text: Two months after United Airlines launched a bug-bounty program to reward researchers who report flaws in the company’s web site and apps, a researcher has received 1 million air miles in the first reward given. 
   
   After submitting information to United about a remote-code execution flaw in the airline’s web site, Jordan Wiens was awarded his mileage last week. It was the first time Wiens, owner of the Florida-based security firm Vector 35, had submitted to a bug-bounty program. 
   
   United is the first airline to launch a bug bounty program. The company announced the program in May, after receiving harsh criticism for banning a security researcher from one of its flights. 
   
   United offers bounty submitters only air miles as a payout, rather than cash, as most vendor bug bounty programs do. The amounts paid by other bounty programs can vary between $500 and $250,000. The cash value of the 1 million miles Wiens received is about $25,000. 
   
   The miles United will pay out depend on the type of bug reported. The airline will award 50,000 miles for cross-site scripting bugs, for example. An authentication bypass bug can earn 250,000. But remote-code execution flaws—which allow an attacker to remotely run whatever malicious code they want on a vulnerable web site or system—earns the top payout. 
   
   “There were actually two bugs that I submitted that I were pretty sure were remote code execution, but I also thought they were lame and wasn’t sure if they were on parts of the infrastructure that qualified,” Wiens told the ThreatPost security blog. “My expectation was that they counted, but I figured they’d award me 50,000 miles or something smaller.” 
   
   Instead, after confirming he was a US citizen and that his research was done in the US, United told him to check his mileage account, where he discovered the massive deposit. ||||| Jordan Wiens is boasting that he earned 1,000,000 airline miles without ever leaving the ground. 
   
   Wiens, a Melbourne computer security analyst, says United Airlines awarded him the seven-figure bounty for locating a bug in its website. 
   
   United issued an unusual call to ethical hackers a few months ago. The carrier said the so-called “bug bounty” is a first for the airline industry. 
   
   “If you think you have discovered a potential security bug that affects our websites, apps and/or online portals, please let us know,” the site reads. “If the submission meets our requirements, we’ll gladly reward you for your time and effort." 
   
   The maximum payout is 1,000,000 miles. 
   
   ABOUT THE BUG BOUNTY: http://www.united.com/web/en-US/content/Contact/bugbounty.aspx 
   
   Wiens says he poked through United’s online systems for about six hours recently to find a flaw. He says he thought the vulnerability was important, but not worthy of so many miles. 
   
   “I did not expect to qualify for a full million,” he said. 
   
   Wiens posted a picture on Twitter showing two deposits from United that arrived on Friday. One deposit was 999,999 plus another for one mile. Together, it’s a huge 1,000,000 mile windfall. 
   
   What flaw did Wiens discover? He can’t say. 
   
   One million miles will travel quite far. Based on our read of the United Airlines MileagePlus award chart, it’s enough for: 
   
   COACH 
   
   40 round trips in the U.S. and Canada (except Hawaii) 
   
   16 round trips to Europe 
   
   12 round trips to Australia 
   
   BUSINESS/FIRST CLASS 
   
   20 round trips in the U.S. and Canada (except Hawaii) 
   
   8 round trips to Europe 
   
   7 round trips to Australia 
   
   Wiens said he plans to use the miles for coach class trips for his family, though he is considering one splurge in the ‘premium’ cabin. 
   
   “I have been telling the wife for awhile that I am going to take her to Hawaii,” he said. But that’s probably not going to cut it anymore. “She’s like, ‘you’ve got to do better than Hawaii.’” 
   
   Wiens said 'bug bounties' are common in the tech world. He saluted a mainstream company like United for hosting the ongoing contest. 
   
   “I have to give kudos to United for doing it,” he said. ||||| Poking about a United Airlines online property might not seem to be the wisest course of action for a professional hacker given the fallout over the Chris Roberts saga, but Jordan Wiens insists he wasn’t deterred. 
   
   Wiens, who founded a security company in Florida called Vector 35 and not too long ago worked for a government contractor, submitted what he thought were a couple of “lame” bugs to United’s two-month-old bug bounty program—his first commercial bounty submission. The payoff was anything but weak. 
   
   Last Friday, Wiens was awarded one million miles for a remote code execution vulnerability, United’s highest payout and the first of its kind; United’s bug bounty is the first for a major airline. 
   
   Wow! @united really paid out! Got a million miles for my bug bounty submissions! Very cool. pic.twitter.com/CEclmhmyUq — Jordan Wiens (@psifertex) July 10, 2015 
   
   United’s bounty was announced shortly after the incident with Roberts, who tweeted during a flight that he had access to the aircraft’s in-flight entertainment system. Roberts was questioned by the FBI, who allegedly said Roberts told investigators he took control of the airplane and caused it to climb and turn. 
   
