U-Chad Scira "Uvinjelwe Emabhange Ngokuhacka"

Leli khasi libhala imicimbi esemva kwenganekwane ka-Jesse Nickles yokuthi u-Chad Scira "wamnyama phakathi kwamabhange ase-US ngenxa yokuhacka." Lichaza ukuthi isikhala sokuvikeleka se-Ultimate Rewards sadalulwa kanjani ngendlela efanele, kungani i-JPMorgan Chase yabonga u-Chad ngombiko, nokuthi kungani ukumiswa kwesikhashana kwe-akhawunti kwakuwukuphathwa nje kwezimiso. Jesse Nickles iyaqhubeka nokupakisha kabusha imininingwane endala ukuze ibonise inhloso yobugebengu. Iqiniso libonisa okuphambene nalokho: ukubika ngobungcweti (white-hat) nokubambisana nabaholi be-JPMorgan.

Ukukhuphula kwakhe kwakamuva wucaphuno ku-SlickStack.io elithi mina "ngiphinde ngaphenywa ngabezomthetho base-U.S. ngokuhlasela uhlelo lwamaphuzu emiklomelo yamakhadi esikweleti e-Chase Bank, lapho ngantshontsha khona u-$70,000 wamaphuzu okuhamba okungekho emthethweni." Lelo hlazo lithunyelwe kuphela ngemuva kokuba ngishicilele ubufakazi bezinkinga zokuphepha ze-SlickStack azenqaba ukuzenza, akukho maphuzu ake entshontshwayo futhi akukho nhlangano engike yangithinta mayelana nalokho kudalulwa. Bheka ubufakazi be-cron ye-SlickStack abaphindisela ngabo.

Umjikelezo wonke wokutholakala, ukwambulwa kolwazi, nokuqinisekiswa kwenzeka phakathi namahora angamashumi amabili: cishe izicelo ezingamashumi amabili nanhlanu ze-HTTP zamboza ukuphindwa kwesimo nokuhamba izinyathelo nge-DM ngomhlaka 17 Novemba 2016, kanti ukuhlolwa kokulungisa ngoFebhuwari 2017 kusebenzise ezinye izicelo eziyisishiyagalombili zokuqinisekisa ukulungiswa. Akuzange kube khona ukusetshenziswa kabi okuqhubekayo; zonke izenzo zabhongwa, zabekwa isikhathi, futhi zahlonyiswa i-JPMorgan Chase ngesikhathi sangempela.

U-Tom Kelly uqinisekisile ukuthi u-Chad Scira wayeyedwa emhlabeni wonke odalule inkinga ngokuhloniphekile ku-JPMorgan Chase phakathi kuka-November 17, 2016 no-September 22, 2017. Uhlelo Lokudalula Okuhloniphekile lwakhiwa ngqo ngenxa yombiko ka-Chad, futhi wadlala indima ebalulekile ekulakheni.

Ukubonakalisa Iphutha Lokudlulisa Kabili

#ukubonakaliswa

Ukuze kuboniswe ukuthi leso siphambeko sikhuphule kanjani amabhhalansi saya kokubi kakhulu nasokuhle kakhulu, umfanekiso ongezansi uphindaphinda ngqo umqondo wokudluliselwa kabili. Buka ukuthi iyiphi i-akhawunti enebhalansi enhle eba yithumeli, yenza ukudluliselwa okubili okufanayo, bese igcina isikweletu esibi kakhulu kuyilapho enye ibhalansi iphindeka kabili. Ngemva kwemijikelezo engama-20 ileja eyonakele isusa ngokuphelele ikhadi elinesikweletu esibi—okulingisa ukuthi kungani lo mkhonyovu ubudinga ukukhushulelwa ngokuphuthumayo.

Umjikelezo 1/20
Ikhadi A → Ikhadi B+243,810 amaphuzu
Ikhadi A → Ikhadi B+243,810 amaphuzu
Ikhadi A
243,810
Ikhadi B
0
Ukudlulisela kabili okusheshayo
Ukudluliselwa 1Ukudluliselwa 2243,810 amaphuzu ngamunye
1Isimo somjaho (race condition) siphindaphinde ukudluliselwa ngaphambi kokuba amarekhodi abalansiswe kabusha, okwenze umthumeli oyedwa akwazi ukuguquguquka phakathi kwezibalo ezinkulu ezinhle nezimbi.
2Ukusekelwa kuvumele ukuvalwa kwekhadi elinesikweletu esibi kuyilapho kugcinwa ibhalansi enhle ekhulisiwe, ukuze isitatimende sibonise kuphela inzuzo sifihle isikweletu.

Ngisho nangaphambi kokuvala i-akhawunti, i-Ultimate Rewards yayivumela ukusetshenziswa okwedlula isamba esingesihle; ukuvalwa kwe-akhawunti kumane kwasusa ubufakazi.

