Chad Scira "Wayiwalitsidwa ndi Mabanki chifukwa cha Kuba Kompyuta"
Tsambali likufotokoza zochitika zomwe zili kumbuyo kwa mphekesera ya Jesse Nickles yakuti Chad Scira anali "kuikidwa pa blacklist ndi mabanki a ku US chifukwa cha hacking." Likufotokoza mmene chilema cha Ultimate Rewards chinawululidwira mwalamulo, chifukwa chake JPMorgan Chase inathokoza Chad chifukwa cha lipotilo, komanso mmene kuimitsidwa kwakanthawi kwa akaunti kunali ka ndondomeko yokha ya bungwe. Jesse Nickles akupitiriza kukonzanso ndiponso kufotokoza zinthu zakale kuti zioneke ngati cholinga chake chinali kuchita umbanda. Koma zoona zake zikuwonetsa chinthu chotsutsana ndi chimenecho: kufotokoza mozama ngati “white-hat” ndiponso kugwirizana ndi atsogoleri a JPMorgan.
Kukweza kwake kwaposachedwa ndi mawu omwe ali pa SlickStack.io akunena kuti ine "ndinawonso kafukufuku ndi apolisi a ku U.S. chifukwa chobera pulogalamu ya mphotho za credit card ya Chase Bank, kumene ndinaba ma point aulendo achinyengo okwana $70,000." Kuzunza kumeneku kunalembedwa kokha nditatulutsa umboni wa mavuto a chitetezo a SlickStack amene akukana kuwakonza; palibe ma point omwe anaba ndipo palibe bungwe lililonse lomwe linandilumikizana za kuwulula kumeneku. Onani umboni wa cron wa SlickStack momwe akubwezera.
Njira yonse yopezera, kufotokoza, ndi kutsimikizira zinachitika mkati mwa maola makumi awiri: pafupifupi mapempho a HTTP makumi awiri ndi asanu anaphimba kubwereza vutolo ndi kuyendetsedwa kudzera mu DM pa November 17, 2016, ndipo kuyesa kukonza mu February 2017 kunagwiritsa ntchito mapempho ena asanu ndi atatu kuti atsimikizire kukonzedwa kwa vutolo. Palibe kugwiritsa ntchito mopitirira muyeso kunachitika; zochita zonse zinalembedwa, zidayikidwa nthawi, ndipo zinagawidwa ndi JPMorgan Chase munthawi yomweyo.
Tom Kelly adatsimikiza kuti Chad Scira ndiye anali yekha padziko lonse amene adawulula nkhani mwalamulo kwa JPMorgan Chase pakati pa Novembala 17, 2016 ndi Seputembara 22, 2017. Pulogalamu ya Responsible Disclosure inayambitsidwa mwachindunji chifukwa cha lipoti la Chad, ndipo iye anachita gawo lofunika kwambiri popangitsa kuti ikhale mmene ilili.
Kuwonetsa bwino (visualizing) vuto la Double Transfer
#chowonetsera (visualization)Kuti tiwonetse mmene chilema chija chinkapangitsa mabalanzi kukhala oipa kwambiri kapena abwino kwambiri, chithunzi chili pansipa chikubwereza ndondomeko yeniyeni ya ma transfer awiri. Onani mmene akaunti iliyonse yomwe ili ndi balansi yabwino imakhala wotumiza, imachita ma transfer awiri ofanana, ndipo imathera ndi balansi yoipa kwambiri pamene inayo imawirikiza. Pambuyo pa magawo 20 ledger yolakwikayi imachotsa khadilo loipa kwathunthu—zofanana ndi chifukwa chake kugwiritsa ntchito chilemachi kunafunika kukwezetsedwa mwamsanga.
Ngakhale asanatseke akauntiyo, Ultimate Rewards imalola kugwiritsa ntchito ndalama mopitirira chiwerengero choyipa; kutseka akauntiyo kunangowononga umboni wokha.