   Wiens, who is bound by the rules of the bounty not to share details on the vulnerability he found, said he wasn’t particularly worried about the ramifications of the Roberts incident on his work. 
   
   “[United] put out the bounty, which means they clearly want help,” Wiens said. “I didn’t have to test for the remote code execution bugs. I was passively poking the site and being careful about how much I was tampering. There wasn’t a whole lot of aggressive testing that I had to do. I knew I was in the clear.” 
   
   Remote code execution bugs are one of 10 bug classes eligible for bounties under United’s program; others include authentication bypass vulnerabilities, vulnerabilities on customer-facing websites and the United mobile app, cross-site request forgery, cross-site scripting, information disclosure, timing and brute-force attacks. Bugs on internal sites, partner sites and apps, on-board Wi-Fi, entertainment and avionics systems are out of scope. 
   
   United offers bounty winners only miles as a payout, with 50,00 awarded for XSS and CSRF bugs, 250,000 for authentication bypass, brute force attacks, PII disclosures and timing attacks, and one million miles for remote code execution bugs. 
   
   “There were actually two bugs that I submitted that I were pretty sure were remote code execution, but I also thought they were lame and wasn’t sure if they were on parts of the infrastructure that qualified,” Wiens said. “My expectation was that they counted, but I figured they’d award me 50,000 miles or something smaller.” 
   
   Instead, he got a message from United asking him to confirm his U.S. citizenship and whether the research was done on U.S. soil. 
   
   “I was hoping this wasn’t a honeypot,” Wiens joked. “Two hours later, I got a message to check my account that I had gotten my million miles. 
   
   “Give [United] credit,” he said. “Not a lot of companies that are not tech companies have a bug bounty program.” 
   
   Wiens said he’s done a number of permutations on what one million miles are worth and what he can do with them. As for monetary value, it’s around $25,000, which is a better payout than most commercial bug bounties. Wiens figures he has a number of options that range from using most of the miles on a first-class around-the-world trip to breaking them down to 40 domestic round-trip flights. 
   
   In the meantime, Wiens said he won’t disclose any details that would put the winnings in jeopardy. 
   
   “The best details I can share is that it was a remote code execution bug, and I didn’t have to test it to know it was remote code execution,” Wiens said, adding that it took him about six hours of work. “Finding the right domain and area to poke at was the interesting part. 
   
   “I never submit to bounties,” he said. “I’ve done a lot of vulnerability research, but always on my own, never public bug bounties before. I’ve never done commercial web app stuff before.” ||||| Current Location within United.com Skip Navigation Links Home 
   
   Contact us 
   
   Bug Bounty Program You are here. United Airlines bug bounty program At United, we take your safety, security and privacy seriously. We utilize best practices and are confident that our systems are secure. We are committed to protecting our customers' privacy and the personal data we receive from them, which is why we are offering a bug bounty program — the first of its kind within the airline industry. We believe that this program will further bolster our security and allow us to continue to provide excellent service. If you think you have discovered a potential security bug that affects our websites, apps and/or online portals, please let us know. If the submission meets our requirements, we'll gladly reward you for your time and effort. Before reporting a security bug, please review the "United Terms." By participating in the bug bounty program, you agree to comply with these terms. What is a bug bounty program? A bug bounty program permits independent researchers to discover and report security issues that affect the confidentiality, integrity and/or availability of customer or company information and rewards them for being the first to discover a bug. Eligibility requirements To ensure that submissions and payouts are fair and relevant, the following eligibility requirements and guidelines apply to all researchers submitting bug reports: All bugs must be new discoveries. Award miles will be provided only to the first researcher who submits a particular security bug. 
   
   The researcher must be a MileagePlus member in good standing. If you're not yet a member, join the MileagePlus program now. 
   
   The researcher must not reside in a country currently on a United States sanctions list. 
   
   The researcher submitting the bug must not be a current or former employee of United Airlines, any Star Alliance™ member airline or any other partner airline, or a family member or household member of an employee of United Airlines or any partner airline. 
   
   The researcher submitting the bug must not be the author of the vulnerable code. Bugs that are eligible for submission: Authentication bypass 
   
   Bugs on United-operated, customer-facing applications such as: united.com mobile.united.com mystatus.united.com smartphone.continental.com wechat.united.com 
   
   Bugs on the United app 
   
   Bugs in third-party assets loaded by United-operated, customer-facing applications 
   
   Cross-site request forgery 
   
   Cross-site scripting (XSS) 
   
   Potential for information disclosure 
   
   Remote code execution 
   
   Timing attacks that prove the existence of a private repository, user or reservation 
   