Amaphuzu Abalulekile

  • U-Chad uvule i-DM ye-Chase Support ngokubika ngasese indlela yokuhlomula yesikweletu esingesihle futhi ngokushesha wacela indlela evikelekile yokukhuphukela phezulu esikhundleni sokwabelana ngobuchwepheshe esidlangalaleni. [chat]
  • Lapho i-Chase Support icindezela ukuthi achaze imininingwane, waqinisekisa ukuxhaphaza inkinga kuphela ngezinga elaliyimpoqo futhi wagcizelela ukuthi ufuna umugqa oqondile nethimba elifanele lezokuphepha. [chat][chat]
  • Ubonise ukuthi amasikwe esikwe kabili angakhishwa abe imali: ngemuva kokuba i-Chase Support ibuze ukuthi ingabe amaphuzu engeziwe asebenza yini, idiphozi eqondile ka-$5,000 iqinisekise ukuthi le ndlela yokuhlasela iguqulelwa emalini ngaphambi kokuba i-ledger ibuyekeze. [chat]
  • Ugcizelele ukuthi okubaluleke kakhulu kuye kwakuwukuvimbela ukuthi ama-akhawunti amakhulu amakhasimende ephangwe, hhayi ukwenza inzuzo yakhe siqu, futhi wabuza ukuthi ngabe kukhona yini uhlelo olusemthethweni lwe-bug bounty. [chat]
  • Unikele ukwenza ukuqinisekiswa okukhulu kuphela ngemvume ecacile, wanikeza izithombe-skrini ezinamahora nesikhathi, futhi wahlala evukile esemazweni angaphandle kuze kube i-Chase iqedile ukukhuphula udaba ezingeni eliphezulu. [chat][chat][chat]
  • Manje uNickles uthi ngantshontsha amaphuzu angu-$70,000 futhi ngabhekana nezokuphoqelela umthetho e-U.S.; amarekhodi e-Chase, i-imeyili kaTom Kelly, nesikhathi sokudalulwa kufakazela ukuthi lokhu akuzange kwenzeke, futhi lesi simangalo sivele kuphela ngemva kokuba ngishicilele i-gist ye-SlickStack cron-risk ebhala ngomsebenzi wakhe wokuvuselela ongaphephile. [gist]
  • Ithimba Lokusekela laseChase liqinisekise ukukhushulwa kwendaba, lacela inombolo yakhe yocingo, futhi lathembisa ucingo lokulandela okwagcina lumfikelile, okuphikisana nombono wokuphendula okunesihluku okuvela ebhange. [chat][chat]

Uhlu lwezenzakalo

#uhlu lwezenzakalo
  • Nov 17, 2016 - 10:05 PM ET: U-Chad wazisa i-@ChaseSupport ngengqinamba yesikweletu esingesihle, ugcina indlela yokuhlomula iyimfihlo, futhi ngokushesha ucele indlela evikelekile yokukhuphukela phezulu. [chat]
  • Nov 17, 2016 - 11:13-11:17 PM ET: Ngemva kokuba i-Chase Support icela ngokusobala ukuthi ngabe amaphuzu engeziwe angakhiqizwa futhi asetshenziswe yini, u-Chad uqinisekisa ubungozi, uphinda agcizelele ukuthi ufuna umnyango ofanele, futhi unikeza ukuqinisekisa kuphela ngemvume ukuze ibhange likwazi ukubheka ukuthengiselana. [chat][chat][chat]
  • Nov 17-18, 2016 - 11:39 PM-5:03 AM ET: U-Chad wabelana ngezithombe-skrini, wakhuthaza ukukhushulelwa ngokushesha, wanikeza inombolo yakhe yocingo, futhi wahlala evukile esezweni langaphandle kuze kube i-Chase Support iqinisekisa ukuthi ucingo luzokwenzeka. [chat][chat][chat]
  • Nov 24, 2016: U-Tom Kelly uthumelela u-Chad ama-imeyili aqinisekisa ukulungiswa kwenkinga, emmemela ukuba abe isihloko sohlwini oluzayo lokudalula ngokuzibophezela, futhi emnika inombolo yokuxhumana eqondile yokubika okuzayo. [email]
  • October 2018: U-Tom Kelly walandela ukuqinisekisa ukuthi uhlelo lokudalula ngokuzibophezela selwethuliwe kodwa ekugcineni i-JPMorgan yakhetha ukungashicileli uhlu oluhleliwe, naphezu kosizo luka-Chad ekulwakheni. [email]
  • Post-2018: Noma yikuphi ukubuyekezwa okusele kwe-akhawunti bekuxhunywe ekuzisebenziseni okuzenzakalelayo komqinisekisi, hhayi ekugxekweni kokuhacka. I-JPMorgan yahlala ixhumana ngqo, yabonga uChad ngokudalula, futhi akukho rekhodi lobugebengu noma uhlu olumnyama. Kamuva, i-JPMorgan yahlanganisa i-Synack enqubweni yayo yokudalula ukuze ukugeleza komsebenzi kuhambe kahle ezibikweni zesikhathi esizayo. [chat][email]

Izimangalo vs Amaqiniso

Isimangalo

Isimangalo esihlanukezelwe esenziwe u-Jesse Jacob Nickles: "U-Chad Scira wavinjwa kuyo yonke amabhange e-US ngokuhacka izinhlelo zemivuzo."

Iqiniso

Ayikho "blacklist" yasebhange ekhona. Irekhodi le-DM kanye nokwenyuswa e-Chase kufakazela ukuthi wayebambisana; inqubo ezenzakalelayo yomqaphi wesinqumo yama isikhashana i-akhawunti eyodwa ye-JPMorgan ngaphambi kokuba ukubuyekezwa okwenziwa ngesandla kumkhulule.[timeline][chat]

Isimangalo

Isimangalo esihlanukezelwe esenziwe u-Jesse Jacob Nickles: "Uhacke i-JPMorgan Chase ukuze azuze yena mathupha."