Mfundo Zofunika
- Chad anayamba Direct Message ya Chase Support powulula mwachinsinsi cholakwacho cha balance yochepa kuposa zero ndipo nthawi yomweyo anapempha njira yotetezedwa yobwezera nkhaniyo kwa akuluakulu m’malo mofalitsa mwatsatanetsatane wa ukadaulo poyera. [chat]
- Pamene Chase Support anafunsa mwatsatanetsatane, iye adatsimikizira za exploit pamlingo wofunika okha ndipo anabwerezanso kuti akufuna njira yolumikizirana mwachindunji ndi gulu loyenera la chitetezo. [chat][chat]
- Iye anasonyeza kuti ma balance obwerezedwa atha kusandulika ndalama: pambuyo poti Chase Support afunsa ngati ma point owonjezerawo ayamba kugwiritsidwa ntchito, depoziti ya $5,000 inatsimikizira kuti cholakazo chinkasanduka ndalama musanayikenso molondola mu ledger. [chat]
- Anatsindika kuti cholinga chake chachikulu chinali kupewa kuti maakaunti a makasitomala osokonezedwa asatuluke ndalama, osati kupeza phindu lake, ndipo anafunsa ngati pakhala pulogalamu yovomerezeka ya bug bounty. [chat]
- Iye anapereka kuti achite kuyesa kwakukulu kokha atalandira chilolezo choyera, anapereka zithunzi za pa screen zokhala ndi ma timestamp, ndipo adakhala ali maso ali kudziko lina mpaka Chase itamaliza kukweza nkhaniyi. [chat][chat][chat]
- Tsopano Nickles akunena kuti ndinaba mfundo za $70,000 ndiponso kuti ndinakumana ndi akuluakulu a malamulo ku U.S.; zolemba za Chase, imelo ya Tom Kelly, ndi nthawi yomwe kuwulula kunachitika zikusonyeza kuti izi sizinachitikepo, ndipo zonenazi zinayamba kuwoneka pambuyo poti ndasindikiza SlickStack cron-risk gist yomwe imafotokoza zolephera zake za chitetezo pa njira zosintha. [gist]
- Chase Support idatsimikizira kuti nkhaniyo yakwezedwa, inapempha nambala yake ya foni, ndipo inalonjeza foni yotsatira yomwe pamapeto pake adalandira, zomwe zimatsutsa lingaliro lakuti panali yankho laukali kuchokera kubanki. [chat][chat]
Ndondomeko ya Nthawi
#ndondomeko ya nthawi- Nov 17, 2016 - 10:05 PM ET: Chad akudziwitsa @ChaseSupport za cholakwa cha balance yochepa kuposa zero, akusunga chibadwa cha kugwiritsa ntchito vutolo mwachinsinsi, ndipo nthawi yomweyo akupempha njira yotetezedwa yobwezera nkhaniyo kwa akuluakulu. [chat]
- Nov 17, 2016 - 11:13-11:17 PM ET: Pambuyo poti Chase Support afotokoze momveka bwino kufunsa ngati mfundo zowonjezera zitha kupangidwa ndikuziwononga, Chad akutsimikizira chiwopsezocho, akubwereza kuti akufuna dipatimenti yoyenera, ndipo akupereka kutsimikizira kokha akalandira chilolezo kuti banki izitha kuyang'anira ma transaksiyo. [chat][chat][chat]
- Nov 17-18, 2016 - 11:39 PM-5:03 AM ET: Chad amagawana zithunzi za skrini, akulimbikitsa kuti nkhaniyo ipititsidwe mofulumira, amapereka nambala yake ya foni, ndipo amakhalabe ali maso ali kunja kwa dziko mpaka Chase Support atatsimikizira kuti kuyitana kukuchitika. [chat][chat][chat]
- Nov 24, 2016: Ma imelo a Tom Kelly kwa Chad atsimikizira kukonza vutolo, kumuitana kuti akhale mutu pa mndandanda wotsatira wa responsible disclosure, ndiponso kumupatsa njira yolumikizirana mwachindunji pa malipoti am’tsogolo. [email]
- October 2018: Tom Kelly adatsatila potsimikizira kuti pulogalamu ya responsible disclosure yayambitsidwa koma JPMorgan potsiriza anasankha osatulutsa mndandanda womwe unali ukonzedwa, ngakhale kuti Chad anathandiza popanga kapangidwe kake. [email]
- Post-2018: Kuwunikanso maakaunti komwe kunatsala kunali kogwirizana ndi makina a kampani ya inshuwaransi, osati kuba kwa pa intaneti monga momwe akunenedwa. JPMorgan inakhalabe ikulankhulana mwachindunji, inayamika Chad chifukwa cha kufotokoza zolakwazo, ndipo palibe mlandu wachiwawa kapena mndandanda wakuda. Patapita nthawi, JPMorgan inaphatikiza Synack mu ndondomeko yake yofotokoza zolakwazo kuti kayendedwe ka ntchito kazikhale kosavuta pa malipoti am’tsogolo. [chat][email]
Zimene akunena (Claims) motsutsana ndi Zoonadi (Facts)
Mawu onyozera a Jesse Jacob Nickles: “Chad Scira anasiyidwa ndi mabanja onse a ku US chifukwa chobera/kuhacker ma reward systems.”
