Hackers who uncovered a flaw in United Airlines' IT have been rewarded with 1m air miles each
By B.R.
FOR companies, there are two strategies for dealing with people who uncover flaws in their IT security: a right way and a wrong way. Our leader on hacking this week tells of the approach that Volkswagen took when a group of academics informed it that they had uncovered a vulnerability in a remote-car-key system: the firm slapped a court injunction on them. It is difficult to conceive of an approach more likely to be counter-productive.
United Airlines, it seems, has a far more enlightened attitude. It has just awarded two hackers 1m air miles each after they managed to spot security weak spots in its website. The move is part of a scheme called “bug bounty”, in which hackers are incentivised to contact the company with security flaws, rather than post them online. This approach is common at Silicon Valley firms, and makes just as much sense for old-fashioned industries too. Pound to a penny, there are nefarious types out there trying to break into most big companies’ IT systems. Encouraging “white-hat” hackers to uncover flaws, and then rewarding them for not revealing them to the wider world, may sit uncomfortably with people’s sense of fairness. However, if it gives firms time to fix the problem, in pragmatic terms the benefit is obvious.
It is particularly important for United, which, as Skift points out, has been susceptible to technological problems in recent years:
United has suffered several major problems with technology systems since 2012, when it switched passenger-reservations and other systems over to those that had been used at its smaller merger partner, Continental Airlines. Last week, all United flights were briefly grounded and more than 1,000 delayed after one such breakdown, which the airline blamed on a faulty computer router. A smaller outage occurred in June.
United was also the victim of a notorious alleged computer-security breach in May, when one of its passengers, Chris Roberts, claimed to have hacked into the avionics system of a flight from Denver to Chicago. As we reported at the time:
The FBI says Mr Roberts had identified a weakness with the in-flight entertainment (IFE) systems on Boeing 737-800, 737-900, 757-200 and Airbus A320 aircraft. It is thought he accessed the systems by plugging a laptop into one of the electronic boxes usually found under the seats either side of the aisle. Once connected, Mr Roberts claims to have accessed other systems on the aircraft. He admits to having issued a 'CLB', or climb command, to the thrust-management computer on a previous flight, resulting in a 'lateral or sideways movement of the plane'.
Such a breach is theoretically possible, according to experts, though most are also sceptical that he managed it in this case. But, even so, where there are weaknesses, it is better that they are discovered by those that do not intend harm. A million air miles seems like a fair reward.