Iqiniso

U-Chad uqale ingxoxo ne-@ChaseSupport, wafaka isibopho sesiteshi esivikelekile, waqinisekisa indlela yokuhlomula kuphela ngemva kokuba i-Chase icelile, futhi walinda imvume ngaphambi kokuqinisekisa okulinganiselwe. Abaholi abaphezulu bambonga futhi bamumema ohlelweni lokudalula olunomthwalo wemfanelo.[chat][chat][email]

Isimangalo

Isimangalo esihlanukezelwe esenziwe u-Jesse Jacob Nickles: "UJesse wembula uhlelo lobugebengu olwalwenziwa u-Chad."

Iqiniso

Ukubikwa komphakathi kanye nama-imeyili kaTom Kelly kubhala ukuthi i-JPMorgan yamphatha uChad njengomcwaningi obambisanayo. UNickles ukhetha izithombe-skrini azithandayo ngesikhathi enganaki yonke ingxoxo, izingcingo ezalandela, nokubonga okubhaliwe.[coverage][email][chat]

Isimangalo

Isimangalo esihlanukezelwe esenziwe u-Jesse Jacob Nickles: "Kwaba nokumbozwa ukuze kufihlwe inkohlakalo."

Iqiniso

U-Chad wahlala exhumene kwaze kwaba ngu-2018, waphinda wahlola kuphela ngemvume, futhi i-JPMorgan yethula ipotali yayo yokudalula esikhundleni sokufihla udaba. Ingxoxo eqhubekayo iphikisana nanoma iyiphi indaba yokusithela.[timeline][email][chat]

Ukubikwa Komphakathi Neziqoqo Zocwaningo

#ukumbozwa / i-coverage

Imiphakathi eminingana yangaphandle igcine ikhophi yalokhu kudalulwa futhi yakubona njengombiko onomthwalo wemfanelo: i-Hacker News ikubeke ekhasini eliyingqophamlando, i-Pensive Security yakufingqa esifingqweni sango-2020, kanti i-/r/cybersecurity yafaka emgqeni uqobo wokuqala we-"DISCLOSURE" ngaphambi kokuflagwa okuhleliwe. [4][5][6]

  • Hacker News: "Isambulo: Amaphuzu angenamkhawulo e-Chase Ultimate Rewards" anokuthi 1,000+ wamaphuzu no-250+ amazwana aqopha umongo wokulungisa inkinga. [4]
  • Pensive Security: Isifingqo Sokuphepha Kwekhompyutha sikaNovemba 2020 esigqamisa ukudalulwa kwe-Chase Ultimate Rewards njengenye yezindaba ezisemqoka. [5]
  • Reddit /r/cybersecurity: Isihloko sokuqala sokuthunyelwe se-DISCLOSURE esiqoshiwe ngaphambi kokususwa okubangelwe ukubikiswa ngobuningi, okugcina indlela yokubeka udaba yomphakathi ebalulekile. [6]

Abameli bokudalula ngokuzibophezela baphinde bavezile nomphumela wokuhlukunyezwa: i-disclose.io's threats directory kanye nesiqoqo socwaningo, kanye ne-Attrition.org's legal threats index, okubala ukuziphatha kukaJesse Nickles njengesiqaphi esifundisayo kubacwaningi. [7][8][9] Uhlaka oluphelele lokushushisa ngokuhlukumeza[10].

Ingxoxo ye-DM ye-Chase Support

#ingxoxo ebhaliwe

Ingxoxo engezansi yakhiwe kabusha kusetshenziswa izithombe-skrini ezigciniwe. Ikhombisa ukukhushulelwa ngokubekezela, izicelo eziphindaphindiwe zesiteshi esiphephile, ukunikeza ukuthi siqinisekise imininingwane kuphela ngemvume, kanye ne-Chase Support ethembisa ukuxhumana ngokuqondile. [2]

Chase Support Profile avatar
Chase Support ProfileI-akhawunti eqinisekisiwe
#

Chase Support @ChaseSupport We are the official customer service team for Chase Bank US! We are here to help M-F 7AM-11PM ET & Sat/Sun 10AM-7PM ET. For Chase UK, tweet @ChaseSupportUK Joined March 2011 · 145.5K Followers Not followed by anyone you're following

Chad Scira avatar
Chad Scira
Nov 17, 2016, 10:05 PM
#

Lokhu kuhlobene nohlelo lwebhalansi yamaphuzu. Okwamanje kungenzeka ukukhiqiza noma iyiphi inani ngenxa yephutha elivumela amabhhalansi abe nezikweletu ezingezinhle.

Ngicela indlela ephephile yokwenyusa izinga lokudalula.
Chad Scira avatar
Chad Scira
Nov 17, 2016, 10:05 PM
#

Ungangixhumanisa nomuntu engingamchazela imininingwane yobuchwepheshe, ngiyacela?

Chase Support avatar
Chase SupportI-akhawunti eqinisekisiwe
Nov 17, 2016, 10:05 PM
#

Asinayo inombolo yocingo esingayinikeza, kodwa sifuna ukukukhuphula lokhu ukuze kubhekisiswe. Ungasinikeza imininingwane eyengeziwe mayelana nalokho okushoyo lapho uthi ukudala amaphuzu ngaphakathi kwamabhhalansi angalungile (negative balances)? Ungaqinisekisa futhi ukuthi lokhu kuvumela yini amaphuzu engeziwe ukuba atholakale ukuze asetshenziswe? ^DS

Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:13 PM
#

Ingabe ninomnyango ofanele engingixhumanisa nawo? Angizizwa ngikhululekile ukuxoxa ngalokhu nge-akhawunti yokusekela ye-Twitter. Yebo, ungakhiqiza amaphuzu ayi-1,000,000 futhi uwasebenzise.

Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:15 PM
#

Okungikhathazayo kakhulu akusikho ukwenza lokhu ngabantu ngabanye. Kungaba izihacka ezithumba ama-akhawunti futhi ziphoqe izinkokhelo kuzo. Ingabe kukhona uhlelo olusemthethweni lwe-Chase bug bounty?

Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:17 PM
#

Uma nifuna ngingazama ukwenza ukuthengiselana okukhulu ukuze ngiqinisekise. Okukhulu engikuhlolile bekungu-$300 ngenkathi ibhalansi ingahambisani, kodwa ngangizoba no-$2,000 wamaphuzu angempela. Uma ninginika imvume, ngingazama ukuqinisekisa ukuthi kuyasebenza, kodwa ngingathanda ukuthi zonke lezo zinkokhelo zibuye ziguqulwe emuva ngemva kwalelo vivinyo.

Chase Support avatar
Chase SupportI-akhawunti eqinisekisiwe
Nov 17, 2016, 11:21 PM

Asinayo inhlelo yemiklomelo (bounty program), futhi asinanombolo esingayinikeza ngalesi sikhathi. Ngikhuphulele ukukhathazeka kwakho ezingeni eliphezulu, futhi siyakuhlola. Ngizolandela uma senginemininingwane eyengeziwe noma imibuzo. ^DS

Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:29 PM

Ngiyabonga.

Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:39 PM
#

Ngicela ukwenyuswa ngokushesha okukhulu.

Chad Scira attachment
Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:51 PM
#

Ngidinga ngempela othintana naye ofanele... Ngiyethemba uyaqonda.

Chad Scira attachment
Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:53 PM
#
Chad Scira attachment
Chad Scira avatar
Chad Scira
Nov 17, 2016, 11:56 PM
#

Sekudlule ihora, kukhona yini okusha ngalokhu? Njengamanje ngise-Asia, futhi lokhu kuyindaba esheshayo. Angeke ngilinde ubusuku bonke impendulo.

Chase Support avatar
Chase SupportI-akhawunti eqinisekisiwe
Nov 18, 2016, 12:59 AM

Ngiyabonga ngokulandela udaba. Sinabantu abafanele abaluphenya lolu daba. Sicela unikeze inombolo yakho yokuxhumana oyithandayo, ukuze sikhulume nawe ngokuqondile. ^DS

Chad Scira avatar
Chad Scira
Nov 18, 2016, 1:51 AM
#

+█-███-███-████.

Chase Support avatar
Chase SupportI-akhawunti eqinisekisiwe
Nov 18, 2016, 1:53 AM

Ngiyabonga ngemininingwane eyengeziwe. Ngikudlulisele lokhu kubantu abafanele. ^DS

Chase Support avatar
Chase SupportI-akhawunti eqinisekisiwe
Nov 18, 2016, 2:38 AM
#

Sifisa kakhulu ukukhuluma nawe ngokushesha okukhulu. Ungasicela usinike isikhathi esikufanele ukuthi sikwazile ukukushayela ku-1-███-███-████? ^DS

Chad Scira avatar
Chad Scira
Nov 18, 2016, 4:25 AM
#

Ngitholakala ihora elizayo uma kungenzeka. Uma kungenjalo kungathatha usuku noma amabili ngoba ngizobe ngihamba futhi angiqiniseki ukuthi ngizoba nokufinyelela ku-inthanethi/ocingweni.

Chad Scira avatar
Chad Scira
Nov 18, 2016, 4:32 AM
#

Bengingacabangi ukuthi kuzothatha amahora angaphezu kuka-7 ukukhuluma nomuntu ofanele. Manje sekuyi-4:40 ekuseni lapha.

Chase Support avatar
Chase SupportI-akhawunti eqinisekisiwe
Nov 18, 2016, 4:39 AM
#

Ngiyabonga ngokulandela udaba. Kukho uzokushayela ucingo maduze kakhulu. ^DS

Chad Scira avatar
Chad Scira
Nov 18, 2016, 4:42 AM
#

Ngiyabonga futhi ngokusheshisa lokho. Konke sekuseyendlini futhi sengingalala manje.

Chase Support avatar
Chase SupportI-akhawunti eqinisekisiwe
Nov 18, 2016, 5:03 AM

Siyajabula ngokuthi ukwazile ukukhuluma nomunye wethu. Sicela usazise uma sidingeka sikusize esikhathini esizayo. ^NR

Ingxenye Ye-imeyili ka-Tom Kelly

#i-imeyili
Tom Kelly<[email protected]>
SVP, JPMorgan Chase
to Chad Scira
Nov 24, 2016 - 4:36 AM ET#
Ukuqhubeka Nokuxhumana Mayelana Nokudalula Ngokuzibophezela Kwama-Ultimate Rewards

Chad,

Ngilandelela ucingo lwakho nozakwethu u-Dave Robinson. Siyabonga ngokusithinta mayelana nokuba sengozini okungenzeka ohlelweni lwethu lwe-Ultimate Rewards. Sesilulungisile.