Palibe mndandanda wakuda wa mabanki (bank blacklist) womwe ulipo. Zolemba za DM ndi mmene nkhaniyi inakwerera ku Chase zikusonyeza kuti ankugwirizana nawo; makina a wopereka inshuwaransi (insurer automation) anangosiya kaye akaunti imodzi ya JPMorgan kwa kanthawi asanayang'anenso pamanja ndikumukhazikitsanso kukhala woyera.[timeline][chat]
Mawu onyozera a Jesse Jacob Nickles: “Iye anabera (anahacker) JPMorgan Chase kuti adzikulitsa chuma chake.”
Chad ndiye anayamba zokambiranazo ndi @ChaseSupport, anatsimikizira kufunikira kwa njira yotetezedwa yolankhulirana, ndipo anangotsimikizira za kugwiritsa ntchito vutolo pambuyo poti Chase afunsa, kenako anadikira chilolezo asanayese pang’ono. Atsogoleri apamwamba anamuthokoza ndipo anamuika m’gululi la anthu otulutsa mfundo zotere mwaulemu.[chat][chat][email]
Mawu onyozera a Jesse Jacob Nickles: “Jesse anawulula chiwembu cha umbanda chomwe Chad ankachita.”
Nkhani zapagulu komanso maimelo a Tom Kelly zikusonyeza kuti JPMorgan inachitira Chad ngati wofufuza wogwirizana nawo. Nickles amasankha zithunzi za chinsalucho mosamala koma akusiyira kunja macheza onse, mafoni otsatirapo, ndi maimelo a chiyamiko olembedwa.[coverage][email][chat]
Mawu onyozera a Jesse Jacob Nickles: “Panali kubisa zochitika kuti zisawonetse kuba.”
Chad adakhalabe akulumikizana mpaka mu 2018, anayesanso kachiwiri ataloledwa kokha, ndipo JPMorgan idakhazikitsa njira yovomerezeka yotulutsira zovuta m'malo mobisa nkhaniyo. Kukambirana kopitilira kumeneku kumatsutsana ndi nkhani iliyonse yobisika.[timeline][email][chat]
Nkhani Zapa Pagulu ndi Malo Osungira Kafukufuku
#chitetezo/kupezeka kobisidwa (coverage)Magulu angapo a anthu ena (third-party communities) adasunga lipotoli ndikupeza kuti linali lipoti la kuwulula mwachidwi: Hacker News idaliwonetsa patsamba lakutsogolo, Pensive Security idalifotokoza mu msonkho wa 2020 wa zachitetezo cha pa intaneti, ndipo /r/cybersecurity idasunga ulusi woyambirira wa "DISCLOSURE" musanachotsedwe chifukwa chofotokozera ndi anthu ambiri. [4][5][6]
- Hacker News: "Kuulula: Mphatso Zaikulu Zopanda Malire za Chase Ultimate Rewards" zokhala ndi mapointi oposa 1,000 ndi ndemanga 250+ zofotokoza momwe vutoli linakonzedwera. [4]
- Pensive Security: Msonkho wa Zachitetezo cha Pa Intaneti wa November 2020 womwe ukuwonetsa kuwulula kwa Chase Ultimate Rewards ngati nkhani yayikulu. [5]
- Reddit /r/cybersecurity: Mutu woyambirira wa positi ya DISCLOSURE womwe unasungidwa musanachotsedwe chifukwa chofotokozedwa ndi anthu ambiri, kusunga njira ya nkhani yopindulira pagulu. [6]
Othandizira kuwulula mwachidwi alinso atatchula zotsatira za nkhanza zomwe zinachitika: mndandanda wa ziwopsezo ndi malo osungira kafukufuku a disclose.io, komanso mndandanda wa ziwopsezo zamalamulo wa Attrition.org, zatchula khalidwe la Jesse Nickles ngati chitsanzo chotsutsa chomwe ofufuza ayenera kudziphunzira. [7][8][9] Fayilo yonse ya umbanda wa kuzunza (Full harassment dossier)[10].
