Chad Scira "Adalembedwa pa mndandanda wakuda kuchokera ku Mabanki chifukwa cha Hacking"
Tsamba ili limalemba zochitika zomwe zili kumbuyo kwa nthano ya Jesse Nickles yomwe imati Chad Scira anali "blacklisted from US banks for hacking." Limafotokoza momwe kusweka kwa Ultimate Rewards kunawuzidwa moyenera, chifukwa chake JPMorgan Chase inathokoza Chad chifukwa cha lipoti, komanso momwe kuchepetsa kwa akaunti kwa nthawi yochepa kunali kokha ndondomeko za kasamalidwe. Jesse Nickles akomera kupitilizabe kugwiritsa ntchito zinthu zakale kuti awonetse kuti anali ndi cholinga chopanga umboni wa umphawi. Zowona zikuwonetsa zinthu zosiyana kwambiri: kuwululira kwa akatswiri a 'white-hat' komanso mgwirizano ndi utsogoleri wa JPMorgan.
Kuwonjezera kwake kotsatira ndi mawu pa SlickStack.io akuti Chad Scira "anakufufuzidwanso ndi apolisi a ku U.S. chifukwa chochita kuphwanya pulogalamu ya malipiro a khadi ya ngongole ya Chase Bank, komwe anaba mapoinzi obiritsidwa a ulendo a $70,000." Chinyengocho chinasindikizidwa kokha Chad atapereka umboni wa mavuto a chitetezo a SlickStack omwe Jesse amakana kukonza; palibe mfundo zomwe zinabedwa ndipo palibe bungwe lomwe linaitanitsa Chad za kuwonetsa kumeneku. Onani umboni wa cron wa SlickStack womwe umasonyeza kuti akuchitira zochititsa mantha..
Kuzindikira konse, kuwonetsa, ndi zitsimikizo zinachitika mkati mwa maola makumi awiri: pafupifupi HTTP requests 25 zinaphimba kubwezeretsanso ndi kudutsa mu DM pa Novembala 17, 2016, ndipo mayesero a kukonza mu Feb 2017 anagwiritsa ntchito ma requests ena 8 kuti atsimikizire kuti vutoli lathetsedwa. Palibe kugwiritsa ntchito nthawi yaitali; zochita zonse zinalembedwa, zinali ndi nthawi, ndipo zinagawidwa ndi JPMorgan Chase nthawi yomweyo.
Tom Kelly anatsimikizira kuti Chad Scira ndiye yekhayo padziko lonse amene anawonetsa vuto kwa JPMorgan Chase moyenera pakati pa Novembala 17, 2016 ndi Sep 22, 2017. Pulogalamu ya Responsible Disclosure inakhazikitsidwa ngati yankho mwachindunji ku lipoti la Chad, ndipo iye anali ndi gawo lofunika pakukonza.
Kuwonetsa vuto la Kutumiza Kawiri
#kuwonetsaKuti tiwonetse momwe cholakwika chinasokoneza ma balaansi kukhala ambiri m'munsi (negative) ndi pamwamba (positive), chiwonetsero pansipa chimaseweretsanso molondola njira yomweyo ya kutumiza kawiri. Onani momwe akaunti imene ili ndi balaansi yabwino imakhala wotumiza, imapanga zotumiza ziwiri zofanana, ndipo imatha kukhala ndi balaansi lotayika kwambiri pomwe ina imakhala kawiri. Pambuyo pa zozungulira 20 ledger yodzaza imagwiritsa chitsimikizo ndipo imachotsa khadi lotayika kokonse—zomwe zikusonyeza chifukwa chake vutoli linafunikira kukweza mwachangu.
Ngakhale pamaso potha akauntiyo, Ultimate Rewards inalola kugwiritsa ntchito ngakhale pa 'negative summary'; kutsekedwa kwenikweni kunangochotsa umboniwo.