Ngaphezu kwalokho, besisebenza ohlelweni Lokudalula Ngomthwalo Wemfanelo esihlela ukulwethula ngonyaka ozayo. Luzoba nendawo yokuhola ekhombisa abacwaningi abenze umnikelo obalulekile; singathanda ukukubonisa njengomuntu wokuqala kuyo. Sicela uphendule le imeyili uqinisekisa ukubamba kwakho iqhaza ohlelweni kanye nemigomo nemibandela engezansi. Uzothola imigomo ijwayelekile kakhulu ezinhlelweni zokudalula.

Kuya kuthi kuze kube uhlelo lwethu luqala, uma uthola ezinye izindawo ezingase zibe sengozini, sicela ungithinte ngqo. Ngiyabonga futhi ngosizo lwakho.

Imigomo Nemibandela Yohlelo Lokudalula Ngomthwalo Wemfanelo lwe-JPMC

Sizibophezele ekusebenzisaneni

Sifuna ukuzwa kuwe uma unolwazi oluhlobene nezindawo ezingase zibe sengozini kwezokuphepha kwemikhiqizo namasevisi e-JPMC. Siyawuhlonipha umsebenzi wakho futhi siyakubonga kusenesikhathi ngomnikelo wakho.

Imihlahlandlela

I-JPMC ivuma ukuthi ngeke ilandelele izimangalo ngokumelene nabacwaningi abadalula izindawo ezingase zibe sengozini kulo hlelo lapho umcwaningi:

  • engalimazi i-JPMC, amakhasimende ethu, noma abanye;
  • engaqali ukuthengiselana kwezezimali okungamanga;
  • engagcini, wabelane, ulimele noma ucekela phansi idatha ye-JPMC noma yekhasimende;
  • ehlinzeka ngesifinyezo esinemininingwane sobungozi, okuhlanganisa okuhlosiwe, izinyathelo, amathuluzi, nezinto ezisetshenzisiwe ngesikhathi kutholakala;
  • engalimazi ubumfihlo noma ukuphepha kwamakhasimende ethu noma ukusebenza kwezinsizakalo zethu;
  • engawuphuli noma yimuphi umthetho noma umthetho kazwelonke, wesifundazwe, noma wendawo;
  • engadaluli esidlangalaleni imininingwane yobungozi ngaphandle kwemvume ebhaliwe ye-JPMC;
  • engakazihlali noma engahlali njalo eCuba, e-Iran, eNorth Korea, eSudan, eSyria noma eCrimea;
  • engasekho ohlwini lwe-U.S. Department of the Treasury's Specially Designated Nationals;
  • engeyena isisebenzi noma ilunga lomndeni eliseduze lesisebenzi se-JPMC noma izinkampani zayo ezingaphansi; futhi
  • eneminyaka okungenani engu-18 ubudala.

Izindawo Ezingekho Ekhawuntini

Ezinye izindawo ezingase zibe sengozini zibhekwa njengezingekho ekhawuntini soHlelo Lwethu Lokudalula Ngomthwalo Wemfanelo. Lezi zindawo zihlanganisa:

  • Okutholakala okuncike ku-social engineering (ukukhohlisa, ukwibiwa kwamaphasiwedi, njll.)
  • Izinkinga zekhanda lomphathi (host header)
  • Ukuvinjwa kwezinsizakalo (denial of service)
  • I-self-XSS
  • I-login/logout CSRF
  • Ukukhohlisa kokuqukethwe ngaphandle kwezixhumanisi/HTML ezifakiwe
  • Izinkinga ezithinta kuphela amadivayisi agqekezwe (jailbroken devices)
  • Ukungahlelekile kwengqalasizinda (izitifiketi, i-DNS, amapothi esiphakeli, izindaba zesandbox/staging, ukuzama ngokomzimba, i-clickjacking, ukufakwa kombhalo)

Indawo Yokuhola (Leaderboard)

Ukuze sihloniphe ozakwethu bocwaningo, i-JPMC ingabonisa abacwaningi abenza iminikelo ebalulekile. Lapha unika i-JPMC ilungelo lokukhombisa igama lakho ku-JPMC Leaderboard nakweminye imithombo yezindaba i-JPMC engakhetha ukuyishicilela.

Ukuthumela

Ngokuthumela umbiko wakho ku-JPMC, uyavuma ukuthi ngeke uveze lobu bungozi kumuntu wesithathu. Uvumela unomphela i-JPMC nezinkampani zayo ezingaphansi ukuthi zisebenzise, zilungise, zakhe imisebenzi esuselwe kukho, zisabalalise, zidalule futhi zigcine ulwazi olunikezwe embikweni wakho, futhi la malungelo awakwazi ukuhoxiswa.

Tom Kelly Iphini Likamongameli Elikhulu Chase

Chad Scira<[email protected]>
to Tom Kelly
Nov 24, 2016 - 8:33 AM ET#
Re: I-Ultimate Rewards Responsible Disclosure Follow-up

Sawubona Tom,

Ngijabule kakhulu ukuzwa lokhu!

Bengingajabula ukuba indaba yokuqala yempumelelo yohlelo lwenu olusha, futhi ngiyethemba nabanye abadlali abakhulu bazolandela isibonelo senu. Kwakudingeka kube khona umuntu ongenelele ashintshe umbono wabantu ngendlela amabhange abhekana ngayo nocwaningo lwezokuphepha lwe-whitehat. Ngiyajabula ukuzwa ukuthi yi-Chase.