   The ability to enumerate reservations, MileagePlus numbers, PINs or passwords (Note: Please do not attempt brute-force attacks on our systems. Report the potential bug and we will verify its validity.) Bugs that are not eligible for submission: Bugs that only affect legacy or unsupported browsers, plugins or operating systems 
   
   Bugs on internal sites for United employees or agents (not customer-facing) 
   
   Bugs on applications that are not operated by United, such as: cruises.united.com hotels.united.com hub.united.com unitedmileageplus.com vacations.united.com 
   
   Bugs on onboard Wi-Fi, entertainment systems or avionics 
   
   Insecure cookie settings for non-sensitive cookies 
   
   Previously submitted bugs 
   
   Self-cross-site scripting 
   
   Vulnerabilities that apply only to you or your own account 
   
   Web server banner disclosure issues Do not attempt: Attempting any of the following will result in permanent disqualification from the bug bounty program and possible criminal and/or legal investigation. We do not allow any actions that could negatively impact the experience on our websites, apps or online portals for other United customers. Brute-force attacks 
   
   Code injection on live systems 
   
   Disruption or denial-of-service attacks 
   
   The compromise or testing of MileagePlus accounts that are not your own 
   
   Any testing on aircraft or aircraft systems such as inflight entertainment or inflight Wi-Fi 
   
   Any threats, attempts at coercion or extortion of United employees, Star Alliance member airline employees, other partner airline employees, or customers 
   
   Physical attacks against United employees, Star Alliance member airline employees, other partner airline employees, or customers 
   
   Vulnerability scans or automated scans on United servers (including scans using tools such as Acunetix, Core Impact or Nessus) Bounties If you have discovered a security bug that meets the requirements, and you're the first eligible researcher to report it, we will gladly reward you for your efforts. Below is our bounty payout structure, which is based on the severity and impact of bugs. Bug Bounty payout structure Severity Examples Maximum payout in award miles High Remote code execution 1,000,000 Medium Authentication bypass 
   
   Brute-force attacks 
   
   Potential for personally identifiable information (PII) disclosure 
   
   Timing attacks 250,000 Low Cross-site scripting 
   
   Cross-site request forgery 
   
   Third-party security bugs that affect United 50,000 Submissions If you think you have discovered an eligible security bug, we would love to work with you to resolve it. Please email us at bugbounty@united.com and include " Bug Bounty Submission " in the subject line. 
   
   " in the subject line. Within the body of the email, please describe the nature of the bug along with any steps required to replicate it, as well as pertinent applications, programs or tools used to discover the bug and the date and time testing took place. 
   
   Include your legal name, MileagePlus number, phone number and IP address at time of testing with your submission. 
   
   A drafted report including legible screenshots is greatly appreciated. Please feel free to reach out to us at bugbounty@united.com with any questions regarding the bug bounty program. We receive a lot of submissions through this program, so we may not be able to reply to your email right away, but we'll respond as soon as possible. We look forward to hearing from you. Terms and conditions The United Terms govern your participation in the Program and it is your responsibility to read and understand all of them. The Program is offered at the discretion of United Airlines and its affiliates, and United has the right to terminate or modify the Program, program rules, procedures, benefits or conditions of participation, in whole or in part, at any time, with or without notice ("Program Rules"). The Program Rules supplement the united.com Terms and Conditions and Legal Notices, the United Privacy Policy and the MileagePlus Program Rules (collectively with the Program Rules, the "United Terms"). 
   
   By participating, you agree to comply with the United Terms. 
   
   The Program is not a game or competition, but rather an experimental and discretionary reward program. Offer is valid for qualified "Bugs" submitted on or after May 11, 2015. We may cancel the Program at any time and the decision as to whether or not to pay award miles is entirely within United's discretion. 
   
   The United "Bug Bounty" offer is open only to United MileagePlus members who are 14 years of age or older at time of submission. Offer is void where prohibited and subject to all laws. Current or former employees, officers and directors (and their respective immediate family members (spouse, parents, siblings, children) or household members (whether or not related)) of United Airlines, Inc. or its parent(s), subsidiaries, affiliated companies, agents, or contractors, and anyone who participates in the administration of the Bug Bounty program are not eligible. 
   
   Bugs must be submitted to bugbounty@united.com and include the researcher's legal name, MileagePlus number and phone number as well as a thorough description of the Bug and supporting evidence. 
   
   Bugs must be new discoveries. Award miles will be provided only to the first eligible researcher to submit a particular Bug. 
   
   In event of disclosure of PII other than your own test account, please cease the affecting activity and document steps to replicate as soon as possible. 
   
   The researcher submitting the Bug must not be the author of the vulnerable code. 
   
   Bugs or potential Bugs you discover may not at any time be disclosed publicly or to a third-party. Doing so will disqualify you from receiving award miles. 
   
