8 ms·

Uber Engineering Bug Bounty: The Treasure Map

189 points by myhrvold 11y ago

Shamiq 11y ago
I would love a Marauder's Map for bug bounty programs: Show me who is working on what, where they're finding bugs, and help me identify where I can most efficiently spend my time. Lots of 'feel bads' if I report a bug that's already been reported, and thus don't get a payout.
- brebla 11y ago
  I am currently working on bug discovery for every big company. You should probably stay away to avoid feel bads.
  - Shamiq 11y ago
    oh, i know -- i got spoiled working at matasano where we'd usually get the first crack.
- nefitty 11y ago
  Maybe you could set up a public Slack room to discuss? I'm not involved in the bounty but it seems like a reasonable way to organize. Utilizing the search people could figure out whether anyone is working on what they're planning to do.
  - Shamiq 11y ago
    That could be a decent hack to get started. Ideally, I'd like for it to be a feature of hackerone et al, assuming security@ as a service providers become the point of interaction with the external security community.
jwcrux 11y ago
There are a ton of bug bounties nowadays, but it's a nice change of pace to have a company give some data on backend stack, subdomains, and purpose of the services up front. Great move on Uber's part!
mcintyre1994 11y ago
As someone whose not really familiar with Uber except at a high level overview kind of way, does anyone know their reasoning behind not wanting a path from email to uuid as a unique concern to them?
- jon-wood 11y ago
  My guess is that they're trying to avoid people who've acquired a list of email addresses being able to trivially work out which of those addresses have Uber accounts. With that information one could target only those accounts with phishing attacks and the like with potentially fewer people flagging those emails as suspicious.
IanCal 11y ago
Having descriptions of all the various services is great. Something I couldn't see here is that while you ask for bugs related to a variety of accounts, are there ways of creating such accounts? I can fairly easily ensure I don't poke at the normal user account of someone else, but what about drivers/businesses/etc? More generally for HNers, are there common ways of dealing with this? Do people try and run parallel stacks that don't contain real info? Or do devs setup fake accounts? I'm not in this business so apologies if I'm missing something really obvious.
- nabaraz 11y ago
  I sent an email to Uber about this. Other companies like facebook, xbox have a way to create test accounts.
- Joool 11y ago
  From there hackerone-page: Do you provide test accounts? As of this time we do not have a good system for creating test accounts for our bug bounty submitters. Please create an account as you would normally and perform testing with that account. https://hackerone.com/uber https://hackerone.com/uber
meritt 11y ago
The going rate for critical bounties is way too small. It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of their user's information. Just earlier this month Facebook rewarded a paltry $15k for a bug that could unlock any user's account. That sort of information in the wrong hands or resulting in a massive PII leak will cause a few orders of magnitude higher in damage to their market cap and goodwill. And I say this from personal experience. Two years ago I submitted a bug to a $10B+ public company which revealed the personal information (email, name, home address, phone) of ~145M users and they offered $10k. Another recent example to a $50B+ public company via HackerOne that exposed the same sort of data for ~77M users. They paid out $1k. I assumed they had left off a 0, but nope, they actually told me $1k was higher than their normal bounty due to the severity. Submitted a bug to a publicly traded food delivery company in the UK, which revealed detail order history (customer name, address, email, phone, partial CC #) for their entire platform. They offered me £500 in food delivery credit. All of my submissions have been purely in good faith and nothing at all resembling extortion, but I assure you there are thousands of bad actors out there far more skilled than I. And there's plenty of legal outlets for this information (depending on how it is accessed of course). Local governments and Lyft would love to know ridership usage details about Uber.
- yeukhon 11y ago
  I always think people should get a full time position rather than earning money through bounty as a full time job. When I have time, I do play with bounty and if I am lucky I can make extra dollars. I earned one big one, but in the second one the company did not honor the payment at all, but I was cool enough to let that shit go despite what I found was critical enough to destroy their product launch that night (basically elementary web vulnerability). Your statements are going to be attacked by the usual "you don't know shit, we have argued about this ten million times here on HN." Companies are not going to reward you with $1M (think about Instagram's 1M bug [0]). While you can't really sell this to the blackmarket and expect to overload people's credit card, this is still a P1 incident and requires a major bounty reward. I am not going to discuss about what happened in this case, but even if he did get paid he wouldn't be getting 1M. The reason is simple: there are a lot more people willing to play this game and many believe being on some Hall of Frame is a great addition to their security professional resume. [0]: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194
alpb 11y ago
"What to look for" part sort of did not make any sense. If the security engineers at Uber has a sense of where the vulnerabilities might come from, they might as well seek those themselves. I don't think anybody would say "oh yeah we were expecting some security bug to arise from this code". I thought the point of security issues is, they show up from places where you wouldn't even expect. I might be wrong.
- ascorbic 11y ago
  I took more as them saying "these are the things we really don't want to have bugs, so if you find them we'll pay well"
whitehat2k9 11y ago
Laying out all their services and telling you what each runs on...ballsy. It's the electronic equivalent of telling strangers where you live and who built the house.
- tyrust 11y ago
  Security through obscurity will not get you very far. This map just removes that false protection and potentially gets more bug hunters' eyes on their services.
greggman 11y ago
How about UX bugs Like: 1. Messages to drivers are apparently not through uber? It seems like sending a message to a driver happens through SMS rather than through uber itself. This seems to result in driver not seeing message. Had that happen twice yesterday. Told driver exactly where I was. Driver gets lost and calls me and from conversion it's clear he never read the message. 2. Can't change your pick up point. Ran into this yesterday. Was waiting near corner of franklin and market on market on the outbound side wanting to go to sunset area. Guy doesn't read message which specifically said turn right on market (he was on Page that lets you turn right onto market). Instead he crossed market which at that point I had to cancel the ride because it would have been another 10 minutes for him to drive the 10+ blocks to correct his mistake That led to getting driver #2. He was coming down Gough so in the interest of making it easier for both of us I walked up to Gough. I wasn't able to change my pickup location. I messaged him that I had moved to gough and market. He called when he got to franklin and market making it clear he didn't get my message.
- Yhippa 11y ago
  Their back-end switched my account with someone in London. They were able to charge trips to my account! Customer service wasn't exactly helpful either.
- csallen 11y ago
  It's nuts to me that drivers (presumably) can't see your current location the same way that you can see theirs.
  - malka 11y ago
    might be a legal issue.
    - andreasklinger 11y ago
      if a good reason might be that they are technically prearranged rides - a prearranged ride has a defined location as start point
  - 11y ago
pogilvie 11y ago
So the first 'season' of the bug bounty is 90 days long, and to qualify for payment you need to find 4 bugs before you can be eligible for payment? That seems initially quite off putting.
- christoph 11y ago
  I had to read that part twice as well. It seems that it's in addition to whatever they are offering 'per bug' - you basically get a 10% bonus on the average of everyone else's payouts. So for example: Bug 1 - $2k Bug 2 - $3k Bug 3 - $6k Bug 4 - $1.5k Bug 5 - $2k + 10% of total commuity average payout as bonus
  - pogilvie 11y ago
    Yeah I've looked around and can't quite follow it.. The rest of what they have set out is really interesting though.
iamleppert 11y ago
Only $10k for a remote code execution bug?
jasonjei 11y ago
It shows quite a bit of wisdom that they've acknowledged the internal undocumented mobile API to be the greatest surface area for attacks. Even if they are certificate pinning, aren't there jailbreak ways to disable that?
jon-wood 11y ago
As an almost complete beginner how would I get to the point of being able to consistently find security issues where they exist? I've got enough experience as a developer to avoid the most common vulnerabilities, but I don't really know how I'd go about approaching things from the other direction to surface potentially undiscovered issues.