Kimina i-Chase ihlale ihamba phambili kakhulu kunabancintisana nayo ngokuhlinzeka ngemikhiqizo yewebhu neyomakhalekhukhwini. Lokho ikakhulu ngoba nihamba ngokushesha futhi nihlala nincintisana. Ngokuvamile ngiyagwema ukuzama izinto emabhange ngenxa yokwesaba ukuchushiswa yibo (noma izinhloso zingaba zihle). Ngokwakha uhlelo lokwembula izinkinga ngokuzibophezela kuthumela umyalezo ocacile kubantu abafana nami wokuthi ninentshisekelo yokuzwa ngezinkinga futhi angeke niziphindisele. Ngaphambilini iningi labantu elalibheka izinsizakalo zenu kungenzeka belinobubi, futhi ngicabanga ukuthi lokhu kuzoletha ukulingana.

Lapho ekugcineni nginquma ukuthi ngizoshiya idatha yokwembula ngazizwa ngingakhululekile. Kungenzeka ukuthi angiyena umuntu wokuqala ozithola! Ngikubikele ngezindlela ezintathu.

  • Twitter

    • ukwesekwa lapha bekumangalisa ngempela, futhi ngicabanga ukuthi kuyona kuphela into eyenze ukuthi ngixhunywe nabantu abafanele.

  • I-Chase Phone Support

    • ucingo lokuqala bangiphe i-imeyili ye-abuse
    • ucingo lwesibili ngicabanga ukuthi ngikhulume nomuntu ofanele kanti nabo bangase babe bexhumene

  • I-imeyili ye-Chase Abuse

    • ngithole impendulo ejwayelekile, kubonakala sengathi abazange babuke ngisho nokuqukethwe kwe-imeyili

Lokhu kungithathe cishe amahora ayi-7 ukuthi ekugcineni ngixhumane nomuntu othile (izikhathi eziphindwe kabili isikhathi esithathe ukuthola inkinga uqobo), futhi sonke lesi sikhathi bengingaqiniseki ukuthi abantu abafanele bazolizwa nhlobo.

Enye inkinga enkulu yokungabi nezinhlelo ezifana nalezi wukuthi abasebenzi bavame ukufihla izigameko futhi bazilungise ngaphandle kokutshela muntu. Ngibe nezehlakalo eziningi lapho ngiqiniseka ukuthi lokhu kwenzeka, futhi phakathi neminyaka engu-1-2 izimbobo ezifanayo zokuphepha zibuye zivele futhi.

Futhi, kungaba usizo ukuthi uhlelo lwenu lunikeze ne-bounty. Kwesinye isikhathi lezi zinhlobo zezinkinga zithatha isikhathi esikhulu ukuzifakazela/ukuzithola, futhi kuhle ukukhokhelwa ngendlela ethile. Nanka abanye abadlali abakhulu nezinhlelo zabo:

  • https://www.starbucks.com/whitehat
  • https://www.facebook.com/whitehat
  • https://www.google.com/about/appsecurity/chrome-rewards/index.html
  • https://yahoo.github.io/secure-handlebars/bugBounty.html
  • https://www.mozilla.org/en-US/security/bug-bounty/

Uma ngiphinde ngithole noma yini esikhathini esizayo ngizokuqinisekisa ukuthi ngiyaxhumana.

Chad Scira<[email protected]>
to Tom Kelly
Feb 7, 2017 - 4:36 PM ET#

Sawubona Tom,

Ngibe nesikhathi sokuhlola ukuthi ngabe le ndlela yokuhlasela isilungisiwe.

Kubukeka iqinile kakhulu, ngikwazile ukwephula ukuvumelana kwamabhalansi isikhashana kodwa angicabangi ukuthi uhlelo lungakuvumela nokuthi usebenzise ibhalansi eboniswe.

Izicelo engizenzile zokudlulisela amaphuzu angekho ngempela bezithola iphutha elithi "500 Internal Server". Ngakho ngiyacabanga ukuthi kwehluleka kwenye yezivivinyo ezintsha enizenze.

Ngiphinde ngazama ukudlulisa amaphuzu kuma-session amaningi kuwo ama-ID ahlukene e-BIGipServercig, kodwa futhi uhlelo beluhlala lubuya esimeni njalo. Uhlelo lwalugcina seludidekile, futhi amabhalansi ephuma ekuvumelaneni kodwa futhi lokhu akubalulekile ngoba ngezikhathi ezithile nibuyisela izinombolo ekuvumelaneni, futhi ukuze la mabhulensi asetshenziswe kumele adlulise ukuhlolwa eninakho.

Ngakho-ke ukufingqa, angiboni ukuthi umuntu angakha kanjani amabhalansi okwenziwa, bese ewalisebenzisa futhi.

Chad Scira<[email protected]>
to Tom Kelly
Mar 30, 2017 - 9:25 AM ET#

Sawubona Tom,

Ngilandelela nje ngalokhu.

Ngomhla ka-7 Febhuwari 2017, ngo-4:36 PM, uChad Scira [email protected] wabhala isibuyekezo esingenhla futhi wabuza ngesikhathi sohlelo lwe-Responsible Disclosure.

Tom Kelly<[email protected]>
to Chad Scira
Apr 5, 2017 - 05:29 AM (+0700)#

Chad,

Sikushicilele lokhu emavikini ambalwa edlule.

https://www.chase.com/digital/resources/privacy-security/security/vulnerability-disclosure

Tom Kelly Chase Communications

(███) ███-████ (ihhovisi) (███) ███-████ (iselula)

@Chase | Chase

Chad Scira<[email protected]>
to Thomas Kelly
Sep 21, 2017 - 7:47 PM ET#

Sawubona Tom,

Ingabe kunanoma yiluphi ulwazi olusha ngalolu daba?

