Story image

Uber updates bug bounty terms to stop extortion and unauthorised data collection

01 May 2018

Any helpful hacker who participates in Uber’s bug bounty program must act in good faith or face legal action. The company has updated the terms of its bug bounty program, which includes safe harbour for those acting in good faith.

Under the new terms, users must play by Uber’s terms, respect users’ privacy, must not cause more harm than good, and they must not extort the company for ransom.

Anyone who stumbles upon user data is now prohibited from going any further and must report it to Uber immediately, or face the consequences. Participants are also prohibited from saving, storing, transferring, disclosing or otherwise retaining and user data that they find.

The terms also prohibit participants from extorting Uber in regards to vulnerabilities they find.

“You should never illegally or in bad faith leverage the existence of a vulnerability or access to sensitive or confidential information, such as making extortionate demands or ransom requests or trying to shake us down. In other words, if you find a vulnerability, report it to us with no conditions attached,” explain Uber security analyst for product security Lindsey Glovin and product security engineering manager Rob Fletcher.

Uber’s bug bounty program has paid out more than US$1.4 million to participants since its launch.

Bounties include:

  • Exposure of user data -- the payout ranges for this bucket range from $0 to $10,000.
  • Unauthorised requests on behalf of user/employee -- the payout ranges for this bucket range from $0 to $10,000.
  • Monetary impact -- the payout ranges for this bucket range from $0 to $10,000
  • Phishing -- the payout ranges for this bucket range from $0 to $5,000
  • Safety -- the payout ranges for this bucket range from $0 to $10,000

The company has added a bonus payout of US$500 for any researchers who include a fully-scripted proof-of-concept in their original report, which allows Uber to ‘quickly and thoroughly test issues once they are resolved, and run the POC again down the line to ensure there have not been regressions’.

Uber will also match donations of up to $100,000 by any bug bounty participant who donates their bounty to a charity through the HackerOne program.

“Once we hit that milestone, we’ll evaluate how the program is going, seek feedback from researchers, and determine whether we need to make any changes before expanding our contribution. Several leading bug bounty programs offer charitable matching already and our hope is for this to become a permanent part of our program,” conclude Glovin and Fletcher.

Five things MSPs need to keep in mind in 2019
A Datto APAC channel exec outlines the most important factors for MSP to being paying attention to in the coming year.
Survey: IT pros nostalgic over on-prem data centre visibility
There are significant security and monitoring challenges faced by IT staff responsible for managing public and private cloud deployments.
61% of CIOs believe employees leak data maliciously
Egress conducted a survey to examine the root causes of employee-driven data breaches, their frequency, and impact.
Opinion: BYOD can be secure with the right measures
Companies that embrace BYOD are giving employees more freedom to work remotely, resulting in increased productivity, cost savings, and talent retention.
Sonatype and HackerOne partner on open source vulnerability reporting
Without a standard for responsible disclosure, even those who want to disclose vulnerabilities responsibly can get frustrated with the process.
OutSystems and Boncode team up for better code analysis
The Boncode and OutSystems alliance aims to help organisations to build fast and feel comfortable that the work they're delivering is at peak quality levels.
Nozomi and RIoT to deliver advanced ICS security solutions to Australia
''As a specialised integrator of robust and resilient ICT and IoT solutions within Australia, we are delighted to be partnering with Nozomi Networks."
Nuance biometrics fight back against fraud
Nuance Communications has crunched the numbers and discovered that it has prevented more than US$1 billion worth of fraud from being passed on to users of its Nuance Security Suite.