189 points by myhrvold 11y ago

I would love a Marauder's Map for bug bounty programs: Show me who is working on what, where they're finding bugs, and help me identify where I can most efficiently spend my time. Lots of 'feel bads' if I report a bug that's already been reported, and thus don't get a payout.

brebla 11y ago
I am currently working on bug discovery for every big company. You should probably stay away to avoid feel bads.
- Shamiq 11y ago
  oh, i know -- i got spoiled working at matasano where we'd usually get the first crack.
nefitty 11y ago
Maybe you could set up a public Slack room to discuss? I'm not involved in the bounty but it seems like a reasonable way to organize. Utilizing the search people could figure out whether anyone is working on what they're planning to do.
- Shamiq 11y ago
  That could be a decent hack to get started. Ideally, I'd like for it to be a feature of hackerone et al, assuming security@ as a service providers become the point of interaction with the external security community.

jwcrux 11y ago

There are a ton of bug bounties nowadays, but it's a nice change of pace to have a company give some data on backend stack, subdomains, and purpose of the services up front. Great move on Uber's part!

mcintyre1994 11y ago

As someone whose not really familiar with Uber except at a high level overview kind of way, does anyone know their reasoning behind not wanting a path from email to uuid as a unique concern to them?

jon-wood 11y ago
My guess is that they're trying to avoid people who've acquired a list of email addresses being able to trivially work out which of those addresses have Uber accounts. With that information one could target only those accounts with phishing attacks and the like with potentially fewer people flagging those emails as suspicious.

IanCal 11y ago

Having descriptions of all the various services is great. Something I couldn't see here is that while you ask for bugs related to a variety of accounts, are there ways of creating such accounts? I can fairly easily ensure I don't poke at the normal user account of someone else, but what about drivers/businesses/etc? More generally for HNers, are there common ways of dealing with this? Do people try and run parallel stacks that don't contain real info? Or do devs setup fake accounts? I'm not in this business so apologies if I'm missing something really obvious.

