Ask HN: How to contact Uber about a rider safety exploit being used in the wild? | Hacker News Reader

Ask HN: How to contact Uber about a rider safety exploit being used in the wild?

144 pointselmerfud70 comments

I've tried every possible way to contact Uber I can find to only be met with canned answers by what I assume are bots. I was a victim of this so I know it's being exploited by drivers currently.

How to assault/rob your passengers and not get caught:

1. Accept the ride

2. Meet the passenger and lock then in your car.

3. Do not start the ride, but instead assault, extort, etc... Your passenger.

4. Decline the ride when they flee the car.

5. Ride is now routed to the next driver.

6. Profit!!! Because you car and name will never appear in the riders history. The rider safety hotline does not have the ability to see driver canceled rides. You cannot open a help case in the app because driver cancelled rides do not appear. Uber support (if you can get them to respond) do not have the ability to see driver canceled rides. There is no way to escalate this issue. There's no human to talk to about this issue. You are totally safe to do this with impunity as a driver.

For all the tech magic, anything that deviates outside what they have considered as possible leads to a black hole. How do we contact Uber about this massive exploit before it blows up and tanks their already floundering stock price?

View on HN

I'm sorry but they will not do a single thing about it. Just recently in Brazil a pregnant, transgender man was almost killed by an Uber driver and he didn't even get so much as a response back from the platform. There are public videos of the man threatening to kill them (he was with his girlfriend) while they were still in the car and Uber did nothing.

On a more similar note, my girlfriend last year called an Uber, and after 30 minutes of waiting for it to arrive, the person simply canceled the ride claiming she wasn't wearing a mask (they never even came close to my girlfriend, and she was definitely wearing a mask). We tried contacting support to at the very least refund us the ridiculous fee, but nothing was ever done.

Avoid Uber like the plague.

Sad, but I believe you're correct,. especially in regards to Uber in other countries. I'm glad Grab bought it Uber in most Asian markets. Grab has some annoying security checks of you get flagged but they are much better in their customer service.

I’m replying here to avoid occupying “top space” in the comments section. Also upvoting this post for better visibility in the hope that some helpful advice or connection arises.

Overall, I agree with the assessment here. It doesn’t matter which country you’re in, Uber doesn’t care much for customers and its customer service is abysmal (standard copy paste non-answers or ignoring you). The Uber customer support team will do everything possible to snatch money from you and avoid compensating you even for their fault.

I thought Uber may be a better company after its previous CEO (Travis Kalanick) and his coterie were ousted or left. But the reality on the ground is still the same as what it was some years ago.

You don't call Uber, you call 911. Being locked in a car and assaulted or extorted is crime, not a software exploit. Get the license plate if you can, but even after the fact, file a police report with as much info as you can remember.

Thank you for the advice but if you read the other comments you'll see that this happened in the Dominican Republic. The police while sympathetic declined to take any kind of official report without a plate number or anything else.

That is the Crux of the exploit that drivers can use against passengers. When you're panicked and running away from someone assaulting you you don't have time to memorize a plate number or take a picture of it. Uber conveniently route you to the next available driver completely of allowing this initial driver to vanish from your ride history.

You're then left with zero information to go back on and Uber support has no way for you to contact them about this ride. You're left with zero information to give the police for them to follow up on. What you have is drivers that can exploit passengers with impunity and no recourse and no evidence.

If the police refuse to take a report, they are not sympathetic. They are hiding crime. You should add that to your list of problems, and take it over their heads. I know there is a US Embassy there if you are American. Tell them.

Uber is ultimately the one shielding their driver by not publishing the same information for driver canceled rides as they do for passenger cancel rides.

And well I am exploring other aspects of dealing with this the core problem in here is that Uber has a massive exploit that is being used in the wild against people and there is zero way to get assistance with or from Uber on this. Specifically Uber's contact methods and reporting methods do not allow you to have any way to know who this person was or even to open a support case with Uber. So the real exploit here that we're talking about is with and against Uber.