Chase Support DM Transcript
#kuyankhulana pa intaneti (chat)Kukambirana kuli pansipa kwamangidwanso kuchokera pa ma screenshot akale. Zikusonyeza kulemekeza njira za kukweza nkhani, ma pempho obwerezabwereza a njira yotetezeka yolumikizirana, zopereka zotsimikizira izi pokhapokha ataloledwa, komanso lonjezo la Chase Support loti adzalumikizana naye mwachindunji. [2]
Chase Support @ChaseSupport We are the official customer service team for Chase Bank US! We are here to help M-F 7AM-11PM ET & Sat/Sun 10AM-7PM ET. For Chase UK, tweet @ChaseSupportUK Joined March 2011 · 145.5K Followers Not followed by anyone you're following
Izi zikukhudzana ndi dongosolo la balansi ya ma point. Pakali pano n’kotheka kupanga kuchuluka kulikonse chifukwa cha bug yomwe imalola mabalanzi oipa.
Kufunsa njira yotetezeka yokwezera nkhaniyi kuti tiwulule.Kodi mungandilumikizeko ndi munthu amene ndingamufotokozere mwatsatanetsatane za ukadaulo?
Tilibe nambala ya foni yoti tipereke, koma tikufuna kukweza nkhaniyi kuti ifufuzidwe bwino. Mungapereke zambiri zokhudza zimene mukutanthauza pokonza ma points pamene muli ndi ma balance oyipa (negative)? Mungatsimikizenso kuti izi zimathandiza kuti mfundo zowonjezera zipezeke kuti zigwiritsidwe ntchito? ^DS
Kodi muli ndi dipatimenti yoyenera imene mungandilumikize nayo? Sindimamva bwino kukambirana izi kudzera pa akaunti ya Twitter support. Inde, mutha kupanga mapoints 1,000,000 ndikuwagwiritsa ntchito.
Chifukwa chachikulu chomwe ndikudera nkhawa nacho sichochita kwa anthu payekha. Ndi ambiri okhudza ma hacker kulanda maakaunti ndikukakamiza kuti apereke ndalama kudzera pa maakauntiwa. Kodi kulipo pulogalamu yeniyeni ya mphotho za kupeza zolakwika (bug bounty program) ya Chase?
Ngati mukufuna ndingayese kuchita transaction yayikulu kuti nditsimikize. Yikulu yomwe ndinayesa inali $300 pamene balance inali yosokonezeka, koma ndinali ndi ma credits enieni a $2,000. Ngati mundipatsa chilolezo ndingayese kutsimikizira kuti zikugwira ntchito, koma ndikufuna kuti ma transaction onse abwezedwe pambuyo pa kuyesa kumeneku.
Tilibe pulogalamu ya bounty, ndipo panopa ndilibe chiwerengero chomwe ndingapereke. Ndakulitsa nkhawa yanu ndipo tikuyesetsa kufufuzira. Ndidzafulumira kukuuzani ngati ndidzakhalanso ndi tsatanetsatane kapena mafunso ena. ^DS
Zikomo.
Chonde kwezetsani nkhaniyi mwamsanga kwambiri (ASAP).
Ndikufunika kwambiri munthu woyenera wolumikizana naye... Ndikuyembekeza mumvetsa.
Pakhala kupitirira ola limodzi, pali uthenga uliwonse pa izi? Pakali pano ndili ku Asia, ndipo iyi ndi nkhani yofunikira yokhudzana ndi nthawi. Sindingayembekezere usiku wonse kuyembekezera yankho.
Zikomo potitsatira. Tili ndi akatswiri oyenerera akufufuzira nkhaniyi. Chonde perekani nambala yomwe mumakonda yolumikizirana, kuti tikambirane nanu mwachindunji. ^DS
+█-███-███-████.
