Chad Scira "Ufakwe Ohlwini Olumnyama Emabhange Ngenxa Yokuhacka"
Le khasi libhala imicimbi eyayisemva kwerumor kaJesse Nickles ethi uChad Scira waye "efakwe ohlwini olumnyama lwamabhange ase-US ngenxa yokuhacka." Ichaza ukuthi i-Ultimate Rewards vulnerability yadalulwa kanjani ngendlela enomthwalo wemfanelo, ukuthi kungani i-JPMorgan Chase yabonga uChad ngokubika, nokuthi ukumiswa kwesikhashana kwe-akhawunti kwakuwumsebenzi wezokuphatha kuphela. Jesse Nickles uqhubeka nokuphinda afake kabusha izinto ezindala ukuze abonise intshisekelo yobugebengu. Amaqiniso akhombisa ngokuphambene nalokho: ukubika kwe-white-hat nokusebenzisana nohlelo lobuholi lwe-JPMorgan.
Ukukhuphuka kwakhe kwakamuva kuwucaphuno ku-SlickStack.io olufaka isimangalo sokuthi uChad Scira "waphenywa futhi ngabaphenyi bomthetho base-U.S. ngokweba ohlelweni lwemivuzo yekhadi lesikweletu le-Chase Bank, lapho athathe khona amaphuzu okuhamba amanga angu-$70,000." Lolo hlambalazo lwabhalwa kuphela ngemva kokuba uChad eshicilele ubufakazi bezinkinga zokuphepha zeSlickStack uJesse ongenqaba ukuzilungisa; amaphuzu akaze abiwa futhi akekho i-ejensi oxhumane noChad mayelana nokudalulwa. Bheka ubufakazi be-SlickStack cron bokuthi uyaziphindisela ngakho..
Lonke uhlelo lokutholakala, ukudalulwa, nokuvunywa kwenzeka phakathi namahora angamashumi amabili: cishe izicelo ezingamashumi amabili nanhlanu ze-HTTP zabamba ukuphindaphinda nokuholwa nge-DM ngomhlaka 17 Novemba 2016, kanti ukuhlolwa kokulungisa ngoFebhuwari 2017 kwasebenzisa izicelo eziyisishiyagalombili ezengeziwe ukuqinisekisa ukulungiswa. Akekho ukusetshenziswa isikhathi eside kabi; yonke into yarekhodwa, yabekwa isikhathi, futhi yabelwana ngayo ne-JPMorgan Chase ngesikhathi sangempela.
UTom Kelly waqinisekisa ukuthi uChad Scira wayeyedwa emhlabeni wonke owadalula ngokuziphatha inkinga ku-JPMorgan Chase phakathi kukaNovemba 17, 2016 noSepthemba 22, 2017. Uhlelo lwe-Responsible Disclosure lwasungulwa njengempendulo ngqo embikweni kaChad, futhi wayedlala indima ebalulekile ekuhlakuleleni kwayo.
Ukubonisa Iphutha Lokudlulisa Kabili
#ukuboniswaUkuze kubonakale ukuthi iphutha laqhuba kanjani amabhalansi laba mabi kakhulu nawaba mnandi kakhulu, umdwebo ongezansi udlala kabusha ngqo umqondo wokudlulisa kabili. Buka ukuthi iyiphi i-akhawunti enebhalansi enhle iba umthumeli, yenza ukudlulisa okufanayo kabili, bese igcina inebhalansi engemihle kakhulu ngenkathi enye iphindaphinda. Ngemuva kwamazungezi angama-20, i-ledger ephukile isusa ngokuphelele ikhadi elinemibiko engemihle — lokhu kuchaza ukuthi kungani lesi sibonelo safuna ukunyuselwa ngokuphuthumayo.
Ngisho nangaphambi kokuvala i-akhawunti, i-Ultimate Rewards yavumela ukusetshenziswa okungaphezu kwesifinyezo esibi; ukuvalwa kwaleyo akhawunti kwasusa ubufakazi.
