United Airlines bug bounty program

http://www.united.com/web/en-US/content/Contact/bugbounty.aspx?

by adamnemecek • 11 years ago

36 45 11 years ago

united.com

outericky• 11 years ago

Paid in United miles? Not really an incentive there.

toomuchtodo• 11 years ago

I see you're familiar with flying United :)

wahsd2• 11 years ago

I appears someone still flied United. Who knew.

teraflop• 11 years ago

Not only that, but: "Award miles offered under this Program are not Premier® qualifying miles." So you don't even get the free checked bag and priority check-in that those miles would otherwise entitle you to.

mindslight• 11 years ago

United's checked bag fees don't actually matter since you'll most likely be refunded as their standard operating procedure is to delay your bag for a week if they can ship freight instead.

scurvy3• 11 years ago

Agreed. They should be award miles that allow for PQM accrual. Or make them all PQM. That way someone could get gold for life (plus spouse) for a code execution exploit.

MichaelGG4• 11 years ago

And United just limited how you can use reward miles. It used to be that your status would pass on too the passenger. So I'd fly my mom or sister, and they'd get checked bags, lounge, priority access, etc.

Now they no longer do that. So it makes the miles far less useful. And, since it doesn't apply to GS, all the other premiers still get screwed by this change. So it's not like it's gonna improve premier status for the rest of us anyways.

Ranty anecdote: Oh and they don't even respect what their ticketing and policies on this state. It was that any such ticket booked before 15 Apr would use the old rules, and indeed the baggage calculator would show that. Sent my sister somewhere, counting on some big bags to bring equipment. GA starts making a fuss, saying no, made her unpack and so on. Even after calling United and being assured she'd be treated properly on the return flight, nope, still not handled correctly and made to pay extra. United's IT is terrible. That's why we call their site ".bomb".

idiot900• 11 years ago

And, a farcically low payout for otherwise very expensive consulting work from highly skilled people.

skolor• 11 years ago

Compared to other bug bounties it isn't bad at all. Airline miles are generally valued at around a penny a mile, so $500 for XSS, $2500 for an auth bypass, $10000 for code exec isn't all that bad.

droopybuns• 11 years ago

A thing that people who have never run bug bounties before: Many of your submissions come from overseas. If your submitters can't profit, they won't submit.

UA needs to get their shit together.

ArkyBeagle2• 11 years ago

Robert Crandall claimed that "no airline has ever made back its cost in capital."

(quotes as delimiters; I can't find the exact quote )

MichaelGG4• 11 years ago

Yeah and who would ever want to use United for international anyways?

wahsd2• 11 years ago

Don't United miles also expire.

poulsbohemian• 11 years ago

If they actually cared about their site they would go back to the old united.com, not the crappy one Continental brought with them in the merger.

I would have been a lifeline customer, but Continental ruined it.

richadams2• 11 years ago

They're currently beta testing a new (more modern) site: https://beta.united.com/ual/en/us/

lqdc13• 11 years ago

I like Virgin's https://www.virginamerica.com/ way more than even their beta one. I guess they're going for different demographics.

saryant3• 11 years ago

The Continental website isn't pretty but it's very functional. Old United's site was called united.bomb for a reason.

scurvy3• 11 years ago

There is always beta.united.com.

MichaelGG4• 11 years ago

Yeah how hard is it to just let us select meals before boarding? Instead of running out of the better meal and pissing off high revenue customers. Even AA gets this right.

richadams2• 11 years ago

"Bugs that are eligible for submission: ... The ability to brute-force reservations, MileagePlus numbers, PINs or passwords"

"Do not attempt: ... Brute-force attacks"

This seems contradictory. I assume the intent is to not allow DoS attacks (although they call that out separately further down the list)?

supercoder• 11 years ago

Not exactly.

Seems they're saying they'd accept a bug that can be caused by brute-force, but do not actually attempt a brute force yourself.

But yeah I'd guess they don't want intentionally invite a bunch of people to DoS the site.

bashinator• 11 years ago

Another interpretation is that, if you discover something similar to what Weev discovered, do not do what Weev did.

bhuga• 11 years ago

"Bugs on onboard Wi-Fi, entertainment systems or avionics" are not eligible for bounties.