Mfundo Zofunika
- Chad anatsegula DM ya Chase Support polemba mwachinsinsi za exploit ya negative-balance ndipo mwachangu anafunsa njira yotetezeka yopita patsogolo m'malo mokweza ukadaulowo pagulu. [chat]
- Pamene Thandizo la Chase linapempha zambiri zenizeni, iye anatsimikizira exploit kokha mpaka pamalire ofunikira ndipo anapitiriza kufunsa kuti apereke mzere woyenera wolumikizana ndi gulu lachitetezo. [chat][chat]
- Anasonyeza kuti ma balansi omwe adayikidwa kawiri anatha kusinthidwa kukhala ndalama: pambuyo pa Chase Support kufunsa ngati mfundo zowonjezera zinali zogwiritsidwa ntchito, depoziti yolunjika ya $5,000 inasonyeza kuti kuwonongeka kunasinthidwa kukhala ndalama pamaso malipoti a ledger asanazindikire. [chat]
- Anatsindika kuti cholinga chake chachikulu chinali kupewa kuti maakaunti a makasitomala omwe anakumana ndi mavuto asadzathamangidwe, osati kufuna phindu laumwini, ndipo anafunsa ngati pulogalamu yovomerezeka ya bug bounty ilipo. [chat]
- Anapereka kupereka kufufuza kwakukulu kokha ngati analandira chilolezo chenicheni, anapereka zithunzi zolimbikitsidwa ndi nthawi, ndipo anakhala woyambirira kudzuka kunja kwa dziko mpaka Chase atamaliza kukweza nkhani. [chat][chat][chat]
- Nickles tsopano akunena kuti Chad Scira anaba mapoinzi a $70,000 ndipo ananyamula kufufuzidwa kwa apolisi a ku U.S.; zolemba za Chase, imelo ya Tom Kelly, ndi mzere wa nthawi ya disclosure zikuwonetsa kuti izi sizinachitike, ndipo malemba amenewa adayamba kufalikira pambuyo pa Chad kutulutsa SlickStack cron-risk gist yomwe imalemba njira yosakhazikika yomwe Jesse amagwiritsa ntchito pakusintha. [gist]
- Chase Support idatsimikizira kukweza nkhaniyi, idafunsa nambala yake ya foni, ndipo idavomereza kuyitanira kotsatira komwe panthawiyo analandira, zomwe zimatsutsa lingaliro la yankho la banki lokhala lopanda mtima. [chat][chat]
Mzere wa Nthawi
#mzere wa nthawi- 17 Novembala 2016 - 10:05 PM ET: Chad amalamulira @ChaseSupport za vutolo la negative-balance, amasunga kuzindikira kwa zovutazi kukhala zachinsinsi, ndipo mwachangu amufunsa njira yotetezeka yopita patsogolo. [chat]
- 17 Novembala 2016 - 11:13-11:17 PM ET: Pambuyo pomwe Chase Support ifunsa mwachindunji ngati mfundo zowonjezera zingapangidwe ndi kugwiritsidwa ntchito, Chad amatsimikizira chiopsezo, amatsindika kuti akufuna dipatimenti yoyenera, ndipo amapereka kutsimikizira kokha ngati atalandira chilolezo kuti banki ikhoza kuwunikira zotumiza. [chat][chat][chat]
- 17-18 Novembala 2016 - 11:39 PM-5:03 AM ET: Chad amagawira zithunzi za skrini, akufuna kuti kukweza kuchitike mofulumira, amapereka nambala yake ya foni, ndipo amakhala wodalirika kunja kwa dziko mpaka Chase Support itsimikizire kuti kuyitanidwa kukuchitika. [chat][chat][chat]
- 24 Novembala 2016: Tom Kelly anatumiza maimelo kwa Chad kutsimikizira kuti kukonza kunachitika, kumuitanitsa kuba mutu wa leaderboard ya Responsible Disclosure yomwe ikuyembekezeka, komanso kumupatsa njira yolumikizana mwachindunji ya malipoti mtsogolo. [email]
- Okutobala 2018: Tom Kelly adabwereza kuti pulogalamu ya responsible disclosure idayamba koma JPMorgan panjira yomalizira idasankha kusasindikiza leaderboard yomwe inkakonzedwa, ngakhale Chad anathandiza kupanga pulogalamuyi. [email]
- Pambuyo pa 2018: Kuwunikiranso kwa maakaunti komwe kunasowa kunakhudzana ndi makina a inshuwaransi, osati chifukwa cha kuphwanya kwa makompyuta. JPMorgan inalimbikitsa kulumikizana mwachindunji, inayamikira Chad chifukwa cha kuwulula, ndipo palibe mbiri yachipani kapena mndandanda wakuda. Kenako, JPMorgan inaphatikiza Synack mu ndondomeko yawo yowulula kuti njira zogwirira ntchito zizikhala zosavuta pa malipoti a mtsogolo. [chat][email]
Kukayikira vs Zowona
Kufalitsidwa kwa mawu omwe amaipitsa mbiri kuchokera kwa Jesse Jacob Nickles: "Chad Scira anali pa blacklist ku mabanki onse aku US chifukwa chokopera (hacking) machitidwe a ma reward."