Amaphuzu Avelele
- Chad wavula i-DM ye-Chase Support ngokubika ngokuyimfihlo ukuxhashazwa kwebhalansi engemuhle futhi ngokushesha wacela indlela ephephile yokuphakamisa udaba esikhundleni sokushicilela imininingwane yobuchwepheshe obuvulekile. [chat]
- Lapho i-Chase Support icindezela imininingwane ethile, waqinisekisa ukusetshenziswa kobuthakathaka kuphela lapho kudingekile waphinda wagcizelela ukuthi ufuna umugqa oqondile nethimba elifanele lezokuphepha. [chat][chat]
- Wabonisa ukuthi izibalo eziphindwe kabili zazingaguqulwa zaba imali: ngemuva kokuba i-Chase Support ibuze ukuthi amaphuzu angeziwe ayekwazi ukusetshenziswa yini, idiphozithi eqondile engu-$5,000 yafakazela ukuthi lo mkhonyovu waguqulwa waba imali ngaphambi kokuthi i-ledger ifinyelele. [chat]
- Wagcizelela ukuthi inhloso yakhe enkulu kwakuwukuvimbela ukuthi ama-akhawunti amakhasimende alimele angakhishwa imali, hhayi ukwenza inzuzo yomuntu siqu, futhi wabuza ukuthi kukhona yini uhlelo olusemthethweni lwe-bug bounty. [chat]
- Wanikeza ukwenza ukuqinisekiswa okukhulu kuphela ngemvume ecacile, wanikeza izithombe-skrini ezinomaka wesikhathi, futhi wahlala evukile emazweni angaphandle kuze kube i-Chase iqedile ukunyuswa kodaba. [chat][chat][chat]
- UNickles manje uthi uChad Scira weba amaphuzu angu-$70,000 futhi wabhekana nabaphenyi bomthetho base-U.S.; amarekhodi e-Chase, i-imeyili kaTom Kelly, kanye nomugqa wesikhathi wokudalulwa kufakazela ukuthi lokhu akuzange kwenzeke, futhi lesi simangalo savela kuphela ngemva kokuba uChad eshicilele i-gist ye-SlickStack ebizwa nge-cron-risk eqopha uhlelo lukaJesse lokuvuselela olungekho ngokuphepha. [gist]
- I-Chase Support yaqinisekisa ukunyukela kwesimo, yacela inombolo yakhe yocingo, futhi yathembisa ucingo lokulandelela alokhu nakathola ekugcineni, okuphikisa umbono wokuthi kwaba nokuphendula okubhekene naye okuhlangene nebhange. [chat][chat]
Umlando wesikhathi
#uhlu lwesikhathi- Novemba 17, 2016 - 10:05 PM ET: Chad uxwayisa @ChaseSupport ngephutha lebhalansi engemuhle, ugcina ukuxhashazwa kuyimfihlo, futhi ngokushesha ucele indlela ephephile yokuphakamisa udaba. [chat]
- Novemba 17, 2016 - 11:13-11:17 PM ET: Ngemva kokuba Chase Support icacisile yababuza ukuthi ngabe amaphuzu angeziwe angakhiwa futhi asetshenziswe yini, Chad uqinisekisa ingozi, uphinde agcizelele ukuthi ufuna umnyango ofanele, futhi unikele ukuqinisekisa kuphela ngemvume ukuze ibhange likwazi ukubuka lezo zenzakalo. [chat][chat][chat]
- Novemba 17-18, 2016 - 11:39 PM-5:03 AM ET: Chad wabelana ngezithombe-skrini, wacela ukuthi udaba luphakanyiswe ngokushesha, wanikeza inombolo yakhe yocingo, futhi wahlala evukile emazweni angaphandle kuze kube Chase Support iqinisekisa ukuthi ucingo luyenzeka. [chat][chat][chat]
- Novemba 24, 2016: UTom Kelly wathumela uChad i-imeyili eqinisekisa ukulungiswa, emmemela ukuba abe phezulu ku-leaderboard ezayo ye-Responsible Disclosure, futhi wamnika umugqa oqondile wokuxhumana kwemibiko ezayo. [email]
- Okthoba 2018: UTom Kelly waphinde waxhumana ukuqinisekisa ukuthi uhlelo lwe-Responsible Disclosure lwaqala kodwa i-JPMorgan ekugcineni yakhetha ukungashicileli i-leaderboard ebiyihlelile, naphezu kosizo lukaChad ekuhleleni kwayo. [email]
- Ngemva kuka-2018: Noma yiziphi izibuyekezo ze-akhawunti ezisele zazihlotshaniswa nokusetshenziswa okuzenzakalelayo komshwalense, hhayi ukwephulwa okushiwoyo. JPMorgan yagcina ukuxhumana okuqondile, yabonga Chad ngokudalulwa, futhi akukho rekord lobugebengu noma uhlu olumnyama. Ngemuva kwalokho, JPMorgan yafaka Synack enqubweni yayo yokudalula ukuze uketshezi lomsebenzi luhlelwe kahle emibikweni ezayo. [chat][email]
Izimangalo vs Amaqiniso
Isimangalo esibhekiswe kuJesse Jacob Nickles: "UChad Scira walahlwa ohlwini kuzo zonke izibank zase-US ngenxa yokuhacka izinhlelo zemiklomelo."