I agree. I think that police could call someone important in Uber and ask for the data about cancelled rides. They just choose not to.

Just take a screenshot of the app when it shows the plate number and name. If the police still refuse to do anything with that, you've got bigger problems than Uber and will have to just deal with it.

But they probably sell your marketing data so if this guy, the driver, was previously googling football (soccer) gear, and now Uber has a record of your phones being in proximity for 10 minutes, now they will add your info to a list of people interested in football (soccer) gear by association, and Uber can reap a reward by selling this info to ad companies. But track down a bad driver??? Oh no, can’t do that.

Uber's new tactic now is that simply continually close my case with no response. Does anyone actually work at Uber and understand the seriousness of this exploit? Surely someone who watches hacker News also works at Uber

Every hour like clockwork they try and close the issue with no response at all. They're just asking for this to blow up in their face when this happens to some celebrity with lots of followers.

I’m really sorry this happened to you, and I hope you’re safe now (and that it stays that way).

One possible safety precaution for the future might be to make it a personal habit to always photograph the car with plate and driver when they show up, if possible, before you get in. This isn’t the “right” fix for the problem, but it’s potentially something you can do to at least create the theory of consequences/evidence, in hopes that it’ll be enough of a deterrent.

Two other things come to mind, though I don’t know how feasible they’d be outside the US. Still, might be worth a shot:

1. Contract an attorney and see if you can file a private suit against Uber in court, or maybe even against local law enforcement. That MIGHT open up the possibility of forcing Uber to turn over data to comply with a subpoena depending on how the law might work there. Not great, I know, but it might be enough to get their attention at least.

This next one requires faith in humanity, and I fully recognize that fact damn near kills it at the outset, but here goes…

2. ASK OTHER UBER DRIVERS AND PASSENGERS TO FILE SUPPORT REQUESTS ABOUT THE ISSUE. If enough people raise enough hell about it, maybe someone capable of independent thought, someone who can do more than copy and paste canned responses, will become aware of this and have “the feels” as they DAMN WELL SHOULD. And maybe then something can get done.

Like I said, requires faith in humanity so it’s probably the longest of long shots. But right now it sounds like a long shot might be the only shot ya got.

Good luck to you, and stay safe out there!

PS - Fellow hackers o’ the news, if you can do this without major consequences, maybe voice some concern for your fellow (hu)man, over Twitter, or whatever. Not much we can do individually by ourselves, but with enough voices, maybe we can form a chorus loud enough to help. It’s a small ask, IMO, and we can hopefully save future victims from harm.

My faith in humanity is very low at this point especially considering many of the replies to this. There seems to be a lot of victim blaming a lot of uber defense.

The fact that Uber does not have any method at all to contact them in regards to this kind of incident is ridiculous. The fact that people believe that this is a defensible behavior by Uber is even more insane. I just hope nothing happens to them where they feel powerless. Currently Uber just repeatedly closes my issue with no response at all.

Surely somebody at Uber reads hacker News and can reach out about this exploit. But that does not seem to be the case for how Ubers modus operandi is. They typically just ignore passenger assaults until it rises to the level that they have to get embarrassed into action.

One more long-shot idea that occurred to me, and might be worth your time (totally up to you!) would be to contact your various "scopes" of government. I know next to nothing about Brazil, so I don't know what that would look like for you, but if it were in a mid-sized US metro area I'd look at:

- City Council Representative

- State Department of Transportation or Public Safety (In my case this would be Texas DPS)

- County level law enforcement, not city; (so not El Paso, TX police dept. in my case but El Paso County Sherrif)

- State level law enforcement (Not Texas Rangers in this case, as I think that's for other stuff, but something adjacent if it exists? Just my guess as to an example, may not have even a remote analogue in Brazil)

- Federal law enforcement (FBI in the US for example; filing a report/complaint won't get them mad at you unless you really abuse the hell out of it)

- Mayor's office for your city

- Metro transit authority if you have one

- State House of Representatives and/or Senate (your legislative representatives, if you have those)

