TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

United Airlines Bug Bounty: An experience in reporting a serious vulnerability

164 pointsby rwestergrenover 9 years ago

13 comments

eyearequeover 9 years ago
If you've participated in their program, you'll probably find that they have their fair share of issues. This is probably where their delay is coming from (but not a valid excuse). I found two serious problems in less than a hour. I reported the issues to them and was subsequently told that both submissions were out of scope and a firm warning to follow the rules. You're welcome for the free findings.
评论 #10613073 未加载
评论 #10613529 未加载
jacquesmover 9 years ago
Interesting terms, if you can't talk about it afterwards how do people know that any of these bounties were paid out? After all there is a pretty simple loophole here: mark any and all reports as duplicates, no need to pay out.
评论 #10612248 未加载
评论 #10612235 未加载
cm2187over 9 years ago
The author is being nice calling it a bug. A buffer overflow is a bug. This is a moronic design, like a sql vulnerability. I am shocked that in these days and age, so many web developers have not adopted the mentality "everything coming back from the client may and will ultimately be tainted". Relying on an ID provided by the client without checking the appropriate access is unexcusable. How many years ago was the Dell shopping cart bug (where a client could alter the price of an order)?
评论 #10613777 未加载
评论 #10615581 未加载
ryandrakeover 9 years ago
Is six months really unreasonable for a big bloated bureaucracy like United Airlines? I've worked on projects for smaller tech companies with release cycles longer than that. Not defending--obviously they should be set up to be able to put out small emergency fixes quickly especially if they're running a bug bounty. But, hey, it's an airline: releasing software is not exactly their bread and butter.
评论 #10612170 未加载
评论 #10612215 未加载
评论 #10612115 未加载
评论 #10612208 未加载
评论 #10612773 未加载
评论 #10612168 未加载
评论 #10612082 未加载
评论 #10612245 未加载
评论 #10613391 未加载
评论 #10613140 未加载
评论 #10612195 未加载
jcdavisover 9 years ago
I reported 2 admittedly minor web security bugs to them several months back that surprisingly I was apparently the first to report, but still haven't heard back about either.
MrQuincleover 9 years ago
Mine was a duplicate as well. Anyone here who was paid out?
评论 #10612243 未加载
评论 #10612056 未加载
评论 #10612011 未加载
jsjohnstover 9 years ago
If you know the PNR of an itinerary and the person's last name you can quite easily do most of what was described in this article via United's website or over the phone. Always makes me laugh when I see folks posting full images of their plane tickets online, they so easily could have their travel plans screwed. :(
评论 #10612791 未加载
swangover 9 years ago
Just checked this using mitmproxy. My United MileagePlus Account is definitely there.<p>Also, you need a valid MP#, and the # is not sequential (nor all numbers).<p>At least they&#x27;re using https.<p>Edit: Also annoying the app keeps making calls to Gogo wifi and some other Wifi page.<p>Edit2: I just realized United _did_ fix it. Thought it said they refused to fix it.
erikbover 9 years ago
It&#x27;s so funny to see how surprised people are about the &quot;corp&quot; IT compared to the &quot;free&quot; IT world. Once I was also surprised about how long it takes and that very important things can be out of scope.<p>I think the reason is that in fact in teams &gt;10 people nobody really knows what&#x27;s going on. That anything happens is more the result of many attempts and some luck. That nothing succeeds is the default.<p>Think of it more as &quot;Twitch Programs Flight Ticketmanager App&quot; than actual software development as you read it in a book. (I once worked with &gt;5 other guys on getting a string in one computer pointing to another computer, took the whole week)
blantonlover 9 years ago
How was this vulnerability able to be exposed in the first place if the API is communicating over SSL?
评论 #10612692 未加载
thedogeyeover 9 years ago
Have you participated in a bug bounty program on Hacker One? We are running one there now.
phphphphover 9 years ago
&gt; Using just these two values, an attacker could completely manage any aspect of a flight reservation using United’s website.<p>Don&#x27;t most airline websites allow that when you get the last name and date of departure right?
评论 #10613703 未加载
vezzy-fnordover 9 years ago
Classic case of confused deputies caused by ambient authority. Wonder if we&#x27;ll ever outlive these kinds of bugs.