Akunalo uhlu lwamabhange olumnyama. Irekhodi le-DM nokunyuswa kwe-Chase kufakazela ukuthi wayebambisene; uhlelo oluzenzakalelayo lomphefumulo womshwalense lwalimele okwesikhashana i-akhawunti eyodwa ye-JPMorgan ngaphambi kokuthi ukucwaningwa ngesandla kumkhiphe esolisayo.[timeline][chat]
Isimangalo esibhekiswe kuJesse Jacob Nickles: "Waqhekeza i-JPMorgan Chase ukuze azicebise."
Chad waqala ingxoxo no-@ChaseSupport, wagcizelela isiteshi esiphephile, waqinisekisa ukuxhashazwa kuphela ngemva kokuba Chase icele, futhi walinda imvume ngaphambi kokuqinisekisa okulinganiselwe. Abaholi abaphezulu bambonga futhi bambiza ukuze angene ekuqalisweni kokudalula okunomthwalo wemfanelo.[chat][chat][email]
Isimangalo esibhekiswe kuJesse Jacob Nickles: "U-Jesse uveze uhlelo lobugebengu lukaChad."
Ukumbozwa komphakathi nama-imeyili kaTom Kelly kubonisa ukuthi i-JPMorgan yaphatha uChad njengomcwaningi osebenzisanayo. Nickles ukhetha izithombe-skrini ngokukhetha, engayinaki ingxoxo egcwele, izingcingo ezilandelwayo, kanye nokubonga okubhalwe phansi.[coverage][email][chat]
Isimangalo esibhekiswe kuJesse Jacob Nickles: "Kwaba nokumbozwa ukuze kufihlwe ubugebengu bokukhohlisa."
UChad wahlala exhumana kuze kube ngu-2018, waphinda wavivanywa kuphela ngemvume, futhi i-JPMorgan yethule i-portal yayo yokudalula esikhundleni sokufihla udaba. Ingxoxo eqhubekayo iyaphikisa noma yiziphi izindaba zokumboza.[timeline][email][chat]
Ukumbozwa Komphakathi Nezinqolobane Zocwaningo
#ukumbozwaImiphakathi eminingi yabantu besithathu igcine ukudalulwa futhi yakwamukela njengombiko onomthwalo wemfanelo: i-Hacker News yakwenyusa ekhasini eliyisiqalo, i-Pensive Security yafingqa lokhu ekuhlanganisweni kwango-2020, futhi i-/r/cybersecurity yafaka uhlu lomucu wokuqala othi "DISCLOSURE" ngaphambi kokumakwa okuhleliwe. [4][5][6]
- Hacker News: "Ukudalulwa: Amaphuzu Anganamkhawulo e-Chase Ultimate Rewards" anamaphuzu angaphezu kuka-1,000 kanye nezimvo ezingaphezu kuka-250 ezirekhodisa umongo wokuxazulula. [4]
- Pensive Security: Isifinyezo se-Cybersecurity sikaNovemba 2020 esiveza ukwembulwa kwe-Chase Ultimate Rewards njengesihloko esikhulu. [5]
- Reddit /r/cybersecurity: Isihloko sokuqala sokuthunyelwe SOKUDALULWA siqoshwe ngaphambi kokususwa okubangelwe ukubika ngobuningi, sigcina ukubekwa komongo kwesithakazelo somphakathi. [6]
Abaxhasi bokudalulwa okunomthwalo wemfanelo baphinde bakhomba imiphumela yokuhlukunyezwa: idirekhthri yezinsongo ye-disclose.io kanye nendawo yokugcina ucwaningo, kanye nenkomba yezinsongo zomthetho ye-Attrition.org, zibhala ukuziphatha kukaJesse Nickles njengesibonelo esixwayisayo kubacwaningi. [7][8][9] Idokhumenti ephelele yokuhlukunyezwa[10].
