Computer security expert Mykko Hypponen discovered the ability for anyone to view the trips by searching trips.uber.com in Google.
Advertisement
The information shared included not just the total time of the trip, but also the rider’s name, the route taken, the driver’s name and his or her vehicle registration. Although Uber stresses that this link will only inform your friends about your ride details, by posting it publicly it is cached by Google and hence appears in its search results.
While the pins show up on a map along with the ETA and driver’s information, there’s no indication that the passenger’s exact address of origin is also included in the source code. When riders select the “Share my ETA ” option, the app generates a link with information meant to be sent via text.
But the source code from the data collected, and publicly accessible, also includes details of pick up and drop off points, according to Business Insider.
This is not technically a data breach, because URLs to these ride pages are being shared by their users on Twitter or other social media services, as a way to let family or friends know when they are arriving at a particular destination, Joe Sullivan, Uber’s Chief Security Officer, has explained.
In a statement, the ride sharing company said: “We have found that all these links have been deliberately shared publicly by riders”. Links that on Thursday had displayed maps now only bring up a web site reading, “Page not found”.
But even though the links may have been deliberately shared online, users likely were not aware that they would contain sensitive data in the source code, or that anyone could find them through Google. That’s because when this all came to light yesterday, Uber changed the links generated by the “Share my ETA” feature to expire after 48 hours.
Uber has been subjected to criticisms and questions over privacy and its user data policies.
Advertisement
The Uber trips are shared by the user via the Uber mobile app, allowing others to track their current location.