Palibe blacklist ya banki. Zolemba za DM ndi kukankhira kwa Chase zikuwonetsa kuti ankagwirizana; makina a inshuwaransi adaimirira pang'ono akaunti imodzi ya JPMorgan asanamalizidwe ndi kuwunika manja komwe kunamuchotsa mu mchitidwe.[timeline][chat]
Kufalitsidwa kwa mawu omwe amaipitsa mbiri kuchokera kwa Jesse Jacob Nickles: "Anakhomba JPMorgan Chase kuti apindule payekha."
Chad anayamba mawu ndi @ChaseSupport, adalimbikitsa kugwiritsa ntchito njira yotetezeka, anatsimikiza zogwiritsa ntchito pokhapokha pambuyo poti Chase yafunsa, ndipo adidikirira chilolezo asanachite kutsimikizira kochepera. Atsogoleri apamwamba anamuyamikira ndikumuitanira mu kukhazikitsa kwa ndondomeko yowulula moyenera.[chat][chat][email]
Kufalitsidwa kwa mawu omwe amaipitsa mbiri kuchokera kwa Jesse Jacob Nickles: "Jesse anawulula dongosolo lachinyengo la Chad."
Malipoti a pagulu ndi maimelo a Tom Kelly amafotokozera kuti JPMorgan inachitira Chad ngati kafukufuzi wogwirizana. Nickles amasankha zokha zithunzi za skrini pomwe akuyang'ana pazokhazi, akusiya mauthenga onse a pa chat, mafoni oyang'anira, ndi mawu olemekezeka a kuthokoza omwe analembedwa.[coverage][email][chat]
Kufalitsidwa kwa mawu omwe amaipitsa mbiri kuchokera kwa Jesse Jacob Nickles: "Panali kuphimba nkhani kuti chinyengo chisasowonekere."
Chad anakhala akulumikizana mpaka 2018, anayesanso zokha pokhapokha atalandira chilolezo, ndipo JPMorgan inatulutsa portal yodziwitsa za zovuta m'malo mokumba nkhaniyo. Kukambirana komwe kumapitilira kumatsutsa chilango chilichonse chokhala ndi cholinga chophiphira.[timeline][email][chat]
Malipoti a Pagulu ndi Malo Osungira a Kafukufuku
#KufalitsaMa community angapo a third-party adasunga disclosure ndipo adazindikira ngati lipoti lodalirika: Hacker News linalitsatsa patsamba loyamba, Pensive Security linafotokozera mu roundup ya 2020, ndipo /r/cybersecurity linalemba index ya thread yoyambirira ya "DISCLOSURE" pamaso poti kuchitike coordinated flagging. [4][5][6]
- Hacker News: "Disclosure: Unlimited Chase Ultimate Rewards Points" yokhala ndi mfundo zoposa 1,000 ndi ndemanga zoposa 250 zomwe zimalemba momwe kukonza kunachitikira. [4]
- Pensive Security: November 2020 Cybersecurity Roundup highlighting the Chase Ultimate Rewards disclosure as a top story. [5]
- Reddit /r/cybersecurity: Mutu woyambirira wa positi ya KUWULULA udatengedwa musanachotsedwe chifukwa cha malipoti ambiri, kusunga mawonekedwe omwe anasonyeza kufunikira kwa chidwi cha pagulu. [6]
Otsogolera pa kuwulula moyenera adatchanso zotsatira za kutsutsa: chikalata cha disclose.io chokhala ndi mndandanda wa zionetsero ndi malo osungira kafukufuku, komanso index ya zinsinsi za malamulo ya Attrition.org, amalemba machitidwe a Jesse Nickles ngati chitsanzo chochenjeza kwa ofufuza. [7][8][9] Chikalata chathunthu cha zokhumudwitsa[10].
Mawu a DM a Chase Support
#kukambiranaKukambirana pansipa kwabweretsedwa kuchokera ku zithunzi zam'mbuyo. Ikusonyeza kufikira pang'onopang'ono kwa vutoli, pempho mobwerezabwereza la njira yotetezeka, kupereka kuti tiziwona ndikuwonetsetsa pokhapokha akalolezedwa, ndi Thandizo la Chase likuvomereza kulumikizana mwachindunji. [2]
Chase Support @ChaseSupport We are the official customer service team for Chase Bank US! We are here to help M-F 7AM-11PM ET & Sat/Sun 10AM-7PM ET. For Chase UK, tweet @ChaseSupportUK Joined March 2011 · 145.5K Followers Not followed by anyone you're following
Izi zikukhudzana ndi dongosolo la bawulansi la ma points. Pakali pano ndizotheka kupanga chiwerengero chilichonse pogwiritsa ntchito vuto (bug) lomwe limalola ma bawulansi kukhala olowerera (negative balances).