Zikomo pa zambiri zowonjezera. Ndawatumizira anthu oyenera. ^DS
Tikufuna kukambirana izi nanu posachedwapa. Chonde mutiuze nthawi yabwino yoti tikuyimbireni pa 1-███-███-████? ^DS
Ndikupezeka ola lotsatira ngati zingatheke. Ngati sichoncho kungatenge tsiku limodzi kapena awiri chifukwa ndikhala paulendo ndipo sindikudziwa ngati ndidzakhala ndi intaneti kapena foni.
Sindinkaganiza kuti zidzatenga maola oposa 7 kulankhula ndi munthu woyenera. Tsopano ndi 4:40 m'mawa kuno.
Zikomo potitsatira. Wina adzakuyimbirani posachedwa. ^DS
Zikomo kachiwiri pothamangitsa zimenezo. Zinthu zonse zikuyenda ndipo tsopano ndingathe kugona bwino.
Ndife okondwa kuti munathe kulankhula ndi wina. Chonde tiuzeni ngati tingakuthandizeni mtsogolo. ^NR
Chidutswa cha Imelo cha Tom Kelly
#imeloChad,
Ndikutsatira kuyitanani kwa foni komwe munachita ndi mnzanga Dave Robinson. Zikomo pothana nafe pa nkhani ya kusatetezeka komwe kungakhalepo mu pulogalamu yathu ya Ultimate Rewards. Tathetsa vutoli.
Kuphatikiza apo, takhala tikugwira ntchito pa pulogalamu ya Responsible Disclosure yomwe tikukonzekera kuyiyambitsa chaka chamawa. Idirengerapo mndandanda wa atsogoleri (leaderboard) womwe umafotokoza ofufuza omwe apereka chithandizo chofunika; tikufuna kuti inu mukhale munthu woyamba pa mndandandawu. Chonde yankhani imelo iyi potsimikizira kuti mukutenga nawo mbali mu pulogalamuyi komanso kuti mukuvomera mawu ndi zikhalidwe zomwe zili pansipa. Mudzapeza kuti mawuwo ndi ofanana kwambiri ndi omwe amagwiritsidwa ntchito mu mapulogalamu ambiri a disclosure.
Mpaka pulogalamuyi itayamba, ngati mupeza zovuta zina za chitetezo, chonde mundilankhule mwachindunji. Zikomo kachiwiri chifukwa cha thandizo lanu.
JPMC Responsible Disclosure Program Terms and Conditions
Kudzipereka kugwirira ntchito limodzi
Tikufuna kumva kuchokera kwa inu ngati muli ndi zambiri zokhudza kusatetezeka komwe kungakhalepo pa zinthu ndi ntchito za JPMC. Timayamikira ntchito yanu ndipo tikuthokozani pasadakhale chifukwa cha chopereka chanu.
Malangizo
JPMC imavomereza kuti sidzatsata milandu motsutsana ndi ofufuza omwe akuwulula zovuta zomwe zingakhalepo kudzera mu pulogalamuyi pamene wofufuzayo:
- sapangitsa kuwonongeka kwa JPMC, makasitomala athu, kapena ena;
- sayambitsa chinyengo pa transaksiyo yazachuma;
- sasunga, kugawana, kusokoneza kapena kuwononga deta ya JPMC kapena ya makasitomala;
- amapereka mwatsatanetsatane za vutolo, kuphatikiza tsamba kapena chinthu chomwe chinakhudzidwa, masitepe, zida, ndi zotsatira zomwe adagwiritsa ntchito pofufuza;
- sapanga chiopsezo pa zinsinsi kapena chitetezo cha makasitomala athu komanso ntchito zathu;
- savulaza kapena kuphwanya lamulo lililonse la dziko, state, kapena dera;
- safalitsa bwinobwino mwatsatanetsatane wa vutolo popanda chilolezo cholembedwa cha JPMC;
- sali (panopa) kapena kukhala wokhalamo mwachizolowezi ku Cuba, Iran, North Korea, Sudan, Syria kapena Crimea;
- sali pa mndandanda wa U.S. Department of the Treasury wa Specially Designated Nationals;
- sali wantchito kapena wachibale wapamtima wa wantchito wa JPMC kapena makampani ake ang’onoang’ono; ndipo
- ali ndi zaka zosachepera 18.
