Live data from Hacker News

United Airlines Bug Bounty: An experience in reporting a serious vulnerability

randywestergren.com

11–20 of 80 posts

Re: United Airlines Bug Bounty: An experience in reporting a serious vulnerability

#11

Is six months really unreasonable for a big bloated bureaucracy like United Airlines? I've worked on projects for smaller tech companies with release cycles longer than that. Not defending--obviously they should be set up to be able to put out small emergency fixes quickly especially if they're running a bug bounty. But, hey, it's an airline: releasing software is not exactly their bread and butter.

Well, having worked on applications like this, I think it's not totally unreasonable. Of course, could it have been done earlier? Yes. But the backend systems of such applications are usually so complicated and with ripple effects through layers that it takes quite a lot of planning to get it right.

I am not saying delaying a critical vulnerability patch for 6 months is right, but I think airline systems will typically need that much time to plan it well.

Re: United Airlines Bug Bounty: An experience in reporting a serious vulnerability

#13

Is six months really unreasonable for a big bloated bureaucracy like United Airlines? I've worked on projects for smaller tech companies with release cycles longer than that. Not defending--obviously they should be set up to be able to put out small emergency fixes quickly especially if they're running a bug bounty. But, hey, it's an airline: releasing software is not exactly their bread and butter.

Let's rephrase your question: "Is six months really unreasonable for an airline to fix a vulnerability that allows customer data to be stolen?"

Yes, I would say so.. especially since this is a 'duplicate' meaning that multiple people were already aware of this, and on top of that it seems the only reason it was eventually fixed was because they couldn't delay fixing the problem any more.

I don't think anyone would consider this reasonable.

Re: United Airlines Bug Bounty: An experience in reporting a serious vulnerability

#14

Is six months really unreasonable for a big bloated bureaucracy like United Airlines? I've worked on projects for smaller tech companies with release cycles longer than that. Not defending--obviously they should be set up to be able to put out small emergency fixes quickly especially if they're running a bug bounty. But, hey, it's an airline: releasing software is not exactly their bread and butter.

Do you think only the good guys got into this?

Re: United Airlines Bug Bounty: An experience in reporting a serious vulnerability

#15

Is six months really unreasonable for a big bloated bureaucracy like United Airlines? I've worked on projects for smaller tech companies with release cycles longer than that. Not defending--obviously they should be set up to be able to put out small emergency fixes quickly especially if they're running a bug bounty. But, hey, it's an airline: releasing software is not exactly their bread and butter.

>But, hey, it's an airline: releasing software is not exactly their bread and butter.

it's not pilots and flight attendants coding that application. they've got an IT department whose bread and butter IS releasing software.

Re: United Airlines Bug Bounty: An experience in reporting a serious vulnerability

#16

Is six months really unreasonable for a big bloated bureaucracy like United Airlines? I've worked on projects for smaller tech companies with release cycles longer than that. Not defending--obviously they should be set up to be able to put out small emergency fixes quickly especially if they're running a bug bounty. But, hey, it's an airline: releasing software is not exactly their bread and butter.

Which reminds me of when I reported 768-bit DHE on a Nest server to Google security. Original bug was https://bugzilla.mozilla.org/show_bug.cgi?id=1170833 . They fixed it in only a few days, but in the meantime they tweeted this: https://twitter.com/nestsupport/status/606246459822997505 (at that time the Firefox version that was broken was not even in the release channel!)

Re: United Airlines Bug Bounty: An experience in reporting a serious vulnerability

#18
post #10

Is six months really unreasonable for a big bloated bureaucracy like United Airlines? I've worked on projects for smaller tech companies with release cycles longer than that. Not defending--obviously they should be set up to be able to put out small emergency fixes quickly especially if they're running a bug bounty. But, hey, it's an airline: releasing software is not exactly their bread and butter.

Bloated beauracracies need agile ways to respond to important situations. Giving them a pass because they are bloated won't make that happen any sooner, and it does need to happen.

Organizations like that have no code hygiene. They have smart talented people that are entrenched in their way of doing things. They don't have the money to throw the code away and start over. They don't have the control to enforce code standards. There are a couple of terrible effects that slow them down.

I'll bet you a nickel that the json is generated by a stored procedure. In that kind of environment, you can't really run a local version of the system. if you're lucky there's a prod, qa, and development version. the development version is shared by everybody.

What winds up happening is the dev system has lots of in-progress stuff, and i can't release my stuff till the other in-progress stuff is ready to go, or is rolled back.

Also high priority stuff tends to go to "that one wizard guy". Unfortunately that one wizard guy is backed up with 6 months of other projects, cause he's the wizard.

Is it "right"? no, of course not. These systems evolve from people making good decisions in the moment, that don't really take into account the global state of the system.

Finally, every few years a new CIO comes into power and wants to clean things up. a few new folks buy in, but the older entrenched interests just pay lip service, because they know the only way to actually get software out the door is to do it their way. (They tried and were burned by at least one of the prior CIO approaches)

I think those organizations are pretty screwed. they are incapable of change at the layer they need. Banks, schools, airlines, machine shops, anyplace there's a large sized in house dev team (30+), that team is going to very likely kind of suck. There are exceptions, but generally, it's a rough state.

So, yes, i agree, but actually solving that problem in a way that won't kill the business is incredibly hard.

Post reply on HN