Ride-hailing app Uber has reportedly ignored a security flaw -- discovered by a New Delhi-based security researcher -- that can allow an attacker to hack into user accounts via bypassing its two-factor authentication feature.
"Two-factor authentication is a vital part of protecting online accounts that adds a second layer of security on top of your username and password -- which can be stolen -- by sending a code by text message to your phone which only you would have access to," tech website ZDNet reported late on Sunday.
"That two-factor code can be bypassed, making the second layer of security protection effectively useless," security researcher Karan Saini was quoted as saying by ZDNet.
The security bug works by exploiting a weakness in how the app authenticates a user when they log in to the platform, thereby letting the user log in to an account and easily defeat the two-factor prompt, without entering the correct code.
According to the report, he filed a bug report with HackerOne, which administers Uber’s bug bounty but his report was reportedly rejected. The bypass bug was reported as ‘informative’ by Uber, which meant that it didn’t not need an immediate fix or action taken on it but contained useful information.
Uber reportedly said the security bug "is not a particularly severe" issue.
"This isn't a particularly severe report and is likely expected behaviour," Rob Fletcher, Security Engineering Manager at Uber, said in his correspondence with Saini about the bug report.
An Uber spokesperson too, told ZDNet that the bug isn’t a bypass. “It is likely caused by the security team's ongoing testing to evaluate and refine the effectiveness of different techniques to secure accounts,” the report quotes him as saying.
Uber began testing two-factor authentication on its systems in 2015 but the company has yet to widely push the security feature to its users.
With IANS inputs