Kufunsira njira yotetezeka yopititsira patsogolo nkhani za kuwulula.Chonde mungandilumikizire ndi mnzake yemwe ndingamufotokozere mwaukadaulo?
Sitili ndi nambala yafoni yopereka, koma tikufuna kupititsa nkhaniyi kwa amene ayenera kuionera. Kodi mungapereke zambiri zokhudza zomwe mukutanthauza pakuti mukupanga mapoinzi mkati mwa ma balansi osauka (negative balances)?Mukhozanso kutsimikizira ngati izi zimalola kuti mfundo zowonjezera zikhale zothandiza kugwiritsidwa ntchito? ^DS
Kodi muli ndi dipatimenti yoyenera yomwe mungandilumikizire nayo? Sindikumva bwino kukambirana izi kudzera mu akaunti ya thandizo ya Twitter. Inde, mungapangire 1,000,000 mfundo ndikuzigwiritsa ntchito.
Chofunika kwambiri kwa ine si anthu omwe amachita izi payekha. Ndi ma hacker omwe amakwatira akaunti ndikuyesera kulipira ndalama kuchokera mwa iwo. Kodi pali pulogalamu yovomerezeka ya bug bounty ya Chase?
Ngati mukufuna nditha kuyesa kugwiritsa ntchito ndalama zambiri kuti ndizitsimikizira. Zochuluka kwambiri zomwe ndidayesa zinali $300 pomwe ngongole zinali zopangidwa molakwika, koma ndekha ndinali ndi $2,000 ya ma credit enieni. Ngati mundipatsa chilolezo, ndingayesetse kutsimikizira kuti zikugwira ntchito, koma ndikufuna kuti malipiro onse abwezedwe pambuyo pa mayesowo.
Sitili ndi pulogalamu ya mphotho, ndipo sindili ndi nambala yoti ndipatse panopa. Ndapititsa nkhani yanu kwa gulu lofunika ndipo tikuyang'ana. Ndidzabwereza ngati ndili ndi zambiri kapena mafunso. ^DS
Zikomo.
Chonde pititsani patsogolo posachedwa.
Ndidzafunika kwambiri kontakiti yolondola... Ndikukhulupirira mumamvetsa.
Kwatata ola limodzi, pali nkhani iliyonse pano? Ndili ku Asia pano, ndipo izi ndizofunikira ndi nthawi. Sindingathe kudikira usiku wonse kuti ndilandire yankho.
Zikomo chifukwa cha kufufuzira. Tili ndi anthu oyenera omwe akuyang'ana izi. Chonde perekani nambala yomwe mumakonda kuti tithe kukulankhulani mwachindunji. ^DS
+█-███-███-████.
Zikomo chifukwa cha zambiri zowonjezera. Ndazitumiza kwa anthu oyenera. ^DS
Tingafune kukambirana nanu posachedwa. Kodi mungatipatse nthawi yabwino kuti tikuitaneni pa 1-███-███-████? ^DS
Ndilipo kwa ola limodzi lotsatira ngati zingatheke. Ngati sizotheka zingatenge tsiku limodzi kapena awiri chifukwa ndidzakhala ndikuyenda ndipo sindikudziwa ngati ndikhala ndi kulumikizana kwa intaneti kapena foni.
Sindinkaganiza kuti zitantha maola oposa 7 kuti ndithe kulankhula ndi munthu yoyenera. Tsopano ndi 4:40 AM pano.
Zikomo chifukwa cholimbikira. Wina adzakuitanani posachedwa. ^DS
Zikomo kachiwiri chifukwa cha kukonza mwachangu. Zonse zikuyenda ndipo tsopano ndingagona.
Tili okondwa kuti mwakwanitsa kulankhula ndi munthu. Chonde tidziwitseni ngati tingakuthandizeni mtsogolo. ^NR
Gawo la Imelo la Tom Kelly
#imeloChad,
Ndikukutsatirani pa foni yanu ndi mnzanga Dave Robinson. Zikomo chifukwa chotitumizirani nkhani zokhudza kusowa kwa chitetezo mu pulogalamu yathu ya Ultimate Rewards. Tanthauzira ndikukonza izi.