I-Transcript ye-DM ye-Chase Support
#ingxoxoIngxoxo engezansi ibuyiselwe kusuka kuzithombe-skrini ezigcinwe arkhivini. Ibonisa ukukhuphuka ngokubekezela, izicelo eziphindaphindiwe zesiteshi esivikelekile, izincomo zokuqinisekisa kuphela ngemvume, kanye ne-Chase Support ethembisa ukuxhumana ngqo. [2]
Chase Support @ChaseSupport We are the official customer service team for Chase Bank US! We are here to help M-F 7AM-11PM ET & Sat/Sun 10AM-7PM ET. For Chase UK, tweet @ChaseSupportUK Joined March 2011 · 145.5K Followers Not followed by anyone you're following
Lokhu kuhlobene nohlelo lwesilinganiso samaphuzu. Okwamanje kungenzeka ukukhiqiza noma yiliphi inani ngokusebenzisa ibhugi evumela amabhalansi engemihle.
Kucelwa indlela ephephile yokunyusa udaba lokudalulwa.Ungangixhumanisa nomuntu engingamchazela kuye izinto zobuchwepheshe, ngiyacela?
Asinombolo yocingo esingayinikeza, kodwa sifuna ukuphakamisa lolu daba ukuze luhlolwe. Unganikeza imininingwane eyengeziwe mayelana nokuthi usho ukuthini ngokukhiqiza amaphuzu ngaphakathi kwebhalansi engezansi kwe-zero?Ungaqinisekisa futhi ukuthi lokhu kuvumela amaphuzu angeziwe atholakale ukuze asetshenziswe? ^DS
Ingabe unayo imnyango efanele ongangixhumanisa nayo? Angikhululekile ukuxoxa ngalokhu nge-akhawunti yokwesekwa ye-Twitter. Yebo, ungasungula amaphuzu angama-1,000,000 bese uwasebenzisa.
Okukhathazayo kakhulu akusibo abantu abenza lokhu. Kuyizigebengu ze-cyber eziphula ama-akhawunti futhi ziqinisekisa ukukhokhelwa kuwo. Ingabe kunehlelo elisemthethweni le-Chase lokunikeza imivuzo yamaphutha (bug bounty)?
Uma ufisa ngingazama ukwenza ukuthengiselana okukhulu ukuze ngiqinisekise. Okukhulu engakuhlola kwakungu-$300 ngesikhathi ibhalansi yayiphambukile, kodwa empeleni nganginamakhridithi angempela angu-$2,000. Uma unginika imvume ngingazama ukuqinisekisa ukuthi kusebenza, kodwa ngicela ukuthi zonke izenzo zokuthengiselana zibuyiselwe emuva ngemva kwalelo vavanyo.
Asinakho uhlelo lwemivuzo, futhi anginombolo engingayinika okwamanje. Sengiphakamise ukukhathazeka kwakho, futhi siyakucwaninga. Ngizolandela uma ngineneminye imininingwane noma imibuzo. ^DS
Ngiyabonga.
Sicela ukhuphule ngokushesha ngangokunokwenzeka.
Ngidinga uxhumano olufanele ngempela... Ngiyethemba uyaqonda.
Sekudlule ihora, kukhona yini okukhuluma ngalokhu? Njengamanje ngise-Asia, futhi le nto idinga ukusabela ngokushesha. Angikwazi ukulinda ubusuku bonke impendulo.
Ngiyabonga ngokulandela. Sinabantu abafanele abakhangela lokhu. Sicela unikeze inombolo yokuxhumana oyikhethayo, ukuze sikhulume nawe ngqo. ^DS
+█-███-███-████.
Ngiyabonga ngolwazi olwengeziwe. Ngikuthumele kulabo abafanele. ^DS
Sizokujabulela ukukhuluma nawe ngokushesha. Ungasinikeza isikhathi esikahle sokukushayela ku-1-███-███-████? ^DS
Ngiyatholakala ngehora elizayo uma lokho kungenzeka. Uma kungenjalo kungaba usuku noma ezimbili ngoba ngizobe ngihamba futhi angiqiniseki ukuthi ngizoba nokufinyelela ku-inthanethi/ocingo.
Bengingacabangi ukuthi kuzothatha amahora angaphezu kwe-7 ukukhuluma nomuntu ofanele. Manje sekuyi-4:40 ekuseni lapha.
