News for hackers. Stuff that matters.

A comment on United Airlines bug bounty program.

Re:United Airlines bug bounty program by richadams on Thursday May 14, 2015 @07:12PM (#9548101)
"Bugs that are eligible for submission: ... The ability to brute-force reservations, MileagePlus numbers, PINs or passwords"

"Do not attempt: ... Brute-force attacks"

This seems contradictory. I assume the intent is to not allow DoS attacks (although they call that out separately further down the list)?

[ Parent | on HN ]
Re:United Airlines bug bounty program by supercoder on Thursday May 14, 2015 @07:15PM (#9548113)
Not exactly.

Seems they're saying they'd accept a bug that can be caused by brute-force, but do not actually attempt a brute force yourself.

But yeah I'd guess they don't want intentionally invite a bunch of people to DoS the site.

[ Parent | on HN ]
Re:United Airlines bug bounty program by bashinator on Thursday May 14, 2015 @08:48PM (#9548384)
Another interpretation is that, if you discover something similar to what Weev discovered, do not do what Weev did.
[ Parent | on HN ]