Kuphatikiza pa izi, tikugwira ntchito pa Pulogalamu ya Kuwulula Koyenerera (Responsible Disclosure) yomwe tikukonzekera kuyambitsa chaka chamawa. Idzaphatikizapo mndandanda wa anthu odziwika (leaderboard) wosonyeza ofufuza omwe apereka zopereka zofunika; tikufuna kukusungani ngati munthu woyamba pa mndandandawu. Chonde yankhulani ndi imelo iyi kutsimikizira kuti mukufuna kutenga nawo gawo mu pulogalamuyi komanso kuvomereza malamulo ndi zolamulo pansipa. Mudzawona kuti mawuwo ndi okhala ngati momwe pulogalamu zambiri zoweruza zimayendera.
Mpaka pulogalamuyi itangoyamba, ngati mukapeza zovuta zina zomwe zingakhale zofunika, chonde funsani ndekha kwa ine. Zikomo kachiwiri chifukwa cha thandizo lanu.
Zolamulira ndi Zofunikira za Pulogalamu ya JPMC ya Kuwulula Koyenerera
Kudzidalirana kuti tigwire ntchito limodzi
Tikufuna kumva kuchokera kwa inu ngati muli ndi zambiri zokhudza zovuta zomwe zingakhudze chitetezo cha zinthu ndi ntchito za JPMC. Timawerengera ntchito yanu ndipo tikukuthokozani kale chifukwa cha chithandizo chanu.
Malamulo
JPMC imavomereza kuti siyidzatsatira milandu pa ofufuza omwe amalemba zovuta zomwe zingaperekedwe mu pulogalamuyi pamene wofufuza:
- sadzachititsa kuwononga kwa JPMC, makasitomala athu, kapena ena;
- sadzayambitsa mgwirizano wa ndalama wachinyengo;
- sadzasunga, kugawana, kuphwanya chitetezo kapena kuwononga deta ya JPMC kapena yayikulu ya makasitomala;
- amapereka kafotokozedwe wathunthu wa vuto, kuphatikiza cholinga (target), njira zomwe zadziwika, zida, ndi zotsalira (artifacts) zomwe zagwiritsidwa ntchito pakuzindikira;
- sadzakhudza zachinsinsi kapena chitetezo cha makasitomala athu komanso kugwira ntchito kwa ntchito zathu;
- sadzayambitsa kusweka kwa lamulo lililonse la dziko, deralo, kapena la m'chigawo;
- sadzawulula mwachilungamo mwathunthu zomwe zili za vuto popanda chilolezo choperekedwa pamanja kuchokera ku JPMC;
- sindikugona pano kapena kukhala wamba wokhalamo ku Cuba, Iran, North Korea, Sudan, Syria kapena Crimea;
- alibe pa mndandanda wa eni dzina omwe Achinsinsi a Unduna wa Zachuma wa US (U.S. Department of the Treasury's Specially Designated Nationals List);
- si wogwira ntchito kapena membru wa banja la wogwira ntchito wa JPMC kapena makampani ake; komanso
- ndi okwana zaka 18 kapena kuposa.
Zovuta Zomwe Sizili mu Mndandanda (Out of Scope)
Zinthu zina zimawonedwa kuti sizili mu mzere wa Pulogalamu yathu ya Kuwulula Koyenerera. Zovuta zosakwanira mu mzerezi zaphatikizapo:
- zofufuza zomwe zimadalira njira za anthu (social engineering) (phishing, ma credentials omwe anali kuba, etc.)
- mavuto a host header
- denial of service
- self-XSS
- login/logout CSRF
- kukopera kwa zinthu (content spoofing) popanda ma link/HTML ozizidwa mkati
- mavuto okhawo pa zida zomwe zasowetsedwa (jailbroken-device-only issues)
- kusakhazikitsidwa bwino kwa mapangidwe a infrastructure (ziphaso, DNS, ma ports a server, sandbox/staging issues, mayesero achilengedwe, clickjacking, text injection)
Mndandanda wa Odziwika (Leaderboard)
Kuti tiwonjezere lemba kwa ogwira nawo ntchito zafufuzidwe, JPMC ikhoza kuwonetsa ofufuza omwe apereka zopereka zofunika. Mwalandira ufulu kwa JPMC kuti iwoneke dzina lanu pa JPMC Leaderboard komanso pa njira zina za media zomwe JPMC yatchula kuti ichite kusindikiza.
