Poking about a United Airlines online property might not seem to be the wisest course of action for a professional hacker given the fallout over the Chris Roberts saga, but Jordan Wiens insists he wasn’t deterred. 
 
 Wiens, who founded a security company in Florida called Vector 35 and not too long ago worked for a government contractor, submitted what he thought were a couple of “lame” bugs to United’s two-month-old bug bounty program—his first commercial bounty submission. The payoff was anything but weak. 
 
 Last Friday, Wiens was awarded one million miles for a remote code execution vulnerability, United’s highest payout and the first of its kind; United’s bug bounty is the first for a major airline. 
 
 Wow! @united really paid out! Got a million miles for my bug bounty submissions! Very cool. pic.twitter.com/CEclmhmyUq — Jordan Wiens (@psifertex) July 10, 2015 
 
 United’s bounty was announced shortly after the incident with Roberts, who tweeted during a flight that he had access to the aircraft’s in-flight entertainment system. Roberts was questioned by the FBI, who allegedly said Roberts told investigators he took control of the airplane and caused it to climb and turn. 
 
 Wiens, who is bound by the rules of the bounty not to share details on the vulnerability he found, said he wasn’t particularly worried about the ramifications of the Roberts incident on his work. 
 
 “[United] put out the bounty, which means they clearly want help,” Wiens said. “I didn’t have to test for the remote code execution bugs. I was passively poking the site and being careful about how much I was tampering. There wasn’t a whole lot of aggressive testing that I had to do. I knew I was in the clear.” 
 
 Remote code execution bugs are one of 10 bug classes eligible for bounties under United’s program; others include authentication bypass vulnerabilities, vulnerabilities on customer-facing websites and the United mobile app, cross-site request forgery, cross-site scripting, information disclosure, timing and brute-force attacks. Bugs on internal sites, partner sites and apps, on-board Wi-Fi, entertainment and avionics systems are out of scope. 
 
 United offers bounty winners only miles as a payout, with 50,00 awarded for XSS and CSRF bugs, 250,000 for authentication bypass, brute force attacks, PII disclosures and timing attacks, and one million miles for remote code execution bugs. 
 
 “There were actually two bugs that I submitted that I were pretty sure were remote code execution, but I also thought they were lame and wasn’t sure if they were on parts of the infrastructure that qualified,” Wiens said. “My expectation was that they counted, but I figured they’d award me 50,000 miles or something smaller.” 
 
 Instead, he got a message from United asking him to confirm his U.S. citizenship and whether the research was done on U.S. soil. 
 
 “I was hoping this wasn’t a honeypot,” Wiens joked. “Two hours later, I got a message to check my account that I had gotten my million miles. 
 
 “Give [United] credit,” he said. “Not a lot of companies that are not tech companies have a bug bounty program.” 
 
 Wiens said he’s done a number of permutations on what one million miles are worth and what he can do with them. As for monetary value, it’s around $25,000, which is a better payout than most commercial bug bounties. Wiens figures he has a number of options that range from using most of the miles on a first-class around-the-world trip to breaking them down to 40 domestic round-trip flights. 
 
 In the meantime, Wiens said he won’t disclose any details that would put the winnings in jeopardy. 
 
 “The best details I can share is that it was a remote code execution bug, and I didn’t have to test it to know it was remote code execution,” Wiens said, adding that it took him about six hours of work. “Finding the right domain and area to poke at was the interesting part. 
 
 “I never submit to bounties,” he said. “I’ve done a lot of vulnerability research, but always on my own, never public bug bounties before. I’ve never done commercial web app stuff before.” ||||| Two months after United Airlines launched a bug-bounty program to reward researchers who report flaws in the company’s web site and apps, a researcher has received 1 million air miles in the first reward given. 
 
 After submitting information to United about a remote-code execution flaw in the airline’s web site, Jordan Wiens was awarded his mileage last week. It was the first time Wiens, owner of the Florida-based security firm Vector 35, had submitted to a bug-bounty program. 
 
 United is the first airline to launch a bug bounty program. The company announced the program in May, after receiving harsh criticism for banning a security researcher from one of its flights. 
 
 United offers bounty submitters only air miles as a payout, rather than cash, as most vendor bug bounty programs do. The amounts paid by other bounty programs can vary between $500 and $250,000. The cash value of the 1 million miles Wiens received is about $25,000. 
 
