United Airlines awards hackers millions of miles for revealing risks

http://www.reuters.com/article/2015/07/16/us-cybersecurity-airmiles-idUSKCN0PQ0A320150716

by doppp • 11 years ago

228 105 11 years ago

adventured• 11 years ago

"The cost can be less than hiring outside consultancies."

It's probably ten times cheaper when you consider the per mile cost to the airline. United could hardly be getting a better deal.

zamalek• 11 years ago

Additionally actual results are orders of magnitude cheaper. If you hire a consultant you still have to pay them even if they find nothing.

draugadrotten• 11 years ago

Maybe UA get a kick-back from the agencies as well, since flying (international) would give the agencies identities, photos, fingerprints and a right to search the luggage of interesting hackers.

rmc• 11 years ago

Pretty sure the US Gov has access to US Passports.,

jon-wood2• 11 years ago

Sorry that you're the one to get the brunt of this, but I'm really bored of the NSA snark on unrelated articles. Yes, we get that they've done some terrible things. No, they didn't set up UA's security disclosure problem in some sort of obscure conspiracy to get hold of hacker's passport numbers.

Tiksi5• 11 years ago

Taking a quick look at http://www.united.com/web/en-US/apps/mileageplus/awards/trav... it seems 1 million miles ~= $3000-$12000 depending on destination, date, etc. It doesn't seem all that bad of deal, except plenty of people don't fly often enough to even make use of this, and you have to fly united, which for me would kill all the value.

notauser• 11 years ago

You can use United miles to buy tickets on Thai, Lufthansa and ANA, all of which are superb.

(I used my last lot on two first class tickets to Tokyo which would have cost a lot more than $12k each if bought for cash.)

Tiksi5• 11 years ago

Well then I suppose it might be worth it, I've had great experiences on Lufthansa the few times I've flown on it, one time the plane was entirely empty except for our group of 5 so we had a 747 to ourselves.

monksy• 11 years ago

I'll take your word on Thai, and ANA. But I would purposely avoid flying on LH. They've managed to screw me over so many times its not even funny.

(I know they're in the same group) I would take LX (Swiss) over LH any day.

When trying to help them in a bad situation on their end, they'll snap at you. (I.e. when they had a plane downgrade in FRA, I offered to be transferred to a UA metal flight on my way back to ORD.. their reaction "WHO TOLD YOU THIS!" [I was trying to help the person avoid involuntary bumping, worse.. I and my travel companion was on an award ticket.. even if it matter anyways]

ubernostrum6• 11 years ago

Though Lufthansa is known to severely restrict the ability to redeem Star Alliance partner miles for premium seats.

Back when US Airways (which is where I have my status) was in Star, that was a consistent complaint. Now we're in oneworld with the AA merger, the complaint is British Airways' ridiculous "fuel surcharge" which makes a premium-class mileage-award ticket still cost the same amount of cash as an actual economy-class ticket.

pauldino• 11 years ago

You wouldn't be stuck on United - although it's a lot easier to use them for flights on United itself they can be used to fly on any Star Alliance carrier, including some really nice ones like ANA and Singapore Airlines.

netheril96• 11 years ago

except plenty of people don't fly often enough to even make use of this

Can this be sold?

onewaystreet• 11 years ago

It's against United's terms to sell your miles.

desigooner• 11 years ago

They can probably be used for giftcards etc via the MileagePlusX program / app.

briandear• 11 years ago

So free tickets in United aren't valuable because you would rather sit on the ground than get to travel for free? I fly over 75,000 miles a year with United, mostly international and they aren't any worse than any other American carrier. I travel enough that I'd even be willing to fly AA if it were completely free even though I despise AA and how they used their bankruptcy to avoid paying a judgement I won against them. Free is free though.

Tiksi5• 11 years ago

Well like I said, not everyone flies that much. I don't come anywhere near 75000 miles a year, maybe somewhere around there for a lifetime total. After my last flight on United (and Delta), I would flat out refuse except maybe first class, but that seems like a waste. I'm pretty tall and 2 hours in I'm just about in tears from the pain in my knees from sitting in those tiny seats. I'd rather pay full price than do that ever again. I try to stick with Jet Blue or Virgin as much as possible because I actually fit.

jpatokal2• 11 years ago

they aren't any worse than any other American carrier

Which is kind of like saying that Ebola isn't any worse than any other hemorrhagic fever.