- National House and/or Senate representatives (I'm in El Paso, TX so in my case Veronica Escobar - House - Ted Cruz (*shudder*) and John Cornyn in the Senate)

- Federal Trade Commission (oversees trade issues, privacy in the US)

- State Attorney General's office (Texas AG in this case)

- Maybe the equivalent of your state governor if appropriate/possible (for example in my case, Gregg Abbott)

- Consumer Financial Protection Bureau (in the US this is a federal agency, but no idea what the equivalent would be elsewhere or if you even have one)

- Federal Communications Commission (The FCC overseas telecommunications systems and law in the US; equivalent may or may not even exist)

Now you're probably thinking "most of those don't deal with criminal exploitation/violent crime/theft!" and you're right. The goal is to make enough noise about it in hopes that somebody in some agency somewhere will just give a damn and hopefully at least make a phone call to a buddy who knows the CEO or something, or draft a letter, or just do something, nearly anything, to poke Uber in the ribs and give 'em a little pain. Sometimes all you need is the attention of just one person in the right position to get others on board, so more complaints = higher probability somebody will do something.

In the US there's an organization called the "Better Business Bureau", or the "BBB", that maintains ratings of merchants and small/mid-sized businesses and tries to mediate disputes. I don't know much about them or if that would be appropriate in this case if it were in the US, but see if an equivalent exists in Brazil or just your local area. You might be surprised at what you find.

Another possibility: take your story to local taxi drivers/companies that COMPETE with Uber. They might be willing to put advertising dollars behind your story to help create a sense of distrust among the public, getting them a bit "scared" to use Uber so that folks use them instead. A slimy tactic, sure, but if your government won't protect you and your fellow citizens, the "slimeball" factor rests on their shoulders, not yours, because they forced you into a corner by not doing the most fundamental job of any government: providing basic safety by enforcing the law.

---

You could also, as others have mentioned, try getting the local (or maybe even national) news media to do a story on this too. Just be aware that being in the public spotlight like that might not be the safest thing for you - retaliation from whomever is doing the extorting could be a serious concern or risk. I doubt Uber themselves would bother you, even through a "proxy" or hired/other "agent", especially as far away as Brazil, so I wouldn't worry about them. The individuals using Uber to harm people, however, might be organized in some way, and they might target you for...something. I don't know what. Don't let that scare you off right away, and don't go buying every gun/weapon you can find "just in case" either, at least not until you're fairly sure you MUST have one. Avoid extreme actions without justified necessity. Don't let this risk put you off entirely - that's exactly why intimidation and retaliation tactics exist and it's the ONLY way they work! Just be aware that there could be some risk depending on your society, laws, public exposure, etc. and discuss that with the journalists involved to find out how to maintain credibility without making yourself an easy target. They might have some pretty clever ideas, so give them a chance!

You're in a tough spot but I appreciate you shining the light of day on this. And you're right, if they don't fix this somebody's going to get mugged, raped, or worse, and it's very likely happened already, and all the while Uber's content to just keep their head in the sand. Not great for "optics" and "public opinion", after all.

I continue to wish you luck! Here's hoping something breaks loose!

Just want to add an update. I finally got a call from someone at Uber who was interested in taking this seriously. So far it's been a positive experience. They listened and understood the mechanics of this exploit that drivers can use. They are working to assist me, but also it seems they do grasp that there is an an ongoing exploit here that drivers are using in the field.

While my incident involved assault, there are other incidents that do not. For example, I've had several drivers message me before they picked me up asking for additional money or my destination. This is explicitly against the driver's terms of service to be an Uber contractor. Just uses the same exploit mechanism of when the driver cancels the ride you can no longer report inappropriate driver behavior. The driver failing to pick you up is annoying behavior but still is the exact same exploit mechanism.

I believe now that Uber has the information to validate that this exploit is going on currently. It may not be used in the US as I've never seen it there but it is definitely happening in the Dominican Republic.