It's very strange to see website timing attacks as worth rewarding, but not avionics. Perhaps they'd rather not incentivize people to attack airplanes in flight?

akerl_• 11 years ago

I'm pretty sure that's the reason. While identifying vulnerabilities in the actual airplane is high-value, it's also high-risk. Even the most cautious researcher can easily affect a system being investigated, which is potentially financially costly for a website and potentially fatal for an airplane in the air.

cortesoft• 11 years ago

Yes, I am pretty sure it is a safety thing. That would be very dangerous to encourage people to try to hack a flight in the air.

shiggerino• 11 years ago

It would be a good idea to provide access to that sort of equipment on the ground. Bugs that can lead to loss of life should be of much higher priority than bugs that can merely lead to loss of profit on a web site.

Though the avionics industry would obviously balk at the proposition, those systems are already spectacularly vulnerable, and they'd hate to lose face.

verelo• 11 years ago

As much as I agree with the comments below/above about it being a safety issue, I would argue it is possible that a contributing factor is in flight WiFi being so flakey that it would be too expensive to run the program on this asset.

saryant3• 11 years ago

My guess is wifi and entertainment are excluded because United doesn't build those. Depending on the aircraft they're provided by Panasonic, LiveTV, etc. in the case of LiveTV (United's vendor for DirecTV) it's even seller-financed.

United probably isn't interested in paying for someone else's bugs.

ArkyBeagle2• 11 years ago

Access to the media for futzing with the avionics better be very [expletive deleted]ing hard to get.

ikonst• 11 years ago

Exactly what you'd expect from an airline:

"Bugs or potential Bugs you discover may not at any time be disclosed publicly or to a third-party. Doing so will disqualify you from receiving award miles."

It's as if it was designed in the same spirit as a frequent flyer program -- really stingy payout, with lots of strings attached. I can't see how this can incentivise anyone to do free penetration-testing for them.

thewhizkid2• 11 years ago

I'm not a hacker - how much should you normally get paid for a low/medium/high bug? 50k points ~= $1500; 250k points ~= $7500; 1m points ~= $30k.

A lot more if you redeem for int'l biz/first class...

tfe• 11 years ago

3 cents per mile seems like a pretty high valuation to me. I usually use 1.5 cpm. You can do better, as you mentioned, but this is a good EV for me.

thewhizkid2• 11 years ago

True.

Another gem in the ToS: "You are responsible for any tax implications that apply based on your country of residency and citizenship."

I know miles earned from credit cards are not taxed, but I do know for a fact that Citibank sends out a 1099 for new checking accounts that come with bonus miles.

If United sends you a 1099 based on the market value of a mile (likely between 2-3 cents each), then you're looking at non-trivial tax implications as well.

SeoxyS• 11 years ago

It's not crazy, though. I was just looking at SFO-TXL round-trips in business. 115k miles… instead of $8k. Values the miles at around 7c/mile.

I made a calculator to answer the question: should I pay cash or spend miles. I set the "good value" threshold at 2c/mile: https://kballenegger.github.io/miles-or-cash/

emmab• 11 years ago

"Code injection on live systems" is not allowed? what does this even mean?

If I put ?param=' and it crashes with an SQL error have I performed code injection on a live system?

ludamad• 11 years ago

Well in that case they'd presumably have a log and they would see no suspicious payload.

CyberDildonics• 11 years ago

Is having rude stewardesses and planes that are never on time bugs? Is grouping two flights into one flight number to deceive people into buying 3 stop international flights a bug? If so please pay me in minimal airline miles which I can then use to waste more of my time on the shittiest airline in the world.

noondip• 11 years ago

Where is their PGP key?

markhall• 11 years ago

I think this idea of bounty programs even among non-tech companies will continue to grow. I recently wrote about this in-depth as a solution to many of the online security problems: http://mytwoandahalfcents.com/prevent-enterprise-security-br...

United Airlines bug bounty program

Related Stories