(FWIW, I've flown >800k miles. Every one of my "top 5 worst flights" was on an American airline, bar one that involved a planeload of drunken Irish football hooligans and a seatmate who was both lecherous and morbidly obese.)

jrockway2• 11 years ago

You can get way more than $12000 out of a million miles. I don't fly *A, but a quick glance at UA's award chart shows ~200k miles for a one way "anytime" US-Australia flight in first class. That is currently about $10,000 according to Google Flights. Done 5 times, there's $50,000. (I'm sure you can redeem on one of their better partner airlines, like ANA, if you are willing to be flexible on dates and times.)

Of course, this is unhelpful if you don't want to go somewhere far away and expensive in a premium cabin. I've always found the value in frequent flyer miles to be in redeeming tickets that I could never afford with money. Using frequent flyer miles to fly from Chicago to Minneapolis is not getting you much value.

vidarh2• 11 years ago

and you have to fly united, which for me would kill all the value.

I used to love flying United (note: I mostly flown transatlantic flights with them; only one domestic US flight and the difference was stark), for a simple reason:

While basic economy in United isn't all that great, their frequent flyer program is (or used to be, been a few years) very good in terms of ease of getting upgrades or perks. Getting up in the tiers enough to always get free upgrades to Premium Economy didn't take much, and the top tiers are actually possible to reach if you travel a bit for business, unlike e.g. British Airlines where you practically have to live in the air to get to their higher tiers.

Business on United did not match business on e.g. BA or Virgin, but on the other hand upgrades to business on United was as reliable as clockwork - I got upgrades ca. every 3rd leg once I'd gotten to one of their upper tiers (which includes a multiplier on miles).

If you fly now and again for leisure, base it on what you'll pay for, sure. But if travelling for business, how the upgrades stack up makes a huge difference.

cesarb• 11 years ago

Even if the nominal value of the reward were as low as $100, it also has another positive but unstated value: it's a strong signal that you won't be prosecuted for revealing to them a flaw you've found.

baakss• 11 years ago

I'd be curious if it also qualifies the person who found the bug for their million mile lifetime membership programs.

http://www.united.com/web/en-US/content/account/lifetime.asp...

ubernostrum6• 11 years ago

Almost certainly not.

Although it was different in the past, all the US carriers now differentiate between miles earned by actually flying (in the industry and the frequent-flyer community referred to as "BIS", or "butt-in-seat" miles), and miles earned from all other associated programs (credit cards, affiliate shopping, etc. etc.).

Only the mileage from actual flying counts toward frequent-flyer status, lifetime benefit thresholds and so on.

SeoxyS3• 11 years ago

The million mile lifetime status is based on "Lifetime Flown Miles," which is different than EQMs (elite-qualifying miles), and "Award Miles." EQMs reset every year, and are used only to set your frequent flyer status level. Award Miles are equivalent to a currency, and you can accumulate them and spend them on award tickets and other things. The reward for the bug bounty is only in award miles.

fapjacks2• 11 years ago

Phew. Talk about tying two cats together and stuffing them in a pillowcase. That's how I feel about flying United, free miles or no.

amelius• 11 years ago

But now you can fly with hackers.

fapjacks2• 11 years ago

Heh, you're exactly right. I totally forgot about that. I'll be so cool!

CPLX• 11 years ago

I've been very confused about the really negative sniping responses to this program saying the miles aren't worth much.

A million frequent flier miles via a major alliance airline is a very, very sweet prize. That's enough for a person to fly themselves and their spouse to basically anywhere on the planet in business class five times, round trip.

icelancer2• 11 years ago

Business class international on Delta is far more than that. I know, I fly Delta first-class often enough and that's ~100k/roundtrip domestic. So that would be five first-class domestic flights for me and a partner at 1MM miles. Business class international? Might get one roundtrip flight between the two of us with some leftover miles for domestics.

driverdan• 11 years ago

That's because Delta SkyPesos suck.