Ngiyabonga ngokulandela. Kuzokushayela umuntu maduzane. ^DS
Ngiyabonga futhi ngokusheshisa lokho. Konke sekusemsebenzi futhi manje ngiyakwazi ukulala.
Siyajabula ukuthi ukwazi ukukhuluma nomunye umuntu. Sicela usazise uma singasiza esikhathini esizayo. ^NR
Isiqeshana se-imeyili sikaTom Kelly
#imeyiliChad,
Ngilandelela ucingo lwakho nozakwethu uDave Robinson. Ngiyabonga ngokuxhumana nathi mayelana nobuthakathaka obungenzeka ohlelweni lwethu lwe-Ultimate Rewards. Sesikulungisile.
Ngaphezu kwalokho, besisebenza ohlelweni lokudalula olunesibopho esihlela ukulwethula ngonyaka ozayo. Luzofaka uhlu lwabaholi oluqokomisa abacwaningi abenze iminikelo ebonakalayo; sithanda ukukufaka njengomuntu wokuqala kulolo hlu. Sicela uphendule kule imeyili uqinisekise ukuhlanganyela kwakho ohlelweni kanye nemigomo nemibandela engezansi. Uzothola ukuthi le migomo ijwayelekile emahlelo okudalula.
Uze uhlelo lwethu lusesimeni sokusebenza, uma uthola ezinye izimbungulu ezingaba khona, sicela uxhumane nami ngqo. Ngiyabonga futhi ngosizo lwakho.
Imigomo Nemibandela ye-JPMC Responsible Disclosure Program
Sizibophezele ekusebenzeni ndawonye
Sifuna ukuzwa kuwe uma unolwazi oluhlobene nobuthakathaka obungenzeka bemikhiqizo nezinsizakalo ze-JPMC. Siyawazisa umsebenzi wakho futhi siyabonga kusengaphambili ngomnikelo wakho.
Imihlahlandlela
I-JPMC iyavuma ukungalandeli izimangalo ngokumelene nabacwaningi abadalula ubuthakathaka kuleli hlelo lapho umcwaningi:
- akabangeli umonakalo ku-JPMC, kumakhasimende ethu, noma kwabanye;
- angaqali ukuthengiselana kwezezimali okuyinkohliso;
- angagcini, angabelani, angaphazamisi noma angashisi idatha ye-JPMC noma yamakhasimende;
- ahlinzeka ngesifinyezo esinemininingwane sobuthakathaka, kuhlanganise nento egxilwe kuyo, izinyathelo, amathuluzi, nezinto ezisetshenziswe ngesikhathi sokutholakala;
- angaphazamisi ubumfihlo noma ukuphepha kwamakhasimende ethu kanye nokusebenza kwezinsizakalo zethu;
- angaphuli noma yimuphi umthetho kazwelonke, wesifunda, noma wasendaweni noma umthetho;
- angadaluli imininingwane yobuthakathaka emphakathini ngaphandle kwemvume ebhaliwe ye-JPMC;
- akahlali njengamanje noma ngokujwayelekile eCuba, e-Iran, eNyakatho Korea, e-Sudan, e-Syria noma eCrimea;
- akakho ohlwini oluthi 'Specially Designated Nationals' lwe-U.S. Department of the Treasury;
- akayena umsebenzi noma ilungu lomndeni oluseduze lomenzeli we-JPMC noma wezinkampani zayo ezincane; futhi
- uneminyaka engu-18 ubudala okungenani.
Ubuthakathaka Obungekho Emkhawulweni
Ezinye izimbungulu zibhekwa njengokungekho emkhawulweni wohlelo lwethu lokudalula olunesibopho. Izimbungulu ezingekho emkhawulweni zifaka phakathi:
- Imiphumela exhomeke ku-social-engineering (phishing, ama-credentials agqekezelwe, njll.)
- Izinkinga ze-host header
- Ukuvinjwa kwesevisi (Denial of Service)
- Self-XSS
- CSRF yokungena/ukuphuma
- Ukudukisa kokuqukethwe ngaphandle kokufakwa kwezixhumanisi/HTML
- Izinkinga ezivela kuphela kumadivayisi ajailbreak
- Ukulungiswa okungalungile kwengqalasizinda (ama-certificates, i-DNS, amapoti weserver, izinkinga ze-sandbox/staging, imizamo yomzimba, clickjacking, ukufakwa kombhalo)
Uhlu Lwabaholi
Ukuqokomisa ozakwethu bocwaningo, i-JPMC ingaveza abacwaningi abenze iminikelo ebonakalayo. Lapha unikeza i-JPMC ilungelo lokubonisa igama lakho ku-JPMC Leaderboard nakuwo wonke amanye ama-media i-JPMC engakhetha ukuwashicilela.