For everyone who's insisting this is 100% of police matter I think you're missing the greater point here. You need to get outside of your local bubble and deal with police and other countries and other locales they do not operate on the same set of ideals and principles as they do in most of the United States. Also that argumentation ignores Uber's responsibility in this matter which is to provide an efficient mechanism to report bad drivers. That mechanism was completely missing here and is cause for the exploit that I was trying to report here on hacker News. It's important that this exploit be made known and that Uber finds a way to address it because if it can happen to me it will happen to other people and it has happened to other people. It may just be the annoyance of canceled rides so far for others but at least in one instance it did rise to the level of assault.

Uber should have a vested interest in ensuring that their drivers are of the highest caliber. Since I had at least three rides where the driver accepted and then canceled after a message where I refused to pay them additional I would think it would be trivial for Uber to use monitoring on messages between riders and drivers and detect this kind of thing. After all detecting a driver demanding a tip prior to pick up or requesting a destination prior to pick up is a much easier prospect than a self-driving car.

I wish it didn't take 3 days to get to this point but I'm currently very satisfied with how Uber is handling this now.

It's very hard to do something after the event. But it is important that this is a warning to others. Perhaps taking some precautions is a good idea. Take a photo of the Uber, including the plate number. If you can, a photo of the driver and screenshots of the booking, etc. Then you have some evidence to file with the police.

That's truly a blindspot for everyone - you'll have to assume they have logs of accepted & canceled rides.

The only thing I can think about for now is taking screenshot of accepted rides as a record.

Yes, do this every time! This will be your only protection that I can think of.

It's insane that Uber even hides driver canceled rides. Because I guess no on would ever need to report a problem with a driver cancelled ride.

I had to do the same with uber eats until I stopped using it. They do everything they can to make sure there's no recorded timestamp of when you place an order so it's that much harder to dispute a bad delivery.

You're definitely going to want to make a police report.

Unfortunately since nothing appears in the ride history without the plate number or the person's name or anything there is nothing to have the police report about. That's the real problem there is this big circle between Uber saying law enforcement needs to make a request and law enforcement saying I need to know what to make the request about.

Having an actual human on the other side of uber that understands the seriousness of this driver exploit would be the easiest way to get it corrected.

Or Uber needs to publish complete ride history including driver cancellations.

In these cases law enforcement should be the ones making the request. This isn't different from "unknown person punched me in the face and ran away, but the Starbucks' camera was pointing at them".

Unfortunately this is in the Dominican Republic (pleasant vacation I'm having) and they are sympathetic but without information they're said they have nothing to file.

What are the odds they already know who mugged you but won't do anything without a (bigger) bribe than what the Uber driver is paying them not to investigate?

You could contact a lawyer who can use legal methods to request the information from Uber. You should probably file the criminal complaint, even if you don't have sufficient information for the police to move forward right now.

It's possible they don't want to accept a request that isn't a slam dunk.

Either way, yeah, your problem is the police, not Uber, and you need someone who knows the law.

My problem is actually with Uber. Because Uber will show passenger canceled rides but Uber will not show driver canceled rides. Uber has no contact method that allows me to interact with them to report this bad driver. Uber has allowed this gaping exploit to be present in their system with no way of resolving it or fixing it or even reporting it.

Saying my problem is with the police and not Uber is typical Uber apologist behavior that acts as if these big data companies can do no wrong. Simply displaying the same driver canceled ride data as they do for passenger canceled ride data this would be a non-issue. Having their safety hotline Representatives be able to view driver canceled rides again would make this a non-issue but they cannot see them.

The only way to contact Uber is in regards to a passenger canceled ride or in regards to a completed ride. So my problem is with Uber because they allow this exploit to exist and it's being used I just hope it is not ever used against you.

I'll rephrase: if you want something to actually happen, taking it to the police (aka the agency directly responsible for dealing with assault) is more likely to work than blaming the soulless corporation for being a soulless corporation.

If you're trying to rile up the masses so that someone goes to court and sues Uber for this, then sure, go ahead. But it'll take significantly longer than dealing with one driver.

