to find flaws, offers up to $10k bounty

HackerOne has established three categories of rewards; $10,000 for a critical flaw, $5,000 for a significant flaw and $3,000 for medium issues.

“Chaining of bugs is not frowned upon in any way, we love to see clever exploit chains!” Uber stated in its online challenge. “If you get access to an Uber server, please report it us and we will reward you with an appropriate bounty taking into full consideration the severity of what could be done. Chaining a CSRF vulnerability with a self-XSS? Nice! Using AWS access key to dump user info? Not cool.”

In 2014, Uber’s servers were hacked and as many as 50,000 driver accounts were compromised. Immediately upon discovering the breach, Uber said it changed the access protocols for the database, “removing the possibility of unauthorised access”.

It said it had not received any reports of actual misuse of information as a result of the 2014 breach.

Because it delayed informing its employees of the data breach, however, Uber was forced to pay a $20,000 penalty in a settlement with New York Attorney General Eric T. Schneiderman.