SeoxyS3• 11 years ago

A UA saver award on business is 115k miles roundtrip international. You could fly from San Francisco to anywhere in Europe in business class and back for 115k miles + ~$10.

zitterbewegung• 11 years ago

I also don't understand the comments that you wouldn't like 1 Million miles from United and they are saying the miles don't matter. Everyone is saying "united is shit" because they don't like the service and not because of what is being discussed in the article.

ghaff3• 11 years ago

Depending upon saver vs. standard and the destination, it's probably not quite that good--but, still, two to three pairs of round-trip business class tickets, which isn't bad.

A good rule of thumb for the floor value of miles is a $0.01 per mile (i.e. a penny). From a value perspective, you usually get a better exchange for business and first. Of course, you may or may not normally pay for those upgraded seats if it were your own cash so imputing the actual value is difficult in that case.

psykovsky5• 11 years ago

A taxy costs you $1/mile minimum. If you think 1 cent per mile in an airline is a good exchange rate I have a bridge to sell you...

kriro• 11 years ago

Do you have to pay taxes on using the miles?

ghaff3• 11 years ago

Interesting question. The answer seems to be unclear. According to this article http://www.forbes.com/sites/kellyphillipserb/2014/08/28/tax-... miles given as "thank you points" can be taxable although there doesn't seem to be a definitive rule.

Previously the IRS more or less said that they weren't going to pursue any enforcement of frequent flyer miles obtained in the usual manner. http://www.journalofaccountancy.com/issues/2012/aug/20125796...

ubernostrum6• 11 years ago

There are small fees associated with redeeming miles on most US airlines.

British Airways is also notorious for applying "fuel surcharge" fees (payable in cash only) to mileage award tickets, running into the hundreds-of-dollars range when redeeming miles for business-class or first-class tickets.

strictnein• 11 years ago

According to another article I read, he had to supply UA with a W9, so the answer is likely yes.

kendallpark• 11 years ago

This is a fantastic idea. A great deal for both parties. Even if you have to fly United. If you're really that adverse to being in the air for a few hours on a United plane you can probably get use the miles for gifts. Get grandma a ticket to visit her grandchildren for her birthday or something.

jaybna• 11 years ago

What a honeypot. Anyone dumb enough to participate would have to fly United.

vonklaus• 11 years ago

What a honeypot.

How? They didn't dump a list of who is participating but Jordan Wiens was named and has a public profile and has published security research. I don't think black hat hackers are decloaking from tor to take a stab at some airline miles.

I wouldn't say the people are outright dumb; maybe they enjoy it and have a vacation lined up. Obviously, it isn't as financially rewarding as other BB programs, but outside of the compensation it doesn't seem overtly malicious. What rubs you the wrong way here?

misterbwong• 11 years ago

He's being sarcastic. It's a running joke among frequent fliers that flying United is almost punishment because they are so bad. So even though you get the miles, you actually have to actually fly on United

droopybuns2• 11 years ago

Offering miles limits the community of bounty hunters to locations served by united.

Paying out with miles is a fun idea, but the strategy seems fatally flawed to me.

JupiterMoon4• 11 years ago

But this far cheaper for United than offering cash rewards.

droopybuns2• 11 years ago

The lions share of bug bounty reporters are from overseas.

I can't even remember a single submission from an American in the bounty I'm involved with.

So in conclusion: if you limit yourself to just that audience, and tempt them with only miles, most americans who are competent enough to obtain bug bounty rewards are making enough money that miles is kind of a dubious incentive. So sure- you save money, but you get fewer submissions, and you get less return on investment than a bounty that pays out.

toddsiegel• 11 years ago

It's far cheaper, especially since miles are so hard to redeem. United has so few seats per plane for miles users that they are nearly worthless. I have hundreds of thousands of miles on United and can rarely ever use them for a flight I want unless I am willing to make 4 or 5 hops.

yinghang• 11 years ago

I think most people don't realize that UA is a part of the Star Alliance, and you can redeem amazing seats/suites on their partner airlines, ie Lufthansa, Singapore Airlines, Turkish Airlines, Thai Airways and Air Canada.

drallison• 11 years ago

The rules of the bug bounty program disallowed many of the usual red team approaches to finding possible exploits.