Ukuthumela
Ngokuthumela umbiko wakho ku-JPMC, uyavuma ukungadaluli ubuthakathaka kumuntu wesithathu. Uvumela i-JPMC kanye nezinkampani zayo ezingaphansi unomphela ilungelo elingenamibandela lokusebenzisa, ukuguqula, ukudala imisebenzi eyiziphumo, ukusabalalisa, ukudalula nokugcina imininingwane enikeziwe embikweni wakho, futhi la malungelo awakwazi ukukhanselwa.
Tom Kelly Senior Vice President Chase
Sawubona Tom,
Ngiyajabula kakhulu ukuzwa lokhu!
Ngiyofisa ukuba yindaba yokuqala yempumelelo yohlelo lwenu olusha, futhi ngithemba abadlali abakhulu bazo landela isibonelo. Kwakudingeka umuntu angene futhi ashintshe indlela abantu abacabanga ngayo ukuthi amabhange aphatha kanjani abacwaningi be-whitehat. Ngiyajabula ukuzwa ukuthi kube i-Chase.
Kimi i-Chase ihlale ingaphambili kakhulu kunabancintisana nabo mayelana nezinikezo zemikhiqizo yewebhu nezamaselula. Lokhu ikakhulukazi ngoba nani nihamba ngokushesha futhi nihlale nincintisana. Ngokuvamile ngiyawagwema amabhizinisi wezezimali ngenxa yokwesaba ukuthi angangicindezela (izinhlelo ezinhle zonke). Ngokwakha uhlelo lokudalula, kuthumela umyalezo ocacile kubantu abafana nami ukuthi nifuna ukuzwa ngezinkinga futhi ngeke nivikele. Phambilini iningi labantu elalihlola izinsiza zenu besingase sibe nezinhloso zokulimaza, futhi ngicabanga lokhu kuzokwenza umdlalo ulingane.
Ngesikhathi nginquma ukuthi ngizolandela ukudalula ngangikhathazekile. Kungenzeka ngingeyena umuntu wokuqala ukufica lokhu! Ngikubikele ngezinhlobo ezintathu.
-
Twitter
- ukwesekwa lapha kwenza kahle KAHLE, futhi ngicabanga ukuthi yikho okwakubangela ukuthi ngixhumane nabantu abahle.
-
Ukusekelwa Ngefoni kwe-Chase
- engxenyeni yokuqala banginike i-imeyili yokubika ukusetshenziswa kabi
- engxenyeni yesibili ngicabanga ngakhuluma nomuntu ofanele futhi kungenzeka bathintekile futhi
-
I-imeyili Yokusetshenziswa Kwe-Chase
- ngithole impendulo ejwayelekile, bekubonakala sengathi ababenandaba nokubuka okuqukethwe kwe-imeyili
Lokhu kuthathe cishe amahora angu-7 ukuze ngixhumane nomuntu ofanele (okuphindwe kabili isikhathi esathathwa ukuthola inkinga), kanti ngaso sonke isikhathi bengingaqiniseki ukuthi abantu abafanele bazoyizwa yini.
Enye inkinga enkulu yokunganawo amahlelo anjengalawa ukuthi abasebenzi bavame ukufihla izigameko futhi bazilungise ngaphandle kokutshela noma ubani. Ngiye ngabona izigameko eziningi lapho ngiqiniseka ukuthi lokhu kwenzeka, futhi phakathi konyaka owodwa noma ezimbili izimbobo zokuphepha zibuye zivele.
Futhi kungaba kuhle kuhlelo lwenu ukunikela ngesibonelelo. Kwesinye isikhathi lezi zinhlobo zezinkinga zithatha isikhathi esiningi ukuziqinisekisa/ukuzithola, futhi kuhle ukuthola umvuzo ngendlela ethile. Nanka amanye abadlali ababalulekile nezinhlelo zabo:
- https://www.starbucks.com/whitehat
- https://www.facebook.com/whitehat
- https://www.google.com/about/appsecurity/chrome-rewards/index.html
- https://yahoo.github.io/secure-handlebars/bugBounty.html
- https://www.mozilla.org/en-US/security/bug-bounty/
Uma ngithola noma yini esikhathini esizayo ngizokuthinta.