The rider goes to law enforcement/security services, they take the appropriate measures to get the data from Uber even if it's not possible to do so from the app.

Reverse scenario:

- Rider requests a ride

- Rider meets driver

- Rider assaults and extorts driver

- Rider cancels the ride.

Your first scenario only works if the police take the complaint and follow up. As I mentioned in other replies, I'm vacationing in the Dominican Republic. The police will not take the complaint without more information, thus they will not make a request to Uber because they don't know what to request. Uber refuses to disclose the same trip history for driver canceled rides as they do for passenger canceled rides.

Thus your reverse scenario and your forward scenario do not match. Because in your reverse scenario both driver and Rider have a history of it in your forward scenario neither driver or Rider have a history to refer to.

This is the Crux of the exploit. Without this information showing up in the trip history of the rider drivers are free to exploit them with impunity. Perhaps if you find a very zealous law enforcement officer in the USA who's willing to pursue this you might get somewhere. Even then if you cannot show that you actually had a ride they may drop the investigation entirely as well.

Go to the media, you're not doing anything @'ing Uber or filing a police report.

If Uber PR has to deal with a growing news story being put in front of potential customers, they'll do something about it.

If you have Android, can you check your notification history? There might be the driver's name on one of them, like "xyz is on route" or sth.

Going to the police, they might have access to security cameras in that neighborhood to check the car's plate.

If they touched your belongings and you still have them, it might be worth giving them to the police to run finger print tracing.

I'm using a One Plus 5T... Still a great phone but sadly no notification history.

I did contact the airport (which is where it happened). They are looking at camera footage but haven't gotten back to me yet. Driver was bold, just didn't care. I've traveled the world and never seen someone so bold right in the middle of so many people. Must have done it many times to know he could get away with it.

Sorry to hear that. I know there used to be a "trick" to get notification history on Androids that don't show it. It involved installing a widget, if I'm correct.

If I were you and had time, I'd create another account and keep requesting for an Uber around the same area where that driver showed up until I see the same driver again. From what you describe, chances are he's still out there doing it.

Hopefully someone here can hack the data stored in the Uber app (in storage) or site (json responses) and see if the registration number is in there somewhere. It wouldn’t surprise me if the meta data is in there even if inaccessible via normal means. The data would have flowed through the app to show you the name of the driver and plate number at the point they agreed to the pickup.

Obviously they can only hack their own app but then once successful they could publish how they did it so you can repeat it for yourself.

Also try this https://help.uber.com/riders/article/request-a-copy-of-your-... and see what they send.

A long shot perhaps.

Another long shot - was there any nest cams in the near vicinity? Do your own police work, but a silver platter, and hand it all over to the police.

They did this to me for three years, including after I talked to humans.

In 2017, a policy change meant that when a rider reported a driver, the driver rating stayed. Prior to that, things were being handled. Afterwards, a five year five star account dropped to 2.6 in two months.

The only solution was to stop using Uber.

I've been gone for four years.

What I learned is that Uber is needed in tiny towns, but in every decent sized city, I have better experiences with lyft and flywheel anyway.

What originally brought me to Uber was faster, lower hassle rides with fewer scams.

No loss, it turns out

Doesn't Uber show the car model and licence plate when the ride is accepted?

Looks useful to make a screenshot and have it uploaded to the cloud in case such a driver steals your phone on top of harassing you.

Hope you are safe now.

Which market are you in and who did you end up getting in touch with in support? Did you try the Safety Incident Support Line? At least in the US that is 1 (800) 285-6172.

Without getting into specifics they absolutely do have a way to track down the driver regardless of the state of the trip / who cancelled.

Yes I specifically called that line. They informed me that they had no ability to see driver canceled rides. They could only see the same rides I have in my history. They were sympathetic and took my complaint but ultimately it ended up nowhere. The same Uber support black hole of nothingness. No response, no follow-up nothing.

Pretty much this driver exploit can be executed with impunity and Uber does not care and there is no way for customers to report it.

