13 ms·
United Airlines awards hackers millions of miles for revealing risks
- deleted 11y ago[deleted]
- adventured 11y ago"The cost can be less than hiring outside consultancies." It's probably ten times cheaper when you consider the per mile cost to the airline. United could hardly be getting a better deal.
- zamalek 11y agoAdditionally actual results are orders of magnitude cheaper. If you hire a consultant you still have to pay them even if they find nothing.
- draugadrotten 11y agoMaybe UA get a kick-back from the agencies as well, since flying (international) would give the agencies identities, photos, fingerprints and a right to search the luggage of interesting hackers.
- rmc 11y agoPretty sure the US Gov has access to US Passports.,
- JupiterMoon 11y agoYes. What they don't have access to (with 100% certainty) is the other part of the potential dataset -- i.e. lists of grey-hat hackers. (Again I doubt that this is actually an NSA backed scheme.)
- jon-wood 11y agoSorry that you're the one to get the brunt of this, but I'm really bored of the NSA snark on unrelated articles. Yes, we get that they've done some terrible things. No, they didn't set up UA's security disclosure problem in some sort of obscure conspiracy to get hold of hacker's passport numbers.
- JupiterMoon 11y agoOn balance I probably agree that this particular scheme is unlikely to be an NSA scheme. However, if we learned anything from Snowden it is err on the side of assuming that if it is possible then the NSA will eventually try to do it - and this definitely includes forcing US companies to act on their behalf. So post-Snowden the derogatory slur of "obscure conspiracy" doesn't carry so much weight.
- Tiksi 11y agoTaking a quick look at http://www.united.com/web/en-US/apps/mileageplus/awards/travel/awardTravel.aspx http://www.united.com/web/en-US/apps/mileageplus/awards/trav... it seems 1 million miles ~= $3000-$12000 depending on destination, date, etc. It doesn't seem all that bad of deal, except plenty of people don't fly often enough to even make use of this, and you have to fly united, which for me would kill all the value.
- notauser 11y agoYou can use United miles to buy tickets on Thai, Lufthansa and ANA, all of which are superb. (I used my last lot on two first class tickets to Tokyo which would have cost a lot more than $12k each if bought for cash.)
- Tiksi 11y agoWell then I suppose it might be worth it, I've had great experiences on Lufthansa the few times I've flown on it, one time the plane was entirely empty except for our group of 5 so we had a 747 to ourselves.
- jon-wood 11y agoI don't know if that's awesome or terrible. I can totally see the appeal of flying in an almost empty 747, but at least according to this source[1] that makes a truly shocking 1MPG between the five of you. I can't help thinking the world would be a bit better off if they'd just apologised, and put you on the next flight. [1] http://science.howstuffworks.com/transport/flight/modern/question192.htm http://science.howstuffworks.com/transport/flight/modern/que...
- benaiah 11y agoIf airlines could do so, they would. It’s very expensive to fly an empty plane. But those planes are on a tight and inflexible schedule - they’d be flying even if no one boarded the plane at all.
- 11y ago
- fapjacks 11y agoPhew. Talk about tying two cats together and stuffing them in a pillowcase. That's how I feel about flying United, free miles or no.
- CPLX 11y agoI've been very confused about the really negative sniping responses to this program saying the miles aren't worth much. A million frequent flier miles via a major alliance airline is a very, very sweet prize. That's enough for a person to fly themselves and their spouse to basically anywhere on the planet in business class five times, round trip.
- icelancer 11y agoBusiness class international on Delta is far more than that. I know, I fly Delta first-class often enough and that's ~100k/roundtrip domestic. So that would be five first-class domestic flights for me and a partner at 1MM miles. Business class international? Might get one roundtrip flight between the two of us with some leftover miles for domestics.
- driverdan 11y agoThat's because Delta SkyPesos suck.
- icelancer 11y agoThey all suck. It's a race to the bottom. Delta is at least upfront about it and their FF program IMO is overall the best (behind American) depending on your geographic location and actual desire to fly (and not run miles like your life depended on it).
- SeoxyS 11y agoA UA saver award on business is 115k miles roundtrip international. You could fly from San Francisco to anywhere in Europe in business class and back for 115k miles + ~$10.
- zitterbewegung 11y agoI also don't understand the comments that you wouldn't like 1 Million miles from United and they are saying the miles don't matter. Everyone is saying "united is shit" because they don't like the service and not because of what is being discussed in the article.
- kriro 11y agoDo you have to pay taxes on using the miles?
- ghaff 11y agoInteresting question. The answer seems to be unclear. According to this article http://www.forbes.com/sites/kellyphillipserb/2014/08/28/tax-court-sides-with-irs-in-tax-treatment-of-frequent-flyer-miles-issued-by-citibank/ http://www.forbes.com/sites/kellyphillipserb/2014/08/28/tax-... miles given as "thank you points" can be taxable although there doesn't seem to be a definitive rule. Previously the IRS more or less said that they weren't going to pursue any enforcement of frequent flyer miles obtained in the usual manner. http://www.journalofaccountancy.com/issues/2012/aug/20125796.html http://www.journalofaccountancy.com/issues/2012/aug/20125796...
- ubernostrum 11y agoThere are small fees associated with redeeming miles on most US airlines. British Airways is also notorious for applying "fuel surcharge" fees (payable in cash only) to mileage award tickets, running into the hundreds-of-dollars range when redeeming miles for business-class or first-class tickets.
- strictnein 11y agoAccording to another article I read, he had to supply UA with a W9, so the answer is likely yes.