   You must not knowingly or intentionally access or acquire the personal information of any United customer or member. In the event it is determined you knowingly or intentionally accessed the personal information of any United customer or member, you will become immediately ineligible to participate in this Program. In the event you inadvertently access or acquire the personal information of any United customer or member, you must immediately cease all activity. 
   
   Award miles may be earned once for each qualifying Bug submitted. You can earn award miles an unlimited number of times in accordance with these terms and conditions. 
   
   Please note that mileage payouts are subject to the taxes of your country of residence and citizenship at a rate of 2% per mile added to your annual earnings. You are responsible for any tax implications. If you’d prefer to donate your miles to charity, let us know. 
   
   United will provide a payout for each qualifying Bug once it has been remediated. Our desired timeframe to remediate each valid submission is within 90 days following the confirmation of each qualifying Bug. 
   
   Neither your Participation in the Program nor anything contained in the United Terms shall be construed as creating or implying a joint venture, partnership, agency or employment relationship between you and United or its affiliates. 
   
   Information you receive or collect about United or its affiliates or members through the Program, whether in oral, visual, written or electronic format, may be deemed proprietary and confidential ("Confidential Information"). For purposes of the Program, information and/or material shall be deemed "Confidential Information" if such information and/or material is otherwise not generally available to the public, or given the nature of the information or material, a reasonable person would consider such information and/or material "confidential" or "proprietary." 
   
   Confidential Information must be kept confidential and only used in connection with the Program. You may not use, disclose or distribute any such Confidential Information without United's prior written consent. 
   
   You agree to defend, indemnify and hold harmless United and its affiliates and the officers, directors, agents, employees and vendors of United and its affiliates from any claim or demand (including attorneys' fees) made or incurred by any third party due to or arising out of your participation in the Program, your breach of the United Terms or your improper use of the Program. 
   
   Award miles offered under this Program are not Premier® qualifying miles. 
   
   Offer is subject to change without notice. Other restrictions may apply. 
   
   Miles accrued, awards, and benefits issued are subject to change and are subject to the rules of the United MileagePlus program, including without limitation the Premier® program, which are expressly incorporated herein. United may change the MileagePlus Program including, but not limited to, rules, regulations, travel awards and special offers or terminate the MileagePlus Program at any time and without notice. United and its subsidiaries, affiliates and agents are not responsible for any products or services of other participating companies and partners. Taxes and fees related to award travel are the responsibility of the member. Bonus award miles, award miles and any other miles earned through non-flight activity do not count toward qualification for Premier status unless expressly stated otherwise. The accumulation of mileage or Premier status or any other status does not entitle members to any vested rights with respect to the MileagePlus Program. All calculations made in connection with the United MileagePlus Program and/or the Premier Program, including without limitation the accumulation of mileage and the satisfaction of the qualification requirements of the Premier Program, and/or the revisions of calculations (including any estimates), will be made by United Airlines and MileagePlus in their discretion and such calculations will be considered final. Information in this communication that relates to the MileagePlus Program does not purport to be complete or comprehensive and may not include all of the information that a member may believe is important, and is qualified in its entirety by reference to all of the information on the united.com website and the MileagePlus Program rules. United and MileagePlus are registered service marks. For complete details about the MileagePlus Program, go to united.com/MileagePlus 
   
   Advertisements
target: – A security researcher has earned the equivalent of a first-class, round-the-world trip after he submitted what he thought were a couple of "lame" bugs to United's new bug bounty program. In an industry first, United announced a bounty in May that rewards miles to anyone who identifies a bug on its website. There are 10 bug classes eligible: Cross-site scripting bugs, for example, are worth 50,000 miles, while authentication bypass bugs earn 250,000. While "passively poking the site," Jordan Wiens, founder of a Florida security company, says he found what he thought were two remote code execution bugs, which allow a hacker to run their own potentially dangerous code on a site. "I also thought they were lame and wasn't sure if they were on parts of the infrastructure that qualified," he tells Threatpost. "I figured they'd award me 50,000 miles or something smaller." It turns out RCE bugs earn the highest payout: a maximum 1 million miles. After making his submission to United—his first to a bounty program, he says—Wiens got an email asking for confirmation that he was a US citizen and that his six hours of research was completed in the US. "Two hours later, I got a message to check my account that I had gotten my million miles," he says. Wiens, who can't share details of the bug, says the miles are worth $25,000 and could take him on a first-class trip around the world or on 40 domestic round-trip flights in coach. His plan is to use the miles on coach trips for his family, plus one luxurious flight with his wife, he tells Fox 13. Wired reports Wiens' award is the program's first major payout. Other security researchers have since shared their awards on Twitter. One says he nabbed 500,000 miles. (Speaking of planes, a "horrible" and "evil" new seat design has been revealed.)