Slashdot Mirror

← Back to Stories (view on slashdot.org)

United Airlines Invites Hackers To Find Security Vulnerabilities

Posted by timothy on from the how-to-get-non-flyer-miles dept.

An anonymous reader writes: Following a recent spike of interest regarding the potential to hack planes, United Airlines has created the first rewards-for-exploits scheme in the aviation industry. The 'Bug-Bounty' program offers up to a million air miles for submitters who find a specific range of exploits in the company's websites and digital infrastructure. The scheme not only bans participants from probing on-board flight systems but threatens criminal prosecution for any such attempt.

10 of 54 comments (clear)

  1. Goodie ! by randalware · · Score: 4, Funny

    I will make reservations to Paris for two.
    Then go visit Dr. Falkin.

    --
    This is my opinion based on what little I know and understand of the rumors and lies Thanks, Randal
  2. bug bounty but no scanning by Anonymous Coward · · Score: 3, Insightful

    sounds odd they place the rule of no scanning of their network.
    how is anyone suppose to find out what the structure is without probing

  3. Screw That. by TechyImmigrant · · Score: 2

    I've got all the points and arse ache I need.
    I want a status upgrade. PQMs or go away.

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  4. Translation by countSudoku() · · Score: 3, Insightful

    Translation: We can't afford (read: won't pay) for real security personnel, so we'll let strangers do it on a dare and not even to any interesting assets like a fucking plane! No, just hack our shitty web site and we'll offer you some "free miles" that will be highly restricted and next to worthless, but don't fear, wherever you end up going will be a horrible journey filled with ignorant TSA agents frisking your panties and smelling your shoes and then if your fucking pilot decides NOT to crash the plane into a building or a mountain you might end up killing yourself at your destination rather than face the social rape that is modern air travel.

    --
    This is the NSA, we're gonna geet U h@x0r5! Also, what is a h@x0r5?
    1. Re:Translation by magarity · · Score: 2

      Translation: We can't afford (read: won't pay) for real security personnel

      In all fairness, United is a huge company and like any huge company has tremendous inertia. Probably it's nearly impossible to get IT security bugs properly identified and fixed even if the CEO came to daily scrum meetings. A bounty for external parties is at least a realization they have this problem.

    2. Re:Translation by TechyImmigrant · · Score: 2

      I'm a united frequent flyer.

      To get an upgrade on an international (atlantic or pacific crossing) flight will cost you 30,000 points and $500.
      The points have no value without extra money.

      Status is everything, points accumulate faster than you can spend them if you are a frequent flyer. With status you don't get a middle seat, you're first in line for upgrades, they don't bump you on overbooked flights. Status matters.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  5. Re:wtf by spiritplumber · · Score: 3, Insightful

    Heh. The problem with half these contests is that two weeks later they say "No, contest over and if you publish a vulnerability we'll sue you".

    --
    Liberty - Security - Laziness - Pick any two.
  6. Following a recent spike .... by PPH · · Score: 2

    ... of interest regarding the potential to hack planes, United offers rewards for finding vulnerabilities in their ground-based systems. But no trying to hack planes, or you'll be in trouble.

    I see a certain logic fail here.

    --
    Have gnu, will travel.
  7. If I get into United's reward system.... by Glasswire · · Score: 2

    and give myself a million miles, does that mean United will give a second million? Or just let me keep mine? So what do I need them for?

  8. it's about taking control of the story/keywords by SuperBanana · · Score: 2

    > Translation: We can't afford (read: won't pay) for real security personnel,

    Eh, not really. I guarantee you they have a lot of "real" security personnel.

    This is about taking over control of the story; it's a sort of "pay no attention to the thing we don't want you to hear about" (ie the fact that their onboard infotainment/networking and satellite uplink systems are ludicrously insecure) and "pay attention to this other thing."

    Now when you search for "united hacking", you'll get a billion stories about the bug bounty, and few about the original problem - that a passenger was able to walk all over stuff he shouldn't have been able to. It's already starting to work, a few hours in:

    https://imgur.com/0rGuKaL

    It also helps them look, to shareholders/the market/the public, like they're "responding" and making an effort to "improve security."

    --
    Please help metamoderate.