United Airlines bug bounty program | Hacker News Reader

United Airlines bug bounty program

united.com

36 pointsadamnemecek45 comments

Paid in United miles? Not really an incentive there.

I see you're familiar with flying United :)

I appears someone still flied United. Who knew.

Not only that, but: "Award miles offered under this Program are not Premier® qualifying miles." So you don't even get the free checked bag and priority check-in that those miles would otherwise entitle you to.

United's checked bag fees don't actually matter since you'll most likely be refunded as their standard operating procedure is to delay your bag for a week if they can ship freight instead.

Agreed. They should be award miles that allow for PQM accrual. Or make them all PQM. That way someone could get gold for life (plus spouse) for a code execution exploit.

Even if you got the PQMs, you'd still need the dollars to get the status. So it's not that helpful, is it?

But the top prize is one million miles, which would get you lifetime status. Delta and United don't (yet) have spend requirements for lifetime status, AFAIK.

Conferring lifetime status isn't necessarily even that expensive to the airline--you only get the benefits after you give the airline your money for tickets. It also creates an incentives to buy tickets on one particular airline, even when they might be slightly more expensive (which is the whole purpose of frequent flier CRM programs).

Yep, exactly. If they were 1mil PQM or 1mil BIS you'd hit million miler and get gold for life. Gold, which only kicks in when you actually fly (like you pointed out).

I fly United about 70 times per year. I use them all the time. And yet, understanding the myriad of acronyms is just plainly annoying. Also, their program is getting worse year after year, including arbitrary inflation of your miles in the order of 50-70% each 18-24 months.

And United just limited how you can use reward miles. It used to be that your status would pass on too the passenger. So I'd fly my mom or sister, and they'd get checked bags, lounge, priority access, etc.

Now they no longer do that. So it makes the miles far less useful. And, since it doesn't apply to GS, all the other premiers still get screwed by this change. So it's not like it's gonna improve premier status for the rest of us anyways.

Ranty anecdote: Oh and they don't even respect what their ticketing and policies on this state. It was that any such ticket booked before 15 Apr would use the old rules, and indeed the baggage calculator would show that. Sent my sister somewhere, counting on some big bags to bring equipment. GA starts making a fuss, saying no, made her unpack and so on. Even after calling United and being assured she'd be treated properly on the return flight, nope, still not handled correctly and made to pay extra. United's IT is terrible. That's why we call their site ".bomb".

And, a farcically low payout for otherwise very expensive consulting work from highly skilled people.

Compared to other bug bounties it isn't bad at all. Airline miles are generally valued at around a penny a mile, so $500 for XSS, $2500 for an auth bypass, $10000 for code exec isn't all that bad.

A thing that people who have never run bug bounties before: Many of your submissions come from overseas. If your submitters can't profit, they won't submit.

UA needs to get their shit together.

Robert Crandall claimed that "no airline has ever made back its cost in capital."

(quotes as delimiters; I can't find the exact quote )

Yeah and who would ever want to use United for international anyways?

Don't United miles also expire.

"Bugs that are eligible for submission: ... The ability to brute-force reservations, MileagePlus numbers, PINs or passwords"

"Do not attempt: ... Brute-force attacks"

This seems contradictory. I assume the intent is to not allow DoS attacks (although they call that out separately further down the list)?

Not exactly.

Seems they're saying they'd accept a bug that can be caused by brute-force, but do not actually attempt a brute force yourself.

But yeah I'd guess they don't want intentionally invite a bunch of people to DoS the site.

Another interpretation is that, if you discover something similar to what Weev discovered, do not do what Weev did.

"Bugs on onboard Wi-Fi, entertainment systems or avionics" are not eligible for bounties.

It's very strange to see website timing attacks as worth rewarding, but not avionics. Perhaps they'd rather not incentivize people to attack airplanes in flight?

I'm pretty sure that's the reason. While identifying vulnerabilities in the actual airplane is high-value, it's also high-risk. Even the most cautious researcher can easily affect a system being investigated, which is potentially financially costly for a website and potentially fatal for an airplane in the air.

Yes, I am pretty sure it is a safety thing. That would be very dangerous to encourage people to try to hack a flight in the air.

It would be a good idea to provide access to that sort of equipment on the ground. Bugs that can lead to loss of life should be of much higher priority than bugs that can merely lead to loss of profit on a web site.

Though the avionics industry would obviously balk at the proposition, those systems are already spectacularly vulnerable, and they'd hate to lose face.

"...those systems are already spectacularly vulnerable..."