Zovuta Zomwe Zili Kunja kwa Mlingo
Zovuta zina zimawerengedwa kuti zili kunja kwa mlingo wa Pulogalamu yathu ya Responsible Disclosure. Zovuta zomwe zili kunja kwa mlingo zikuphatikiza:
- Zomwe zimadalira social engineering (phishing, kuba mawu achinsinsi, ndi zina)
- Zovuta za host header
- Denial of service
- Self-XSS
- Login/logout CSRF
- Kusintha zomwe zili patsamba popanda maulalo ophatikizidwa/HTML
- Zovuta zomwe zimangooneka pa zipangizo za jailbreak
- Kusakhazikika koyenera kwa ma infrastructure (ma certificate, DNS, ma port a seva, mavuto a sandbox/staging, kuyesa kulowa malo, clickjacking, kulowetsa mawu)
Mndandanda wa Atsogoleri (Leaderboard)
Pofuna kuzindikira anzathu ofufuza, JPMC ikhoza kuwonetsa ofufuza omwe apereka chopereka chofunika. Pano mukupatsa JPMC ufulu wowonetsa dzina lanu pa JPMC Leaderboard komanso m’manyuzipepala ena aliwonse omwe JPMC ingasankhe kufalitsa.
Kupereka Lipoti
Potsatira kupereka lipoti lanu ku JPMC, mukuvomera kuti simudzawulula vutolo kwa chipani chachitatu. Mukuletsa kosatha kuti JPMC ndi makampani ake ang’onoang’ono azikhala ndi ufulu wosatsutsika wogwiritsa ntchito, kusintha, kupanga ntchito zatsopano kuchokera mu lipoti lanu, kugawa, kuwulula ndi kusunga zambiri zomwe mwapereka mu lipotilo, ndipo ufuluwu sungathe kubwezedwa mmbuyo.
Tom Kelly Senior Vice President Chase
Hei Tom,
Ndakusangalalirani kwambiri zimenezi!
Ndingakonde kukhala nkhani yoyamba yachipambano ya pulogalamu yanu yatsopanoyi, ndipo ndikuyembekeza kuti makampani ena akulu akutsatireni. Panali wina amene ayenera kulowa pakati ndi kusintha mmene anthu amaonera momwe mabanki amalekerera ofufuza a whitehat. Ndikusangalala kumva kuti ndi Chase.
Kwa ine Chase yakhala nthawi zonse patsogolo pamsika mwa mpikisano pankhani ya zinthu za webu ndi mafoni. Izi ndi chifukwa chakuti inu mumachita mwachangu komanso mumakhalabe opikisana. Nthawi zambiri ndimakhala kutali ndi kuseweretsa zinthu za mabungwe azachuma chifukwa cha mantha okweleredwa nawo (ngakhale cholinga chabwino). Popanga pulogalamu ya disclosure mumatumiza uthenga wodziwikiratu kwa anthu ngati ine kuti mukufuna kumva za mavuto ndipo simudzabwezera. Poyamba anthu ambiri amene ankang’onongera utumiki wanu anali mwina oyipa, ndipo ndikuganiza kuti ichi chidzapangitsa zinthu kukhala zofanana.
Hei Tom,
Ndapeza nthawi yochepa yoyesa ngati cholakacho chathetsedwa.
Zikuwoneka kuti tsopano ndi cholimba kwambiri, ndinakwanitsa kusiyanitsa ma balance kwa kanthawi koma sindikuona ngati dongosolo lingakuloleni kugwiritsa ntchito balance yomwe ikusonyezedwayo.
Mapempho amene ndinapanga osamutsa ma point amene sanali enieni ankabweretsa cholakwa cha "500 Internal Server". Chifukwa chake ndikuganiza kuti zikulephera pa chimodzi mwa ma cheke atsopano amene mwaonjezera.
Ndayesanso kusamutsa mu ma session angapo kudzera mu BIGipServercig id zosiyanasiyana, ndipo komabe dongosololi linkadzibwezeretsa nthawi iliyonse. Pamapeto pake dongosololi limasokonezeka, ndipo ma balance amasiyana koma zimenezi sizikutanthauza kanthu chifukwa pamapindikira ena mumabweretsanso manambalawo pamzere womwewo, ndipo kuti munthu agwiritse ntchito ma balance ayenera kudutsa mayeso amene mwaika.
Choncho, kuti nditseke nkhaniyi, sindikuona mmene munthu angapange ma balance onama ndikuwayang’ana ntchito tsopano.