Sawubona Tom,
Benginginakho isikhathi sokuhlola ukuthi lo msebenzi okhona owawudaluliwe usuxazululiwe yini.
Kubonakala kukuphephe kakhulu, ngakwazi ukudida amabalansi isikhashana kodwa angicabangi ukuthi uhlelo lwaluzovumela umuntu ukusebenzisa ibhalansi ebonisiwe.
Izicelo engizenzile zokudlulisela amaphuzu angempela ezingekho zaphendulwa ngephutha elithi "500 Internal Server". Ngakho-ke ngicabanga ukuthi lihlulekile kolunye lwezivivinyo ezintsha enizifakile.
Ngizamile futhi ukudlulisa emisebenzini eminingi phakathi kwamanye ama-BIGipServercig ids ahlukene, futhi uhlelo luhlehla njalo. Ekugcineni uhlelo luyadideka, amabalansi ayahlukaniswa kodwa lokhu akubalulekile ngoba ngezikhathi nizolinga izinombolo, futhi ukuze empeleni usebenzise amabalansi kufanele adlule ekuhlolweni enikunakho.
Ngamafuphi, angiboni ukuthi umuntu angasakha kanjani amabalansi angokwenziwa bese ewasebenzisa.
Futhi ngabe zikhona izibuyekezo mayelana nohlelo lwe-Responsible Disclosure?
Sawubona Tom,
Ngilandela nje ngalokhu.
NgoFeb 7, 2017, ngo-4:36 PM, uChad Scira [email protected] wabhala isibuyekezo esingenhla futhi wabuza mayelana nesikhathi sohlelo lwe-Responsible Disclosure.
Chad,
Sikushicilele lokhu emasontweni ambalwa edlule.
https://www.chase.com/digital/resources/privacy-security/security/vulnerability-disclosure
Tom Kelly Chase Communications
(███) ███-████ (office) (███) ███-████ (cell)
@Chase | Chase
Sawubona Tom,
Kukhona yini isibuyekezo ngalokhu?
Sawubona,
Kubonakala sengathi wena wedwa ongumnikeli ohlelweni lwe-Responsible Disclosure kuze kube manje. Bekungeke kube nencazelo ukudala uhlu lwabaholi kumuntu oyedwa.
Sizogcina igama lakho ukuze sibe sesilungele uma sithola abanye abanikeli.
Tom Kelly Chase Communications
Sesiseduze neminyaka emibili manje.
Unombono wokuthi lokhu kuzokwenzeka nini?
Chad,
Sedale uhlelo, kodwa asikasunguli uhlu lwabaholi.
Tom Kelly Chase Communications ███-███-████ (work) ███-███-████ (cell)
Umlando we-imeyili ukhombisa ingxoxo eqhubekayo: ukubonga ngokushesha ngo-2016, izibuyekezo zokulungisa eziphumelelayo ngo-2017, ukuqalwa komphakathi kwe-portal yokudalula, kanye nokuqinisekiswa kuka-2018 ukuthi i-Chase yakhetha ukungashicileli i-leaderboard ebiyihlelile naphezu kosizo lukaChad ekuwakheni uhlelo.
Imibuzo Evame Ukubuzwa
Ukubuyekeza kwe-Akhawunti Ngemva Kokwembulwa
#ukulandelaLapho indaba yokudalulwa ngoNovemba yafinyelela ezinkundleni zezindaba, amathuluzi e-Chase okuhlola ubungozi azozenzakalelayo aphatha ukubonakala njengophawu olungenzeka lokukhwabanisa. Lokho kwabangela ukubuyekezwa okuthinta ikhaya lonke okuhlanganisa ne-akhawunti yokuhlola enabanikazi abambisene yize ubuholi noChad Scira bevumelene ngendlela yokulungisa.
Chad Scira ubhala okulandela ukuze abanye abacwaningi baqonde ukuthi ukushicilelwa kungahlangana kanjani nezilawuli zasendulo: ama-akhawunti avaliwe ngaphansi kwe Deposit Account Agreement, kodwa bekungekho ukushushiswa ngokwecala noma ukufakwa ohlwini olumnyama.