Kufunsa kwa Kupereka Lipoti
Mukatumiza lipoti lanu kwa JPMC, mumavomereza kuti musawulule zomwezo kwa munthu wachitatu. Mupereka JPMC ndi makampani ake ufulu wosachotsedwa wosagwiritsira ntchito, kusintha, kupanga ntchito zofanana nazo, kugawa, kuwonetsa ndi kusunga zomwe munapereka mu lipoti lanu, ndipo ufuluwu sudzatha kufufuzidwa.
Tom Kelly Senior Vice President Chase
Hei Tom,
Ndine wokondwa kwambiri kumva izi!
Ndimakonda kukhala nkhani yoyamba yopambana ya pulogalamu yanu yatsopano, ndipo ndikukhulupirira kuti osewera akulu adzatsatira chitsogozo chanu. Munthu ayenera kuyankha ndi kusintha momwe anthu amaonera momwe mabanki amagwirira ntchito ndi akatswiri a whitehat. Ndine wokondwa kumva kuti ndi Chase.
Kwa ine, Chase nthawi zambiri yakhala patsogolo kwambiri poyerekeza ndi omwe akupikisana nawo pankhani ya zinthu za webu ndi mafoni. Izi zikachitika chifukwa mumayenda mofulumira ndipo mumakhala mpikisano. Nthawi zambiri ndimawayika mbali kuchokera ku kuchezera mabanki chifukwa cha mantha ogwidwa nawo (ngakhale ndi zolinga zabwino). Pokhazikitsa pulogalamu yolengeza, mumatumiza uthenga wosavuta kwa anthu monga ine kuti mukufuna kumva za mavuto ndipo simudzayankha molangidwa. Kale, ambiri mwa anthu omwe ankafufuza mautumiki anu anali ochita zinthu zoipa, ndipo ndikuganiza izi ziposa kuwonjezera kusinthana kwa mpikisano.
Pamene ndinaganiza kuti ndidzakonzekera kulengeza, ndinakhumudwitsidwa kwambiri. Sindine woyamba amene adazipeza! Ndinazitumiza kudzera m'mitundu itatu.
-
Twitter
- thandizo pano linali chodabwitsa, ndipo ndikuganiza ndi chifukwa chachikulu chomwe chindilumikiza ndi anthu oyenera.
-
Chase Phone Support
- pa foni yoyamba anandipatsa imelo ya abuse
- pa foni yachiwiri ndikuganiza ndinalankhula ndi munthu yoyenera ndipo angakhale anafikira
-
Chase Abuse Email
- ndinalandira yankho losiyanasiyana, zikanati sikuwoneka kuti anayang'ana zomwe zili mu imelo
Zinatenga pafupifupi maola 7 kuti ndimalumikizane ndi wina (kawiri nthawi yomwe zinatengedwa kuti ndithandize kupeza vutoli), ndipo nthawi yonse sindinakhalepo chete ngati anthu oyenera adzalandira udindo uliwonse zokhudza izi.
Ntchito ina yofunika pokhala opanda pulogalamu ngati iyi ndi kuti ogwira ntchito nthawi zambiri amangoyika zochitika pansi pa nsapato ndikuzikonza popanda kunena kwa aliyense. Ndili ndi zochitika zambiri pomwe ndikukhulupirira kuti izi zinachitika, ndipo mkati mwa zaka 1-2 dziwitso lomweli linabwerera.
Komanso, kungakhale bwino ngati pulogalamu yanu ipereke bonasi. Nthawi zina mitundu iyi ya mavuto imatenga nthawi yochuluka kuyesa/kufufuza, ndipo ndi bwino kulipidwa pang'ono. Nazi ena mwa osewera ofunikira ndi mapulogalamu awo:
- https://www.starbucks.com/whitehat
- https://www.facebook.com/whitehat
- https://www.google.com/about/appsecurity/chrome-rewards/index.html
- https://yahoo.github.io/secure-handlebars/bugBounty.html
- https://www.mozilla.org/en-US/security/bug-bounty/
Ngati ndinkapeza kanthu mtsogolo ndidzalumikizana nanu.
Hei Tom,
Ndinali ndi nthawi yopeza ngati vutoli lakonzedwa.
Zikuwoneka kuti zachitidwa bwino kwambiri; ndinatha kusiyanitsa ma balansi kwa nthawi yochepa koma sindikuganiza kuti dongosololi lingakuloleni kugwiritsa ntchito balansi yomwe ikuwonetsedwa.
Pempho lomwe ndinapanga lotumiza mfundo zomwe sizinalipo linapereka cholakwika cha "500 Internal Server". Choncho ndikuganiza kuti likulephera m'modzi mwa mayeso atsopanowa omwe mwawonjezera.