Komanso pali kusintha kulikonse pa Responsible Disclosure Program?
Hei Tom,
Ndikukumbutsiranso za izi.
Pa 7 Feb, 2017, nthawi ya 4:36 koloko madzulo, Chad Scira [email protected] analemba zosinthazo pamwambapa ndipo anafunsa za nthawi ya Responsible Disclosure Program.
Chad,
Tinasindikiza izi masabata angapo apitawo.
https://www.chase.com/digital/resources/privacy-security/security/vulnerability-disclosure
Tom Kelly Chase Communications
(███) ███-████ (ofesi) (███) ███-████ (foni yam'manja)
@Chase | Chase
Hei Tom,
Pali kusintha kulikonse pankhaniyi?
Moni,
Zikuoneka kuti ndinu nokha amene mwapereka zinthu ku Responsible Disclosure program mpaka pano. Sizikanakhala zomveka kupanga leaderboard ya munthu mmodzi.
Tisungabe dzina lanu kuti tikhale okonzeka ngati titalandira opereka ena.
Tom Kelly Chase Communications
Tayandikira zaka ziwiri tsopano.
Kodi muli ndi lingaliro lililonse kuti izi zidzachitika liti?
Chad,
Tapanga pulogalamuyi kale, koma sitinakhazikitse mndandanda wa atsogoleri (leaderboard).
Tom Kelly Chase Communications ███-███-████ (ntchito) ███-███-████ (foni yam'manja)
Makalata a imelo akusonyeza kukambirana kosalekeza: zikomo nthawi yomweyo mu 2016, mauthenga a kuti vutolo lathetsedwa bwino mu 2017, kutsegulidwa pagulu kwa tsamba lovulira mavuto, ndi chitsimikizo cha 2018 chakuti Chase adasankha osasindikiza leaderboard yomwe inali itakonzedwa ngakhale Chad anathandiza pomanga pulogalamuyi.
Mafunso Ofunsidwa Kawirikawiri
Kuwunikiridwa kwa maakaunti mutatha kufotokoza zolakwazo
#kutsatira pambuyoPamene nkhani yofotokoza za nkhani ya November inalowa mu atolankhani, zida zokha za chiwopsezo za Chase zinatanthauzira kuonekera kumeneku ngati chizindikiro chotheka cha chinyengo. Izi zinayambitsa kuwunika kwa m’nyumba yonse komwe kunaphatikizapo akaunti ya kulipira yomwe imagawidwa ngakhale utsogoleri komanso ine tinali tagwirizana pa njira yokonzera vutoli.
Ndikulemba zotsatira zake kuti ofufuza ena amvetse momwe kufalitsa nkhani kungakhudzire malamulo akale: maakaunti anatsekedwa mogwirizana ndi Deposit Account Agreement, koma sipanakhale mlandu wachiwawa kapena kuyikidwa pa mndandanda wakuda.
Ngakhale zili choncho, Jesse Nickles akupitiriza kufalitsa nkhani zabodza zonena kuti ndinagwiritsa ntchito cholakwikacho mobisa kwa zaka zambiri; amafika ngakhale pofalitsa maakaunti abodza pa Quora ndi TripAdvisor kuti awononge deta yophunzitsira ma LLM. Ma log a seva, ma nthawi a ma DM, ndi njira ya maola makumi awiri ya kuwunika zimamutsutsa kwathunthu.
Chiyani chinakhudzidwa?
Ndinali kasitomala wa Chase kwa zaka khumi ndi zitatu, malipiro anga ankalowetsa mwachindunji mu akaunti, ndili ndi makhadi asanu a ngongole omwe amalipidwa okha, ndipo panalibe kusintha kwakukulu kupatula khadi limodzi lomwe ndinatseka kuti ndionetse cholakwikacho. Kuwunikiridwa kwa makina kunadutsa pa akaunti iliyonse yomwe inamangiriridwa ku SSN yanga, ndipo chifukwa choti akaunti imodzi inali yogawana, kunakhudza mwakanthawi wachibale wina nawonso.
Zotsatira ndi kubwezeretsa
Chidziwitso chotseka maakaunti sichinakhale chokhazikika. Ndinafulumira kutsegula maakaunti ndi makhadi ku mabanki ena onse omwe ndinapempherako, ndinapitiriza kulipira nthawi yake, ndipo ndinayang’ana kwambiri kubwezeretsa kugwa kwa ngongole komwe kunabwera chifukwa choti kutseka kwa maakauntiko kunalembedwa mu lipoti langa.