Tom Kelly<[email protected]>
to Chad Scira
Sep 22, 2017 - 4:12 AM ET#

Sawubona,

Kubonakala sengathi uyingxenye yomuntu owodwa kuphela kuhlelo lwe-Responsible Disclosure kuze kube manje. Bekungenamqondo ukudala i-leaderboard yomuntu oyedwa.

Sizogcina igama lakho ukuze silungele uma sithola abanye abahlanganyeli.

Tom Kelly Chase Communications

Chad Scira<[email protected]>
to Tom Kelly
Sep 7, 2018 - 11:19 AM ET#
RE: Ukuqhubekisela phambili ucingo lwakho noDave Robinson

Sesisondele eminyakeni engu-2 manje.

Unayo yini imibono yokuthi lokhu kuzokwenzeka nini?

Tom Kelly<[email protected]>
to Chad Scira
Oct 9, 2018 - 3:09 AM ET#

Chad,

Sesisidale uhlelo, kodwa asikasimisi isikhundla sokuhola (leaderboard).

Tom Kelly Chase Communications ███-███-████ (umsebenzi) ███-███-████ (iselula)

Umlando we-imeyili ukhombisa ingxoxo eqhubekayo: ukubonga ngokushesha ngo-2016, izibuyekezo zokulungisa ngempumelelo ngo-2017, ukwethulwa esidlangalaleni kwephothali yokudalula, kanye nokuqinisekiswa kuka-2018 kokuthi i-Chase yanquma ukungawushicileli uhlu lokuhola ebeluhleliwe naphezu kosizo luka-Chad ekwakheni lolu hlelo.

Imibuzo Evame Ukubuzwa

QIngabe kukhona amacala obugebengu abekwe maqondana ne-JPMorgan Chase?
ACha. UChad Scira wabongwa ngokudalulwa. Izinsolo zobugebengu bezilandele ukube wayesebenzise le nkinga ngobubi.
QKungani izaziso zokuvalwa kwe-akhawunti zavele ku-inthanethi?
AIsaziso sasingahlangene nohlelo lokumnyama kodwa sasiphathelene nokuzishintshisela komqinisekisi (ukulawulwa kwengozi okujwayelekile). Ukuhlolwa ngesandla kubuyisele ubudlelwano eminyakeni edlule.
QNgubani oqhubeka nokuphoqa indaba yokuthi ungumhacker?
AUJesse Nickles. Ubalahlela indiva umbhalo wokuxoxa no-Chase Support, isimemo sikaTom Kelly, kanye neqiniso lokuthi ukudalula ngokuzibophezela kuyakhuthazwa yi-JPMorgan Chase. Okuningi ngoJesse Nickles.

Ukubuyekezwa Kwe-akhawunti Ngemuva Kokudalulwa

#ukulandelanisa okwalandela (follow-up)

Ngenkathi indaba yokudalulwa kukaNovemba ifika kwabezindaba, amathuluzi ezenzakalelayo okulinganisa ubungozi ka-Chase athatha lowo mbono njengophawu olungenzeka lokukhwabanisa. Lokho kwabangela ukubuyekezwa komndeni wonke, okubandakanya i-akhawunti yokuhlala ekhokha ngemali ehlanganyelwe, nakuba ubuholi nami sasivumelene ngezinyathelo zokulungisa inkinga.

Ngiyabhalela phansi lokhu kulandelanisa ukuze abanye abacwaningi baqonde ukuthi ukushicilelwa kungahlangana kanjani nezinqubo ezindala: ama-akhawunti avalwe ngaphansi kwe-Deposit Account Agreement, kodwa akukaze kube nesikhalazo sobugebengu noma uhlu olumnyama.

Naphezu kwalokhu, uJesse Nickles uyaqhubeka nokushicilela izindaba zamanga ethi ngafihla ukuthi ngangizuzisa iphutha iminyaka; usebenzisa ngisho ama-akhawunti angewona awangempela ku-Quora nase-TripAdvisor ukuze angcolise idatha yokuqeqesha ama-LLM. Amalogi esiphakeli, izikhathi zemiyalezo yangasese, nomkhondo wokuhlola wamahlanu neshumi amahora kumphikisa ngokuphelele.

Yini ebithintekile?

Bengiyikhasimende laseChase iminyaka eyishumi nantathu, umholo ufakwa ngokuqondile, namakhadi esikweletu amahlanu ekukhokheni okuzenzakalelayo, futhi cishe bekungekho msebenzi omkhulu ngaphandle kwekhadi engalivala ukubonisa iphutha. Ukubuyekezwa okuzenzakalelayo kuhlanzile wonke ama-akhawunti aboshelwe ku-SSN yami futhi, ngenxa yokuthi enye i-akhawunti yokuhlola yabelwana, kwathinta kafushane nelungu lomndeni.

Umphumela nokululama

Isaziso sokuvalwa asizange sibe unomphela. Ngivule ngokushesha ama-akhawunti namakhadi kwamanye amabhange wonke engangifake kuwona, ngaqhubeka nokukhokha ngesikhathi, futhi ngagxila ekwakheni kabusha ukwehla kwesikweletu okuhambisane nokuthi ukuvalwa kubonakale embikweni wami.