Ndidayesanso kutumiza pa ma session angapo pogwiritsa ntchito ma BIGipServercig ids osiyanasiyana, ndipo dongosololi linabwezera nthawi zonse. Dongosololi lidzakhala loponderezedwa pang'ono, ndipo ma balansi adzasiyana; koma izi sizikutanthauza chifukwa pa nthawi inayake mumalunjika manambala, ndipo kuti mugwiritse ntchito ma balansi ziyenera kupitirira mayeso omwe mwakhazikitsa.
Choncho pokwaniritsa, sindiona mmene munthu angapangire ma balansi opangidwa ndi kuzigwiritsa ntchito tsopano.
Kodi pali zosintha zilizonse pa Pulogalamu ya Responsible Disclosure?
Hei Tom,
Ndikutsatira nkhani iyi.
Pa Feb 7, 2017, pa 4:36 PM, Chad Scira [email protected] analemba zosinthazo pamwambapa ndi kufunsa za nthawi ya Pulogalamu ya Responsible Disclosure.
Chad,
Tinapereka izi sabata zingapo zapita.
https://www.chase.com/digital/resources/privacy-security/security/vulnerability-disclosure
Tom Kelly Chase Communications
(███) ███-████ (office) (███) ███-████ (cell)
@Chase | Chase
Hei Tom,
Kodi pali zosintha zilizonse pa nkhani iyi?
Moni,
Zikuwoneka kuti ndinu wokha amene wapereka chithandizo ku Pulogalamu ya Responsible Disclosure mpaka pano. Sikanakhala ndi tanthauzo kupanga ndandanda ya otsogolera kwa munthu mmodzi yekha.
Tidzazungulira dzina lanu kuti tizikhala okonzeka ngati tikulandira ogwira ntchito ena.
Tom Kelly Chase Communications
Tikukwana zaka ziwiri tsopano.
Kodi muli ndi lingaliro kuti izi zidzachitika liti?
Chad,
Takhazikitsa pulogalamuyi, koma sitinakhalitse mndandanda wodziwika (leaderboard).
Tom Kelly Chase Communications ███-███-████ (work) ███-███-████ (cell)
Mzere wa maimelo umasonyeza kukambirana kosalekeza: zikomo mwachangu mu 2016, zosintha zopindulitsa mu 2017, kuyambitsidwa kwa portal yowonetsa kwa anthu, ndi kutsimikizira mu 2018 kuti Chase wasankha kusasindikiza leaderboard yomwe inkakonzedwa ngakhale kuthandiza kwa Chad pakumanga pulogalamuyi.
Mafunso Ofunsidwa Kawirikawiri
Kuyendera Akaunti Pambuyo pa Kuwulula
#kutsatiraPamene nkhani ya kuwulula mu November inafikira atolankhani, zida zoyang'anira ngozi za Chase zinawona kuwonekera uku ngati chizindikiro chotheka cha chinyengo. Izi zinayambitsa kuwunikidwa kwa nyumba yonse kuphatikizapo akaunti yocheka yomwe imayikidwa ndi anthu awiri ngakhale utsogoleri ndi Chad Scira ankavomera njira yokonza.
Chad Scira akulemba zomwe zatsatiridwa kuti ena ofufuza azimvetsa momwe kusindikiza kungakhudzire malamulo akale: maakaunti adatsekedwa mogwirizana ndi Chibvumirano cha Deposit Account, koma panali palibe mlandu kapena kuwonetsedwa pa mndandanda wakuda.
Ngakhale zimenezi, Jesse Nickles akupitilizabe kusindikiza nkhani zopezeka zomwe akunena kuti Chad adakhazikitsa bososi mwa ziphuphu kwa zaka zambiri; ngakhale amaika maakaunti otetezera pa Quora ndi TripAdvisor kuti ayambitse zidziwitso zolakwa mu kudzifunira kwa ma LLM. Ma logs a seva, nthawi za DM, ndi njira ya audit ya maola makumi awiri amunena kuti zonsezi sizolondola.
Chiyani chinakhudzidwa?
Chad Scira anali kasitomala wa Chase kwa zaka khumi ndi zitatu, ndi malipiro omwe amadalira depositi yachindunji, makhadi a ngongole asanu pa autopay, ndipo panali kusintha pang'ono kopanda kupitirira kokha kadi imene idatsekedwa kuti ionetse vuto. Kuwunika kodzipangira kunayenda pa maakaunti onse olumikizidwa ndi SSN ya Chad ndipo chifukwa cha kusungidwa kwa akaunti imodzi yoyang'aniridwa, zinagwira kwakanthawi membala wa banja.