nabaraz 11y ago
I sent an email to Uber about this. Other companies like facebook, xbox have a way to create test accounts.
Joool 11y ago
From there hackerone-page: Do you provide test accounts? As of this time we do not have a good system for creating test accounts for our bug bounty submitters. Please create an account as you would normally and perform testing with that account. https://hackerone.com/uber https://hackerone.com/uber

meritt 11y ago

The going rate for critical bounties is way too small. It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of their user's information. Just earlier this month Facebook rewarded a paltry $15k for a bug that could unlock any user's account. That sort of information in the wrong hands or resulting in a massive PII leak will cause a few orders of magnitude higher in damage to their market cap and goodwill. And I say this from personal experience. Two years ago I submitted a bug to a $10B+ public company which revealed the personal information (email, name, home address, phone) of ~145M users and they offered $10k. Another recent example to a $50B+ public company via HackerOne that exposed the same sort of data for ~77M users. They paid out $1k. I assumed they had left off a 0, but nope, they actually told me $1k was higher than their normal bounty due to the severity. Submitted a bug to a publicly traded food delivery company in the UK, which revealed detail order history (customer name, address, email, phone, partial CC #) for their entire platform. They offered me £500 in food delivery credit. All of my submissions have been purely in good faith and nothing at all resembling extortion, but I assure you there are thousands of bad actors out there far more skilled than I. And there's plenty of legal outlets for this information (depending on how it is accessed of course). Local governments and Lyft would love to know ridership usage details about Uber.

yeukhon 11y ago
I always think people should get a full time position rather than earning money through bounty as a full time job. When I have time, I do play with bounty and if I am lucky I can make extra dollars. I earned one big one, but in the second one the company did not honor the payment at all, but I was cool enough to let that shit go despite what I found was critical enough to destroy their product launch that night (basically elementary web vulnerability). Your statements are going to be attacked by the usual "you don't know shit, we have argued about this ten million times here on HN." Companies are not going to reward you with $1M (think about Instagram's 1M bug [0]). While you can't really sell this to the blackmarket and expect to overload people's credit card, this is still a P1 incident and requires a major bounty reward. I am not going to discuss about what happened in this case, but even if he did get paid he wouldn't be getting 1M. The reason is simple: there are a lot more people willing to play this game and many believe being on some Hall of Frame is a great addition to their security professional resume. [0]: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194

alpb 11y ago

"What to look for" part sort of did not make any sense. If the security engineers at Uber has a sense of where the vulnerabilities might come from, they might as well seek those themselves. I don't think anybody would say "oh yeah we were expecting some security bug to arise from this code". I thought the point of security issues is, they show up from places where you wouldn't even expect. I might be wrong.

ascorbic 11y ago
I took more as them saying "these are the things we really don't want to have bugs, so if you find them we'll pay well"

whitehat2k9 11y ago

Laying out all their services and telling you what each runs on...ballsy. It's the electronic equivalent of telling strangers where you live and who built the house.

tyrust 11y ago
Security through obscurity will not get you very far. This map just removes that false protection and potentially gets more bug hunters' eyes on their services.

greggman 11y ago

How about UX bugs Like: 1. Messages to drivers are apparently not through uber? It seems like sending a message to a driver happens through SMS rather than through uber itself. This seems to result in driver not seeing message. Had that happen twice yesterday. Told driver exactly where I was. Driver gets lost and calls me and from conversion it's clear he never read the message. 2. Can't change your pick up point. Ran into this yesterday. Was waiting near corner of franklin and market on market on the outbound side wanting to go to sunset area. Guy doesn't read message which specifically said turn right on market (he was on Page that lets you turn right onto market). Instead he crossed market which at that point I had to cancel the ride because it would have been another 10 minutes for him to drive the 10+ blocks to correct his mistake That led to getting driver #2. He was coming down Gough so in the interest of making it easier for both of us I walked up to Gough. I wasn't able to change my pickup location. I messaged him that I had moved to gough and market. He called when he got to franklin and market making it clear he didn't get my message.

Yhippa 11y ago
Their back-end switched my account with someone in London. They were able to charge trips to my account! Customer service wasn't exactly helpful either.
csallen 11y ago
It's nuts to me that drivers (presumably) can't see your current location the same way that you can see theirs.
- malka 11y ago
  might be a legal issue.
  - andreasklinger 11y ago
    if a good reason might be that they are technically prearranged rides - a prearranged ride has a defined location as start point
- 11y ago

pogilvie 11y ago

So the first 'season' of the bug bounty is 90 days long, and to qualify for payment you need to find 4 bugs before you can be eligible for payment? That seems initially quite off putting.

christoph 11y ago
I had to read that part twice as well. It seems that it's in addition to whatever they are offering 'per bug' - you basically get a 10% bonus on the average of everyone else's payouts. So for example: Bug 1 - $2k Bug 2 - $3k Bug 3 - $6k Bug 4 - $1.5k Bug 5 - $2k + 10% of total commuity average payout as bonus
- pogilvie 11y ago
  Yeah I've looked around and can't quite follow it.. The rest of what they have set out is really interesting though.

iamleppert 11y ago

Only $10k for a remote code execution bug?

jasonjei 11y ago

It shows quite a bit of wisdom that they've acknowledged the internal undocumented mobile API to be the greatest surface area for attacks. Even if they are certificate pinning, aren't there jailbreak ways to disable that?

jon-wood 11y ago

As an almost complete beginner how would I get to the point of being able to consistently find security issues where they exist? I've got enough experience as a developer to avoid the most common vulnerabilities, but I don't really know how I'd go about approaching things from the other direction to surface potentially undiscovered issues.