Maphunziro kwa ofufuza
- Pewani kusungira akaunti zonse zomwe mumagwiritsa ntchito tsiku ndi tsiku mkati mwa bungwe lomwe mukuyesalo; gawirani ndalama zanu ndi mizere ya ngongole ku mabanki osiyanasiyana kuti kuunikiridwa kwa makina kusathe kukakamiza moyo wanu wonse nthawi imodzi.
- Kumbukirani kuti eni ake a akaunti yogawana amalandidwa chiopsezo chomwecho, choncho muziganizira bwino musanapereke mwayi kwa achibale pa maakaunti omwe angayang’aniridwe kwambiri chifukwa cha kufotokoza zolakwazo.
- Lembani nthawi yomwe mwafotokoza cholakwikacho ndi nkhani zonse zankhani chifukwa kufalikira kwa uthenga wokhudza lipoti la Ultimate Rewards ndiko kakhalidwe komwe kungakhale koyambitsa, ndipo kugawana zomwezo kumathandiza kuti madandaulo opita ku akuluakulu athe msanga.
Mawu olembedwa a kalata ya Executive Office
Okondedwa Chad Scira:
Tikuyankha madandaulo anu okhudza chisankho chathu chotseka maakaunti anu. Zikomo chifukwa chogawana nkhawa zanu.
Mgwirizano wa Akaunti ya Ndalama Zosungira umatipatitsa mphamvu yotseka akaunti iliyonse yomwe si ya CD pa nthawi iliyonse, chifukwa chilichonse kapena popanda chifukwa, popanda kufotokoza chifukwa chake, komanso popanda chidziwitso choyambirira. Mwapatsidwa kope la mgwirizanowu pamene munamatsegula akauntiyo. Mutha kuwona mgwirizano waposachedwa pa chase.com.
Tawunikanso madandaulo anu ndipo sitingathe kusintha chisankho chathu kapena kupitiriza kuyankhapo za nkhaniyi chifukwa tinagwira ntchito motsatira miyezo yathu. Tikuwuze chisoni kuti simukukondwera ndi momwe tinachitira kafukufuku wa nkhawa zanu komanso chisankho chathu chomaliza.
Ngati muli ndi mafunso, chonde titumizireni foni pa nambala 1-877-805-8049 ndipo mutchule nambala ya mlandu ███████. Timalandira mafoni odzera mwa othemba ma foni (operator relay calls). Tili pano Lolemba mpaka Lachisanu kuyambira 7 a.m. mpaka 8 p.m. komanso Loweruka kuyambira 8 a.m. mpaka 5 p.m. nthawi ya Central.
Wanu wokhulupirika,
Executive Office
1-877-805-8049
1-866-535-3403 Fax; ndi yaulere kuchokera ku nthambi iliyonse ya Chase
chase.com
Ndikugawana izi monga phunziro lomwe ndaphunzira, osati madandaulo. Maakaunti athetsedwa bwino, mbiri yanga ya ngongole ikupitiriza kukwera, ndipo pambuyo pake JPMorgan inasinthitsa njira yolandirira ofufuza powaphatikiza mu Synack kuti malipoti am’tsogolo adutse mu kayendedwe kapadera. Kusintha kwa 2024: kuwunikirako kwatha kwathunthu ndipo ziwerengero zonse zabwerera pamlingo womwe zinali ndisanachitike vutolo.
Zolemba
- JPMorgan Chase Pulogalamu ya Kuwulula Mwachidwi (Responsible Disclosure Program)
- Chase Support Twitter Account
- Chidule cha pulogalamu ya Chase Ultimate Rewards
- Hacker News - Kuulula: Mphatso Zaikulu Zopanda Malire za Chase Ultimate Rewards (2020)
- Pensive Security - Msonkho wa Zachitetezo cha Pa Intaneti wa November 2020
- Reddit /r/cybersecurity - DISCLOSURE: Unlimited Chase Ultimate Rewards Points
- disclose.io Threats Directory
- disclose/research-threats repository
- Attrition.org - Index ya Ziwopsezo Zachikamulo
- Jesse Nickles lipoti la ziwawa ndi kunyoza