Absolutely untrue, unless you have physical access to them (at which point any system is vulnerable). In truth, the maintenance port on a 787, for example, (which is the only place you could feasibly get the kind of access you'd need to even attempt an exploit) is located in the avionics bay. At the point that an unauthorized party has gained access to the avionics bay, you've got a much bigger problem than software exploits.

If you're referring the Chris Roberts' dubious "Planes, Trains, and Automobiles" grrcon talk ... well, I'm sorry, but claiming that you've "made friends <giggle>" with an airplane doesn't seem very substantive to me.

Avionics code is some of the most extensively tested code in the world, with 100% statement and decision coverage, 100% requirements test coverage, extensive robustness testing, and somewhere between a handful and hundreds of eyes having reviewed every single line (depending on criticality level). Additionally, design constraints are followed for high criticality software that simply eliminate many types of attacks - no dynamic allocation, mathematically provable static stack analysis, etc. etc. etc. (get yourself a copy of DO-178B and read it if you really want to know all the details). I would bet a significant amount of money that the defect rate per N lines of code in avionics software is probably substantially lower than almost all other commercial software. There's also the fact that on modern aircraft using Ethernet based networks, message routing and authentication are implemented in both hardware and software at multiple layers by independent teams, which greatly reduces the chances of a common fault that allows a successful attack (even if you could gain physical access to the network).

As much as I agree with the comments below/above about it being a safety issue, I would argue it is possible that a contributing factor is in flight WiFi being so flakey that it would be too expensive to run the program on this asset.

My guess is wifi and entertainment are excluded because United doesn't build those. Depending on the aircraft they're provided by Panasonic, LiveTV, etc. in the case of LiveTV (United's vendor for DirecTV) it's even seller-financed.

United probably isn't interested in paying for someone else's bugs.

Access to the media for futzing with the avionics better be very [expletive deleted]ing hard to get.

Exactly what you'd expect from an airline:

"Bugs or potential Bugs you discover may not at any time be disclosed publicly or to a third-party. Doing so will disqualify you from receiving award miles."

It's as if it was designed in the same spirit as a frequent flyer program -- really stingy payout, with lots of strings attached. I can't see how this can incentivise anyone to do free penetration-testing for them.

Is having rude stewardesses and planes that are never on time bugs? Is grouping two flights into one flight number to deceive people into buying 3 stop international flights a bug? If so please pay me in minimal airline miles which I can then use to waste more of my time on the shittiest airline in the world.

I'm not a hacker - how much should you normally get paid for a low/medium/high bug? 50k points ~= $1500; 250k points ~= $7500; 1m points ~= $30k.

A lot more if you redeem for int'l biz/first class...

3 cents per mile seems like a pretty high valuation to me. I usually use 1.5 cpm. You can do better, as you mentioned, but this is a good EV for me.

True.

Another gem in the ToS: "You are responsible for any tax implications that apply based on your country of residency and citizenship."

I know miles earned from credit cards are not taxed, but I do know for a fact that Citibank sends out a 1099 for new checking accounts that come with bonus miles.

If United sends you a 1099 based on the market value of a mile (likely between 2-3 cents each), then you're looking at non-trivial tax implications as well.

United doesn't send out 1099s.

It's not crazy, though. I was just looking at SFO-TXL round-trips in business. 115k miles… instead of $8k. Values the miles at around 7c/mile.

I made a calculator to answer the question: should I pay cash or spend miles. I set the "good value" threshold at 2c/mile: https://kballenegger.github.io/miles-or-cash/

If they actually cared about their site they would go back to the old united.com, not the crappy one Continental brought with them in the merger.

I would have been a lifeline customer, but Continental ruined it.

They're currently beta testing a new (more modern) site: https://beta.united.com/ual/en/us/

I like Virgin's https://www.virginamerica.com/ way more than even their beta one. I guess they're going for different demographics.

The Continental website isn't pretty but it's very functional. Old United's site was called united.bomb for a reason.

There is always beta.united.com.

Yeah how hard is it to just let us select meals before boarding? Instead of running out of the better meal and pissing off high revenue customers. Even AA gets this right.

"Code injection on live systems" is not allowed? what does this even mean?

If I put ?param=' and it crashes with an SQL error have I performed code injection on a live system?

Well in that case they'd presumably have a log and they would see no suspicious payload.

I think this idea of bounty programs even among non-tech companies will continue to grow. I recently wrote about this in-depth as a solution to many of the online security problems: http://mytwoandahalfcents.com/prevent-enterprise-security-br...

Where is their PGP key?

Reply on news.ycombinator.com