- kendallpark 11y agoThis is a fantastic idea. A great deal for both parties. Even if you have to fly United. If you're really that adverse to being in the air for a few hours on a United plane you can probably get use the miles for gifts. Get grandma a ticket to visit her grandchildren for her birthday or something.
- jaybna 11y agoWhat a honeypot. Anyone dumb enough to participate would have to fly United.
- vonklaus 11y ago> What a honeypot. How? They didn't dump a list of who is participating but Jordan Wiens was named and has a public profile and has published security research. I don't think black hat hackers are decloaking from tor to take a stab at some airline miles. I wouldn't say the people are outright dumb; maybe they enjoy it and have a vacation lined up. Obviously, it isn't as financially rewarding as other BB programs, but outside of the compensation it doesn't seem overtly malicious. What rubs you the wrong way here?
- misterbwong 11y agoHe's being sarcastic. It's a running joke among frequent fliers that flying United is almost punishment because they are so bad. So even though you get the miles, you actually have to actually fly on United
- saryant 11y agoNot really. Frequent fliers know you can redeem United miles for flights on any *A carrier.
- droopybuns 11y agoOffering miles limits the community of bounty hunters to locations served by united. Paying out with miles is a fun idea, but the strategy seems fatally flawed to me.
- JupiterMoon 11y agoBut this far cheaper for United than offering cash rewards.
- droopybuns 11y agoThe lions share of bug bounty reporters are from overseas. I can't even remember a single submission from an American in the bounty I'm involved with. So in conclusion: if you limit yourself to just that audience, and tempt them with only miles, most americans who are competent enough to obtain bug bounty rewards are making enough money that miles is kind of a dubious incentive. So sure- you save money, but you get fewer submissions, and you get less return on investment than a bounty that pays out.
- JupiterMoon 11y agoBUT you get the great publicity of being one of the forward thinking companies that does bug bounties. Anecdotally many non-programmer people are starting to understand that bug bounty = good.
- saryant 11y agoYou can redeem with Star Alliance, which serves 193 countries (i.e., almost everywhere).
- toddsiegel 11y agoIt's far cheaper, especially since miles are so hard to redeem. United has so few seats per plane for miles users that they are nearly worthless. I have hundreds of thousands of miles on United and can rarely ever use them for a flight I want unless I am willing to make 4 or 5 hops.
- 11y ago
- drallison 11y agoThe rules of the bug bounty program disallowed many of the usual red team approaches to finding possible exploits. Attempting any of the following will result in permanent disqualification from the bug bounty program and possible criminal and/or legal investigation. We do not allow any actions that could negatively impact the experience on our websites, apps or online portals for other United customers. .. Brute-force attacks .. Code injection on live systems .. Disruption or denial-of-service attacks .. The compromise or testing of MileagePlus accounts that are not your own .. Any testing on aircraft or aircraft systems such as inflight entertainment or inflight Wi-Fi .. Any threats, attempts at coercion or extortion of United employees, Star Alliance member airline employees, other partner airline employees, or customers .. Physical attacks against United employees, Star Alliance member airline employees, other partner airline employees, or customers .. Vulnerability scans or automated scans on United servers (including scans using tools such as Acunetix, Core Impact or Nessus) One can hope that the bad guys are similarly polite. And, as you would expect, the United security folks did not see the irony of their restrictions when it was pointed out to them.
- jberryman 11y agoYeah. And they have a huge surface area of non-customer-facing and/or abandoned servers which are off limits. They should be more concerned with that than someone gaming their mileage program.
- userbinator 11y agoAny testing on aircraft or aircraft systems such as inflight entertainment or inflight Wi-Fi I think this one and the "live system" one is due to legal regulations - they obviously do not want you to attempt to actually take control of a plane.
- brandon272 11y agoInflight entertainment and wifi systems are airgapped from avionics. It would be impossible to take control of the plane.
- jvehent 11y agoI guess creating a bug bounty program is an easier way of pretenting that you care than actually fixing your broken TLS... $ ./cipherscan united.com prio ciphersuite protocols pfs curves 1 RC4-SHA TLSv1,TLSv1.1,TLSv1.2 None None
- psykovsky 11y agoHow will the NSA/CIA get "unofficial" access to the travellers data if they step up their encryption?
- saryant 11y agoWhy would they need to get it from United when the government already has it through TSA SecureFlight?
- geofft 11y agoI love how everyone is focused on the NSA and CIA as threats, to the exclusion of all other possible threats. If the US government wants to steal my credit card number, they can just tax me, that's a legitimate power they have. If they want to stop me from going somewhere, they can just arrest me at the TSA checkpoint. Setting up a MITM and breaking TLS, while possible, is way too much effort to gain something they can already gain in a perfectly straightforward way. It's like killing ants on the White House lawn by poisoning them via fracking. The threat model for bugs in United is primarily non-governmental thieves.
- psykovsky 11y agoWhat you said doesn't invalidate what I said. Are the intelligence agencies allowed to have that data at all? Because if they aren't they will try and get it using unofficial channels.
- nraynaud 11y agothat's a lot of broken guitars!
- ajays 11y agoFTA: United unveiled the approach in May just weeks before technological glitches grounded its entire fleet twice, underscoring the risks that airlines face. Hmm, makes me wonder: could the glitches have been caused by some "hackers" doing testing?
- X-Istence 11y agoSupposedly the downtime was due to a routing issue: https://www.reddit.com/r/networking/comments/3cme3b/a_route_leaking_misconfig_took_united_airlines/ https://www.reddit.com/r/networking/comments/3cme3b/a_route_...
- CyberDildonics 11y agoIf they really wanted to thank them they would have given them miles to a different airline.