Get a driver willing to help you simulate the situation. Record it, put it on YouTube/TikTok.

That might be an idea, but I'm a nobody with no followers. I guess it could picked up and go viral. It's a trivial exploit. Maybe get a major news outlet to m pick it up.

Contact Brian Krebs of Krebs On Security.

https://krebsonsecurity.com/about/

^ Something like this OP. Get your content ready, edit it, and then start contacting specific people that might want to cover this content.

It could even be a local newspaper/channel. I think you should do it. I recently felt uncomfortable with a Lyft driver and decided to check my ride history logs. All of the time stamps were completely wrong. That was a little unnerving but it’s something I never did anything about. If I needed to prove I was somewhere at so and so time, Lyft wouldn’t be a reliable source of information.

Something actually happened to you, so I encourage you to follow through. That could happen to anyone and it’s not funny it’s being shrugged off.

If the ride has been accepted, there most certainly is a log on Uber’s side. It may not show up in your history, but it is there. I hope you are safe now and your health is intact, but please consider filing a police report. Even if you did not note the license plate, location, time, vehicle info, description and name of the driver, etc - this all can help identify the driver. On top of that, your state may have a consumer protection agency or even contacting a state’s attorney office maybe useful, if it is a systematic issue. Also, see if it is worth filing a civil lawsuit. Maybe even in a small claims, depends on the damage.

Even if they have the history, they will generally do nothing about complaints against riders or drivers more than review data and possibly cancel account

have you brought this incident to the polices attention?

I did speak to the police about this when it happened and it goes in circles like this. They need to know the driver's information or the car number. Since it's not in the trip history I don't have it. I contact Uber asking them for this information and they say have law enforcement submit a request. Law enforcement doesn't have any thing to submit a request about. And the circle jerk continues like that ad nauseam.

I suspect that the number of rideshare assaults is greatly underreported based upon this simple exploit. Because quite literally Uber is entirely ignoring my pleas and not even acknowledging this as a possibility.

You know when & where it happened, and have a rough make/model/color of the car and maybe some description of the driver - surely people regularly report crimes based on less than that? I'm not sure why this wouldn't be enough for a police report, at least to have some paper record of it to wave in Uber's face.

Sorry to hear this happened to you, sounds a bit scary and traumatic. Good luck.

I think in the USA I would have better luck doing that. I'm on vacation in the Dominican Republic. There's a lot of sympathy but without information they said they can't take any action.

The fact that Uber hides driver canceled rides but not customer cancelled rides allows for this possibly to even happen. You would think they would want to address this quietly. If it's happened to me, then it will happen to someone with a million Twitter followers and it will blowup in their face.

Uber is aware of this. They have taken explicit steps to protect their drivers "privacy" against police requests for data, even given investigation #s and warrants . I don't really understand what their motivation is, but my experience in the brief period I worked there is that they're lead by scummy people. They do not take reports of crimes seriously.

Could you seek legal advice and see if there’s potential for litigation? That’ll force Uber to disclose potential internal logs during discovery.

If they actually want to, most databases keep some kind of history. The problem is that they don't want to be able to deal with it.

I highly doubt they dispose of any information in the sequence of requests, acceptance/decline and cancellation. That would require actually deleting things that were already in their database, and they have no incentive to do that. They certainly have an incentive to make those things inaccessible to the riders, but not to actually flush them.

Tweet at them?

I have hundreds of tweets at them. It's the same mind numbed robot responses they always give. They say open a help request on the ride in the app, note this is the ride history that does not appear because the driver canceled it. Or alternately they will open it for you from Twitter when you provide them a phone number or email address on the account but then again ask you for which ride it was which doesn't exist.

Quite literally with this information any driver who wishes to assault or extort someone can pretty much do it with impunity with this knowledge. And there is no way to contact Uber about it or even get Uber to acknowledge that it exists.

Or maybe wait and see if anyone that works on Uber also browse HN

hey we see your post and are working on investigating this now.

Reply on news.ycombinator.com