 The miles United will pay out depend on the type of bug reported. The airline will award 50,000 miles for cross-site scripting bugs, for example. An authentication bypass bug can earn 250,000. But remote-code execution flaws—which allow an attacker to remotely run whatever malicious code they want on a vulnerable web site or system—earns the top payout. 
 
 “There were actually two bugs that I submitted that I were pretty sure were remote code execution, but I also thought they were lame and wasn’t sure if they were on parts of the infrastructure that qualified,” Wiens told the ThreatPost security blog. “My expectation was that they counted, but I figured they’d award me 50,000 miles or something smaller.” 
 
 Instead, after confirming he was a US citizen and that his research was done in the US, United told him to check his mileage account, where he discovered the massive deposit. ||||| Jordan Wiens is boasting that he earned 1,000,000 airline miles without ever leaving the ground. 
 
 Wiens, a Melbourne computer security analyst, says United Airlines awarded him the seven-figure bounty for locating a bug in its website. 
 
 United issued an unusual call to ethical hackers a few months ago. The carrier said the so-called “bug bounty” is a first for the airline industry. 
 
 “If you think you have discovered a potential security bug that affects our websites, apps and/or online portals, please let us know,” the site reads. “If the submission meets our requirements, we’ll gladly reward you for your time and effort." 
 
 The maximum payout is 1,000,000 miles. 
 
 ABOUT THE BUG BOUNTY: http://www.united.com/web/en-US/content/Contact/bugbounty.aspx 
 
 Wiens says he poked through United’s online systems for about six hours recently to find a flaw. He says he thought the vulnerability was important, but not worthy of so many miles. 
 
 “I did not expect to qualify for a full million,” he said. 
 
 Wiens posted a picture on Twitter showing two deposits from United that arrived on Friday. One deposit was 999,999 plus another for one mile. Together, it’s a huge 1,000,000 mile windfall. 
 
 What flaw did Wiens discover? He can’t say. 
 
 One million miles will travel quite far. Based on our read of the United Airlines MileagePlus award chart, it’s enough for: 
 
 COACH 
 
 40 round trips in the U.S. and Canada (except Hawaii) 
 
 16 round trips to Europe 
 
 12 round trips to Australia 
 
 BUSINESS/FIRST CLASS 
 
 20 round trips in the U.S. and Canada (except Hawaii) 
 
 8 round trips to Europe 
 
 7 round trips to Australia 
 
 Wiens said he plans to use the miles for coach class trips for his family, though he is considering one splurge in the ‘premium’ cabin. 
 
 “I have been telling the wife for awhile that I am going to take her to Hawaii,” he said. But that’s probably not going to cut it anymore. “She’s like, ‘you’ve got to do better than Hawaii.’” 
 
 Wiens said 'bug bounties' are common in the tech world. He saluted a mainstream company like United for hosting the ongoing contest. 
 
 “I have to give kudos to United for doing it,” he said.
– A security researcher has earned the equivalent of a first-class, round-the-world trip after he submitted what he thought were a couple of "lame" bugs to United's new bug bounty program. In an industry first, United announced a bounty in May that rewards miles to anyone who identifies a bug on its website. There are 10 bug classes eligible: Cross-site scripting bugs, for example, are worth 50,000 miles, while authentication bypass bugs earn 250,000. While "passively poking the site," Jordan Wiens, founder of a Florida security company, says he found what he thought were two remote code execution bugs, which allow a hacker to run their own potentially dangerous code on a site. "I also thought they were lame and wasn't sure if they were on parts of the infrastructure that qualified," he tells Threatpost. "I figured they'd award me 50,000 miles or something smaller." It turns out RCE bugs earn the highest payout: a maximum 1 million miles. After making his submission to United—his first to a bounty program, he says—Wiens got an email asking for confirmation that he was a US citizen and that his six hours of research was completed in the US. "Two hours later, I got a message to check my account that I had gotten my million miles," he says. Wiens, who can't share details of the bug, says the miles are worth $25,000 and could take him on a first-class trip around the world or on 40 domestic round-trip flights in coach. His plan is to use the miles on coach trips for his family, plus one luxurious flight with his wife, he tells Fox 13. Wired reports Wiens' award is the program's first major payout. Other security researchers have since shared their awards on Twitter. One says he nabbed 500,000 miles. (Speaking of planes, a "horrible" and "evil" new seat design has been revealed.)