Attempting any of the following will result in permanent disqualification from the bug bounty program and possible criminal and/or legal investigation. We do not allow any actions that could negatively impact the experience on our websites, apps or online portals for other United customers.

    .. Brute-force attacks
    .. Code injection on live systems
    .. Disruption or denial-of-service attacks
    .. The compromise or testing of MileagePlus accounts that are not your own
    .. Any testing on aircraft or aircraft systems such as inflight entertainment or inflight Wi-Fi
    .. Any threats, attempts at coercion or extortion of United employees, Star Alliance member airline employees, other partner airline employees, or customers
    .. Physical attacks against United employees, Star Alliance member airline employees, other partner airline employees, or customers
    .. Vulnerability scans or automated scans on United servers (including scans using tools such as Acunetix, Core Impact or Nessus)

One can hope that the bad guys are similarly polite. And, as you would expect, the United security folks did not see the irony of their restrictions when it was pointed out to them.

jberryman• 11 years ago

Yeah. And they have a huge surface area of non-customer-facing and/or abandoned servers which are off limits. They should be more concerned with that than someone gaming their mileage program.

userbinator• 11 years ago

Any testing on aircraft or aircraft systems such as inflight entertainment or inflight Wi-Fi

I think this one and the "live system" one is due to legal regulations - they obviously do not want you to attempt to actually take control of a plane.

brandon272• 11 years ago

Inflight entertainment and wifi systems are airgapped from avionics. It would be impossible to take control of the plane.

svieira• 11 years ago

Lots of discussion about why that isn't possible (and other tangents) here [1]

  [1]: https://what.thedailywtf.com/t/plane-not-actually-commandeered-by-wi-fi-that-was-not-actually-hacked/47922

nraynaud2• 11 years ago

I guess it's a way to dip their toes into the waters, because for good safe pen testing they would need to mirror their infrastructure and make a system for testers to create accounts on demands, which necessitate work.

tptacek5• 11 years ago

These seem like pretty standard bug bounty terms. "Find bugs, but don't disrupt production systems trying to exploit them to find more".

The last bullet addresses a problem everyone has with bounties and scanners, which is that (a) they don't work and (b) they generate loads of bogus findings that the people who pirate the scanners then demand bounties for.

nowey• 11 years ago

Reminds me of the guy who found the starbucks gift card exploit and decided to test it live. That got him the lawsuit.

CyberDildonics2• 11 years ago

To me it reads as a list of vulnerabilities they are guaranteed not to find.

surge2• 11 years ago

Yeah, I don't understand why the bug bounty programs have you use the live site, and not say, a clone of said site on a sub-domain and isolated servers, with fake customer data and flights populated so you can just have at it.

arihant• 11 years ago

To me this list reads as:

1. Don't do attacks all systems are vulnerable to. (DDOS, Brute force)

2. Don't fuck with our customers.

3. Don't fuck with our employees.

Sounds very fair for a company with hundreds of people hanging in the middle of the air at any given point in time.

It is not an audit or internal code review. This is bug bounty program. If you get to a position from where you can directly or indirectly affect live systems, you should stop there and report.

jvehent• 11 years ago

I guess creating a bug bounty program is an easier way of pretenting that you care than actually fixing your broken TLS...

    $ ./cipherscan united.com
    prio  ciphersuite             protocols              pfs                 curves
    1     RC4-SHA                 TLSv1,TLSv1.1,TLSv1.2  None                None

psykovsky5• 11 years ago

How will the NSA/CIA get "unofficial" access to the travellers data if they step up their encryption?

saryant3• 11 years ago

Why would they need to get it from United when the government already has it through TSA SecureFlight?

nraynaud2• 11 years ago

that's a lot of broken guitars!

ajays• 11 years ago

FTA: United unveiled the approach in May just weeks before technological glitches grounded its entire fleet twice, underscoring the risks that airlines face.

Hmm, makes me wonder: could the glitches have been caused by some "hackers" doing testing?

X-Istence• 11 years ago

Supposedly the downtime was due to a routing issue:

https://www.reddit.com/r/networking/comments/3cme3b/a_route_...

CyberDildonics2• 11 years ago

If they really wanted to thank them they would have given them miles to a different airline.

United Airlines awards hackers millions of miles for revealing risks

Related Stories