United Airlines Invites Hackers to Find Security Vulnerabilities

Chicago-Based, United Airlines, the World’s Largest in Terms of Number of Destinations Served, has Launched the 1s Rewards-for-Exploits Scheme in the Aviation Industry. United’s ‘Bug Bounty Program’ will Reward with Air-Miles Individuals Who Report Security Vulnerabilities in the Company’s Range of Websites, its App and in 3rd Party Programs that it Uses. The Maximum Payout Possible under the Scheme is Proof of a Vulnerability Leading to Remote Code Execution, which will Net the Submitter 1 Million Air Miles. 250,000 Air Miles are on Offer for Evidence of Exploits such as an Authentication Bypass, Brute Force Attacks, Timing Attacks and Flaws which Could Lead to the Disclosure of Personally Identifiable Information (PII). Successful Submissions regarding Cross-Site Scripting and Cross-Site Request Forgeries are Worth 50,000 Air Miles. Investigation of Actual On-Board Systems, including In-Flight Entertainment Systems, is Banned from the Scheme and United Promises Additionally to Subject Anyone Who Attempts such Probing to Criminal Prosecution. Any Bounty will Go to the 1st Submitter of a Particular Vulnerability.


The Submitter Must Not be a Resident of a Country in a United States Sanction List, the Author of the Vulnerable Code, an Employee of the Company or of Related Companies – and Must also be a Member of United’s MileagePlus Program in Order to Participate. The Scope of the Bug-Hunt Excludes Non-Customer-Facing Applications, Legacy Browsers and Plugins and Insecure Cookie Settings. Along with the Ban on Hacking On-Board Flight Systems, the Bug-Bounty Scheme Prohibits the Use of Code-Injection on Live Systems, Brute-Force Attacks, Scanning of United’s Servers, DDoS Attacks and Physical Attacks or Threats against the Company’s Employees. The Scheme Seems to be a Response to a Spate of Speculation about the Possibility of Hacking Airplanes in the Last Month or so, as well as, the Incident Where Security Researcher, Chris Roberts, was Prevented from Boarding a United Plane to California after Boasting on Twitter that, he Could Get the Plane’s Oxygen Masks to Deploy.