sb-au logo
Story image

Uber updates bug bounty terms to stop extortion and unauthorised data collection

01 May 2018

Any helpful hacker who participates in Uber’s bug bounty program must act in good faith or face legal action. The company has updated the terms of its bug bounty program, which includes safe harbour for those acting in good faith.

Under the new terms, users must play by Uber’s terms, respect users’ privacy, must not cause more harm than good, and they must not extort the company for ransom.

Anyone who stumbles upon user data is now prohibited from going any further and must report it to Uber immediately, or face the consequences. Participants are also prohibited from saving, storing, transferring, disclosing or otherwise retaining and user data that they find.

The terms also prohibit participants from extorting Uber in regards to vulnerabilities they find.

“You should never illegally or in bad faith leverage the existence of a vulnerability or access to sensitive or confidential information, such as making extortionate demands or ransom requests or trying to shake us down. In other words, if you find a vulnerability, report it to us with no conditions attached,” explain Uber security analyst for product security Lindsey Glovin and product security engineering manager Rob Fletcher.

Uber’s bug bounty program has paid out more than US$1.4 million to participants since its launch.

Bounties include:

  • Exposure of user data -- the payout ranges for this bucket range from $0 to $10,000.
  • Unauthorised requests on behalf of user/employee -- the payout ranges for this bucket range from $0 to $10,000.
  • Monetary impact -- the payout ranges for this bucket range from $0 to $10,000
  • Phishing -- the payout ranges for this bucket range from $0 to $5,000
  • Safety -- the payout ranges for this bucket range from $0 to $10,000

The company has added a bonus payout of US$500 for any researchers who include a fully-scripted proof-of-concept in their original report, which allows Uber to ‘quickly and thoroughly test issues once they are resolved, and run the POC again down the line to ensure there have not been regressions’.

Uber will also match donations of up to $100,000 by any bug bounty participant who donates their bounty to a charity through the HackerOne program.

“Once we hit that milestone, we’ll evaluate how the program is going, seek feedback from researchers, and determine whether we need to make any changes before expanding our contribution. Several leading bug bounty programs offer charitable matching already and our hope is for this to become a permanent part of our program,” conclude Glovin and Fletcher.

Story image
Revealed: The behaviours exhibited by the most effective CISOs
As cyber-threats pile up, more is being asked of CISOs - and according to Gartner, only a precious few are 'excelling' by the standards of their CISO Effectiveness Index.More
Story image
ESET launches the latest version of its Mobile Security solution
“With this latest version of ESET Mobile Security, we want to ensure our users feel completely secure when performing financial transactions on their devices, in addition to being protected from malware and phishing attempts."More
Link image
Webcast series: The necessary tools to secure a remote workforce
Experts from across the A/NZ region discuss the best security practices in a remote working world - with sessions available on the first Thursday of every month.More
Story image
Five security challenges for the Enterprise of Things
Many enterprise networks aren't adequately managed, creating risk for businesses that don’t have full visibility into all of the devices on their network, writes Forescout regional director for A/NZ Rohan Langdon.More
Story image
Yubico rolls out subscription service for hardware authentication keys
“With immediate success from the initial roll out in the US and Canada, we are proud to now offer YubiEnterprise Subscription to our APAC channel partners.” More
Story image
Video: 10 Minute IT Jams - Who is Bitglass?
Today, Techday speaks to Bitglass senior director of marketing Jonathan Andresen, who discusses insider attacks and the best solutions and practices to employ to protect organisations and employees.More