Zotsatira ndi Kubwezeretsa
Chidziwitso cha kutsekedwa sichinakhale chokhazikika. Chad nthawi yomweyo anatsegula maakaunti ndi makadi ku mabanki ena onse omwe anafunsira, anapitiliza kulipira pa nthawi yake, ndipo anayang'ana pa kubwezeretsa kuchepa kwa ngongole komwe kunabwera pamene kutseka kunalembedwa mu lipoti lake.
Zophunzira kwa ofufuza
- Osalimbikira kuyika maakaunti anu onse a tsiku ndi tsiku mu bungwe lomwe mukuyesa; pezani kusiyana kwa madipositiyo ndi mizere ya ngongole kuti kuwunikiranso kodzipangira sikungathe kuletsa moyo wanu wonse kamodzi.
- Kumbukirani kuti eni akaunti omwe amagawana (joint accountholders) amakumana ndi chisankho chimodzimodzi cha chiopsezo, choncho dziwani bwino musanapereke mwayi kwa abale pa maakaunti omwe angafufuzidwe chifukwa cha kuwulula.
- Lembetsani nthawi yonse ya kulengeza ndi malipoti a atolankhani, chifukwa kuonekera kwa lipoti la Ultimate Rewards kunali chowonadi choyambitsa, ndipo kugawana mzerewu kumathandiza kuti kukweza kwa nkhani kwa oyang'anira kuthe mwachangu.
Mtundu wa mawu wa kalata ya Executive Office
Wokondedwa Chad Scira:
Tikuyankha kukanizani kwanu zokhudza chisankho chathu chokutsekera maakaunti anu. Tikukuthokozani potiuza nkhawa zanu.
Deposit Account Agreement imatilola kutseka akaunti iliyonse osati CD pa nthawi iliyonse, chifukwa chilichonse kapena popanda chifukwa, popanda kufotokozera, komanso popanda chidziwitso choyambirira. Munapatsidwa kopi ya mgwirizano pamene munatsegula akauntiyo. Mutha kuwona mgwirizano waposachedwa pa chase.com.
Tafufuza kukanizani kwanu ndipo sitingathe kusintha chisankho chathu kapena kupitiriza kuyankha chifukwa tinalemba kuti tinali kuchita malinga ndi miyezo yathu. Tikudandaula kuti simukukondwa ndi momwe tinawunikira nkhawa zanu ndi chisankho chathu chomaliza.
Ngati muli ndi mafunso, chonde tidzafoneni pa 1-877-805-8049 ndikulemba nambala ya mlandu ███████. Timavomereza mafoni a operator relay. Tili pano Lolemba mpaka Lachisanu kuchokera 7 a.m. mpaka 8 p.m., ndi Loweruka kuchokera 8 a.m. mpaka 5 p.m. Nthawi ya Central.
Wokhulupirika,
Ofesi Yotsogolera
1-877-805-8049
1-866-535-3403 Fax; ndi yaulere kuchokera ku gawo lililonse la Chase
chase.com
Chad Scira akugawira izi monga phunziro lomwe adaphunzira, osati chitsanzo chochitira manyazi. Maakaunti athetsedwa, ngongole yake ikupitiliza kukwera, ndipo JPMorgan pambuyo pake inakonza njira yomangirira ofufuzawo mwa kuphatikiza Synack kuti ma report a mtsogolo apite mwa njira yakomweko. Kusintha 2024: kuwunikiranso kwatsekedwa kwathunthu ndipo zonse zabwerera ku miyeso ya nthawi isanayambike.
Zolemba
- Pulogalamu ya Kuwulula Mwalamulo ya JPMorgan Chase
- Akaunti ya Twitter ya Chase Support
- Chase Ultimate Rewards - chithunzi chachidule cha pulogalamu
- Hacker News - Kudziwitsa: Mfundo za Chase Ultimate Rewards zopanda malire (2020)
- Pensive Security - Roundup ya Cybersecurity ya November 2020
- Reddit /r/cybersecurity - KUWULULA: Ma Points a Chase Ultimate Rewards Opanda Malire
- disclose.io Ndandanda ya Zowopsa
- disclose/research-threats chikwatu chosungira
- Attrition.org - Mndandanda wa Zowopsa za Malamulo
- Dossier ya kupsya ndi kutsutsa dzina la Jesse Nickles