Source: HackerOne Report #5200
Vulnerability Summary
A user enumeration vulnerability on Uber's login form allowed attackers to determine whether an email address was registered with the service by analyzing response time differences.
Technical Details
The vulnerability is a timing side-channel attack. When a user submits the login form:
- Existing user: The server performs additional processing — password hash verification, multi-factor authentication checks, account status validation — resulting in a longer response time
- Non-existing user: The server returns early with an 'invalid credentials' message, resulting in a shorter response time
By measuring the response time for many requests, an attacker can statistically determine which email addresses are registered with Uber.
Why Timing Differences Occur
In many authentication implementations, the code path differs between existing and non-existing users:
if (userExists) {
// Hash comparison, MFA check, etc. — takes time
verifyPassword(inputPassword, storedHash);
checkMFA();
return result;
} else {
// Early return — fast
return 'Invalid credentials';
}Even if the code looks similar, operations like database lookups for existing users, password hashing algorithm execution, and session creation add measurable latency.
Impact
- User enumeration: Attackers build lists of registered Uber accounts
- Targeted attacks: Knowing which emails are registered enables targeted phishing
- Credential stuffing: Enumerated accounts can be targeted with credential stuffing attacks
- Privacy violation: Reveals that specific individuals use the Uber service
Remediation
Uber fixed the vulnerability by implementing consistent response timing:
- Artificial delay added to non-existing user responses to match existing user response times
- Alternative: Always perform the full password verification flow (using a dummy hash for non-existing users)
- Rate limiting on login attempts to prevent large-scale enumeration
General Lessons for Login Form Security
- Return identical error messages for 'user not found' and 'wrong password'
- Maintain consistent response timing regardless of user existence
- Implement rate limiting on authentication endpoints
- Monitor for enumeration patterns — many requests to different email addresses from the same source
- Use CAPTCHA or proof-of-work for repeated failed login attempts