Slashdot Mirror
United Airlines Invites Hackers To Find Security Vulnerabilities
An anonymous reader writes: Following a recent spike of interest regarding the potential to hack planes, United Airlines has created the first rewards-for-exploits scheme in the aviation industry. The 'Bug-Bounty' program offers up to a million air miles for submitters who find a specific range of exploits in the company's websites and digital infrastructure. The scheme not only bans participants from probing on-board flight systems but threatens criminal prosecution for any such attempt.
I will make reservations to Paris for two.
Then go visit Dr. Falkin.
This is my opinion based on what little I know and understand of the rumors and lies Thanks, Randal
sounds odd they place the rule of no scanning of their network.
how is anyone suppose to find out what the structure is without probing
They explicitly state brute-force attacks are not allowed and will "result in permanent disqualification from the bug bounty program and possible criminal and/or legal investigation"... then, the following section clearly states a 250,000 mile reward for discovering a brute-force attack. wtf.
I've got all the points and arse ache I need.
I want a status upgrade. PQMs or go away.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
...I would've thought that fact alone would be enough to discourage anyone (who's not actually suicidal) from stuffing around with onboard systems.
After all, if you win air miles, aren't you and/or friends & family that much more likely to be onboard when a hacked system goes titsup?
Or am I giving the average hacker too much credit for common sense?
Translation: We can't afford (read: won't pay) for real security personnel, so we'll let strangers do it on a dare and not even to any interesting assets like a fucking plane! No, just hack our shitty web site and we'll offer you some "free miles" that will be highly restricted and next to worthless, but don't fear, wherever you end up going will be a horrible journey filled with ignorant TSA agents frisking your panties and smelling your shoes and then if your fucking pilot decides NOT to crash the plane into a building or a mountain you might end up killing yourself at your destination rather than face the social rape that is modern air travel.
This is the NSA, we're gonna geet U h@x0r5! Also, what is a h@x0r5?
So, who's gonna be the one to show them the seating layout bug that keeps taking an inch off of all dimensions of airliner seats every year?
I see a certain logic fail here.
Have gnu, will travel.
they won't pay. not even in miles.
"Investigation of actual on-board systems, including in-flight entertainment systems, is banned from the scheme, and United promises additionally to subject anyone who attempts such probing to criminal prosecution."
We'll let you play with our web site as much as you want if you'll stop poking around the actual planes.
United is a pretty crappy company, I assume someone new came up with this idea. Damn uppity fool, United will eat your soul!
Not only is there no prize, you get to pay 100 grand when you win!
one billion dollar bounty for anyone who can pass through solid wall without looking for or making a door.
" The scheme not only bans participants from probing on-board flight systems but threatens criminal prosecution for any such attempt. "
but THAT!!! is the easiest way IN!!!!
Head in the sand will never work out well !!!
"I don't pitch OpenSUSE Linux to my friends, i let Microsoft do it for me
What do these numbers translate to roughly, a million flyer miles.
$100-$200?
First Rule of United Airlines Hack Club is that you don't tweet about United Airlines Hack Club Second Rule of United Airlines Hack Club is that you don't tweet about United Airlines Hack Club If you tweet about it we're gonna call the FBI
I'm sick of companies putting out prizes to get work done instead of actually hiring people.
What it amounts to is getting thousands of hours of labour for free.
If the winner got a high salaried contract of employment it would still be a little predatory, but at least you could get behind the idea that maybe someone with great skills who never got the opportunity will get a good position out of it. That would be far too reasonable though. I mean, why pay that guy at all when the person organizing this nonsense can just hand out a few air miles instead and get a bonus?
Does this happen in other industries? I'm sure it could be applied to all kinds of situations.
Imagine you owned a diamond mine but didn't really want to pay your workers. You use all that MBA know-how to come up with the following plan: Anyone who wants to can go in the mine at any time(you have security 24/7 to make sure nothing is taken). Nobody gets paid, but anyone who comes across a large diamond gets a 5,000 dollar prize! Imagine all the desperate people you'll be able to get to mine diamonds for you without paying them!
Award miles only and no employees / code share employees / family member or household member of them as well.
What a joke.
Oh, so like Bitcoin!
r in ur plaens nao
1. Find big valuable diamond.
2. Smash into 100 smaller diamonds.
3. ($500,000.00) PROFIT.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
and give myself a million miles, does that mean United will give a second million? Or just let me keep mine? So what do I need them for?
I got your Brute Force attack right here!
If they'd put up a few bug bounties for physical infrastructure they would be thousands of times as effective in improving security per dollar as the security improv group at the end of the line.
> Translation: We can't afford (read: won't pay) for real security personnel,
Eh, not really. I guarantee you they have a lot of "real" security personnel.
This is about taking over control of the story; it's a sort of "pay no attention to the thing we don't want you to hear about" (ie the fact that their onboard infotainment/networking and satellite uplink systems are ludicrously insecure) and "pay attention to this other thing."
Now when you search for "united hacking", you'll get a billion stories about the bug bounty, and few about the original problem - that a passenger was able to walk all over stuff he shouldn't have been able to. It's already starting to work, a few hours in:
https://imgur.com/0rGuKaL
It also helps them look, to shareholders/the market/the public, like they're "responding" and making an effort to "improve security."
Please help metamoderate.
The highest payout is for Remote code execution but performing code injection on live systems is prohibited. Assuming that united.com, beta.united.com and mobile.united.com is all live systems, that means to get the highest payout involves finding remote code execution attacks against the United app (for Android and iOS).
Also, since cross-site attacks involving United Airlines are probably worth more to certain other groups than just a 50,000 mile payout, I don't see why anyone would bother taking the time to report it to United.
They also will not payout anything at all until the bug has been remediated. While they claim the desired timeframe is 90 days, they put no upper limit on how long it will take them to remediate. Since they reserve the right to change the offer and MileagePlus Program at any time and without notice, someone that reports may discover the that actual terms/value of the payout greatly changes once United gets around to remediation of the bug.
I don't see why anyone would bother to report to United under this conditions.
Not the flight systems (aside from the moral issue of that, I don't like dying), but I was able to download one of their movies from the complimentary wi-fi using FFMpeg. I wouldn't really call it much of hack though. :-D
The scheme not only bans participants from probing on-board flight systems but threatens criminal prosecution for any such attempt.
... because those are not secured yet due to use of legacy software?
now we need to go OSS in diesel cars
Wow, United, I can't think of a better way to scare potential customers away.
"Hey, folks! Come fly with us, but don't be surprised if our plane is hacked, or just stops working mid-flight, or if we have absolutely no trace of your ticket a few days after you purchase it."
Pretty clear to me that whoever wrote these rules has no idea how any of this stuff works...
Bugs that are eligible for submission:
[...]
The ability to brute-force reservations, MileagePlus numbers, PINs or passwords
Attempting any of the following will result in permanent disqualification from the bug bounty program and possible criminal and/or legal investigation.
Brute-force attacks
As someone who hacks aircraft systems as part of his job (yes, we do exist, far and few between) one of the problems is the equipment manufacturers don't want the attention and they are in the position of power too often. That said, if you had the money you could buy some of these systems yourselves, a lot of what I do is just hooking them up on a benchtop...