5 ms·
The rules of the bug bounty program disallowed many of the usual red team approaches to finding possible exploits. Attempting any of the following will result
by drallison 11y ago
The rules of the bug bounty program disallowed many of the usual red team approaches to finding possible exploits.
Attempting any of the following will result in permanent disqualification from the bug bounty program and possible criminal and/or legal investigation. We do not allow any actions that could negatively impact the experience on our websites, apps or online portals for other United customers.
.. Brute-force attacks
.. Code injection on live systems
.. Disruption or denial-of-service attacks
.. The compromise or testing of MileagePlus accounts that are not your own
.. Any testing on aircraft or aircraft systems such as inflight entertainment or inflight Wi-Fi
.. Any threats, attempts at coercion or extortion of United employees, Star Alliance member airline employees, other partner airline employees, or customers
.. Physical attacks against United employees, Star Alliance member airline employees, other partner airline employees, or customers
.. Vulnerability scans or automated scans on United servers (including scans using tools such as Acunetix, Core Impact or Nessus)
One can hope that the bad guys are similarly polite. And, as you would expect, the United security folks did not see the irony of their restrictions when it was pointed out to them.
- jberryman 11y agoYeah. And they have a huge surface area of non-customer-facing and/or abandoned servers which are off limits. They should be more concerned with that than someone gaming their mileage program.
- userbinator 11y agoAny testing on aircraft or aircraft systems such as inflight entertainment or inflight Wi-Fi I think this one and the "live system" one is due to legal regulations - they obviously do not want you to attempt to actually take control of a plane.
- brandon272 11y agoInflight entertainment and wifi systems are airgapped from avionics. It would be impossible to take control of the plane.
- TeMPOraL 11y agoGive me a million dollars and a Get Out of Jail Free card and I'll show you it's perfectly possible. If anything security teaches us, it's that everything is vulnerable if the attacker is determined enough.
- cmdrfred 11y agoI just plugged in my raspberry pi. It is air gapped and has no internet connection. Connect to it via SSH and I will be your personal servant for the rest of my life.
- evan_ 11y agoHack the inflight entertainment to display a scary action-movie ransom notice on every monitor in the cabin and see if you can't get the plane to go where you want.
- svieira 11y agoLots of discussion about why that isn't possible (and other tangents) here [1] [1]: https://what.thedailywtf.com/t/plane-not-actually-commandeered-by-wi-fi-that-was-not-actually-hacked/47922
- tptacek 11y agoI think the "hack the plane through IFE" thing is nonsense but it still seems negligent to encourage people to try to break the electronics on a plane in the air, which is exactly what a bug bounty that qualifies findings in the IFE does. Something to remember about every company that offers a bounty: they aren't just offering to pay for findings, but also implicitly granting permission to attack them, waiving many of their rights in the process. It makes sense that an airline would do that carefully.
- deleted 11y ago[deleted]
- nraynaud 11y agoI guess it's a way to dip their toes into the waters, because for good safe pen testing they would need to mirror their infrastructure and make a system for testers to create accounts on demands, which necessitate work.
- tptacek 11y agoThese seem like pretty standard bug bounty terms. "Find bugs, but don't disrupt production systems trying to exploit them to find more". The last bullet addresses a problem everyone has with bounties and scanners, which is that (a) they don't work and (b) they generate loads of bogus findings that the people who pirate the scanners then demand bounties for.
- nowey 11y agoReminds me of the guy who found the starbucks gift card exploit and decided to test it live. That got him the lawsuit.
- psykovsky 11y agoOnly way to be sure it exists is to test it live.
- tptacek 11y agoThat is rarely true, and also besides the point: if you report the flaw and they acknowledge it, what does verification matter?
- lojack 11y agoNot only did he test it live, but he used the gift card to purchase items. Could have easily walked in and checked the balance without purchasing anything.
- an_ko 11y agoTo be fair, his purchase was relatively inexpensive, did not significantly disrupt other customers or otherwise compromise the system, and served to test that the balance was actually available, not just displayed. Just deduct the price of the sandwiches from the bounty reward?
- jjarmoc 11y agoHe never 'got a lawsuit.' Instead, he got some comments from the contact to whom he reported it that criticized his approach. It's not even clear just who this person was. It seems he had trouble locating a contact to report security issues to, so this may as well have just been a low level support rep who was in over his head and saying things he shouldn't have. "The hardest part - responsible disclosure. Support guy honestly answered there’s absolutely no way to get in touch with technical department and he’s sorry I feel this way. Emailing InformationSecurityServices@starbucks.com on March 23 was futile (and it only was answered on Apr 29). After trying really hard to find anyone who cares, I managed to get this bug fixed in like 10 days. The unpleasant part is a guy from Starbucks calling me with nothing like “thanks” but mentioning “fraud” and “malicious actions” instead. Sweet!" http://sakurity.com/blog/2015/05/21/starbucks.html http://sakurity.com/blog/2015/05/21/starbucks.html
- arihant 11y agoTo me this list reads as: 1. Don't do attacks all systems are vulnerable to. (DDOS, Brute force) 2. Don't fuck with our customers. 3. Don't fuck with our employees. Sounds very fair for a company with hundreds of people hanging in the middle of the air at any given point in time. It is not an audit or internal code review. This is bug bounty program. If you get to a position from where you can directly or indirectly affect live systems, you should stop there and report.