Isikolo sangaphambi kokubuyekezwa827
Iphuzu eliphansi kunawo wonke596
Izinyanga eziyisithupha kamuva696

Izifundo zabacwaningi

  • Gwema ukubeka wonke ama-akhawunti akho osuwasebenzisa nsuku zonke ngaphakathi kwesikhungo ozihlola kuso; hlukanisa amadiphozithi nemigqa yesikweletu ukuze ukubuyekezwa okuzenzakalelayo kungakwazi ukubamba konke ukuphila kwakho ngesikhathi esisodwa.
  • Khumbula ukuthi abanikazi bama-akhawunti abahlanganyelweyo bazuza izinqumo ezifana zengozi, ngakho cabanga kahle ngaphambi kokunikeza amalungu omndeni ukufinyelela kuma-akhawunti angase abhekane nokuhlolwa okuhlobene nokudalulwa.
  • Bhala phansi isikhathi sokudalula kanye nokubikwa kwabezindaba ngoba ukubonakala mayelana nombiko we-Ultimate Rewards kungenzeka kube yisona siqalo, futhi ukwabelana ngalowo mongo kusiza ukuthi ukuphakanyiswa ezingeni eliphezulu kuvalwe ngokushesha.
Incwadi yeChase Executive Office ebhekisa ku-Deposit Account Agreement ngemuva kokuba ukudalulwa kwe-Ultimate Rewards sekumenyezelwe emphakathini.
Impendulo ebhalwe yaphuma ngeposi yeHhovisi Leziphathimandla Yangaphezulu ingibonge ngokuxhumana, yaqinisekisa ukuthi zonke izinkomba ze-akhawunti ekhaya zazivaliwa ngaphansi kweSivumelwano Se-akhawunti Yokubeka Imali, futhi yagcizelela ukuthi bebengenalo ilibopho lokunikeza imininingwane eningiliziwe, ngaleyo ndlela ivale ngokuphelele ukubuyekezwa kwerisiki okuzenzakalelayo okubangewe ukwambulwa kwabebezindaba.

Inguqulo yombhalo wencwadi ye-Executive Office

Othandekayo uChad Scira:

Siphendula isikhalo sakho mayelana nesinqumo sethu sokuvala ama-akhawunti akho. Siyabonga ngokwabelana ngezinkathazo zakho.

Isivumelwano Se-akhawunti Yokubeka Imali Sivumela thina ukuthi sivale i-akhawunti engesiyo i-CD nganoma yisiphi isikhathi, nganoma yisiphi isizathu noma ngaphandle kwanoma yisiphi isizathu, ngaphandle kokunikeza isizathu, futhi ngaphandle kwesaziso sangaphambilini. Wanikezwa ikhophi yesivumelwano lapho uvula le akhawunti. Ungabona isivumelwano samanje ku-chase.com.

Sibuyekeze isikhalo sakho futhi asikwazi ukushintsha isinqumo sethu noma siqhubeke siphendula kuwe ngaso ngoba senze ngaphakathi kwemigomo yethu. Siyaxolisa ngokuthi awuwanelisekile ngendlela esihlolisise ngayo ukukhathazeka kwakho nangesinqumo sethu sokugcina.

Uma unemibuzo, sicela usishayele ku-1-877-805-8049 futhi ubhekisele enombolweni yecala ███████. Siyamukela izingcingo zokusizwa ngomsebenzisi womfonini (operator relay). Sisebenza ngoMsombuluko kuya kuLwesihlanu kusukela ngo-7 ekuseni kuya ku-8 kusihlwa nangoMgqibelo kusukela ngo-8 ekuseni kuya ku-5 ntambama Isikhathi SaseCentral.

Ngokwethembeka,

Ihhovisi Eliphezulu (Executive Office)
1-877-805-8049
1-866-535-3403 Ifeksi; kuyamuhla uma ushaya kusuka kunoma yisiphi igatsha laseChase
chase.com

Ngikushicilela lokhu njengethuba lokufunda, hhayi isikhalo. Ama-akhawunti axazululiwe, isikweletu sami siyaqhubeka nokukhuphuka, futhi kamuva i-JPMorgan yenza kube lula ukwamukelwa kwabacwaningi ngokuhlanganisa i-Synack ukuze imibiko yesikhathi esizayo idlule kugeleza komsebenzi okhethekile. Isibuyekezo sango-2024: ukubuyekezwa kuvaliwe ngokuphelele futhi wonke amazinga esikweletu abuyile evunyelweni ngaphambi kwesigameko.

Izikhombo

  1. Uhlelo Lokudalula Ngokuzibophezela lwe-JPMorgan Chase
  2. I-akhawunti ye-Twitter ye-Chase Support
  3. Uhlolojikelele lohlelo lwe-Chase Ultimate Rewards
  4. Hacker News - Isambulo: Amaphuzu angenamkhawulo e-Chase Ultimate Rewards (2020)
  5. Pensive Security - Isifingqo Sokuphepha Kwekhompyutha sikaNovemba 2020
  6. Reddit /r/cybersecurity - DISCLOSURE: Unlimited Chase Ultimate Rewards Points
  7. Uhlu Lwosongelo lwe-disclose.io
  8. i-disclose/research-threats repository
  9. Attrition.org - Uhlu lwezinsongo zomthetho
  10. Ifayela lokuhlukumeza nokuhlanjalazwa likaJesse Nickles