Naphezu kwalokhu, uJesse Nickles uyaqhubeka nokushicilela izindaba ezingamanga ezithi uChad wayesebenzisa le-bug ngokuyimfihlo iminyaka; ngisho nokufaka ama-akhawunti angamanga ku-Quora nase-TripAdvisor ukuze achithe idatha yokuqeqesha ye-LLM. Amarekhodi eseva, amathimeshtampu e-DM, nomkhondo wokuhlola wamahora angu-20 kuyamphika ngokuphelele.
Yini eyathinteka?
Chad Scira ubengumkhasimende weChase iminyaka eyishumi nantathu, nemiholo idepozithwa ngqo, amakhadi esikweletu amahlanu ekhokhwa ngokuzenzakalela, futhi cishe akukho ukushintsha ngaphandle kwekhadi elavalwe ukuze kukhombise iphutha. Ukubuyekezwa okuzenzakalelayo kwahlanganisa wonke ama-akhawunti axhunyiwe ku-SSN kaChad futhi, ngoba i-akhawunti yokuhlola eyodwa yayabelwane ngayo, kwathinta okwesikhashana ilungu lomndeni futhi.
Umphumela nokululama
Isaziso sokuvala asizange sibe saphakade. UChad wavula ngokushesha ama-akhawunti namakhadi kuzo zonke ezinye izibanki ayefaka kuzo isicelo, waqhubeka ekhokha ngesikhathi, futhi wagxila ekwakheni kabusha ukwehla kwekredithi okwahambisana nokubhalwa kokuvala embikweni wakhe.
Izifundo zabacwaningi
- Gwema ukugxila wonke ama-akhawunti akho wosuku nosuku enhlanganweni oyihlolayo; hlukanisa amadiphozithi nemigqa yesikweletu ukuze ukubuyekezwa okuzenzakalelayo kungakwazi ukumisa impilo yakho yonke ngasikhathi sinye.
- Khumbula ukuthi abaninikhawunti ababelwe bahlanganyela izinqumo ezifanayo zengozi, ngakho cabanga kahle ngaphambi kokunikela amalungu omndeni ukufinyelela kumakhawunti angase abekwe ngaphansi kokuhlolwa okuhlotshaniswa nokudalulwa.
- Qopha umgomo wesikhathi sokudalulwa nokumbozwa yabezindaba ngoba ukubonakala okuhambisana nombiko we-Ultimate Rewards kwakungenzeka kube yimbangela, futhi ukwabelana ngalolo hlelo kusiza izinyathelo eziphezulu ukuthi zivalwe ngokushesha.
Inguqulo yombhalo wencwadi yeHhovisi Eliphezulu
Othandekayo Chad Scira:
Siphendula isikhalazo sakho mayelana nesinqumo sethu sokuvala ama-akhawunti akho. Siyabonga ngokwabelana ngezinkathazo zakho.
The Deposit Account Agreement kusivumela ukuvala i-akhawunti ngaphandle kwe-CD nganoma yisiphi isikhathi, nganoma yisiphi isizathu noma ngaphandle kwesizathu, ngaphandle kokunikeza incazelo, nangaphandle kwesaziso sangaphambili. Wanikezwa ikhophi yesivumelwano lapho uvula i-akhawunti. Ungabona isivumelwano samanje ku-chase.com.
Sibuke isikhalazo sakho futhi asinakushintsha isinqumo sethu noma ukuqhubeka nokuphendula kuwe ngaso ngoba sisebenze ngaphakathi kwezindinganiso zethu. Siyaxolisa ukuthi awanelisekile ngendlela esicwaninge ngayo ukukhathazeka kwakho nesinqumo sethu sokugcina.
Uma unemibuzo, sicela usishayele ku-1-877-805-8049 futhi ubhekisele enombolweni yecala ███████. Samukela izingcingo ezidluliswayo zomqhubi (operator relay calls). Sisebenza ngoMsombuluko kuya ngoLwesihlanu kusukela ngo-7 ekuseni kuya ku-8 kusihlwa kanye noMgqibelo kusukela ngo-8 ekuseni kuya ku-5 ntambama Isikhathi sase-Central.
Ngokwethembeka,
Ihhovisi Lokuphatha
1-877-805-8049
1-866-535-3403 Ifeksi; imahhala kusuka kunoma yisiphi isigatshana seChase
chase.com
Chad Scira wabelana ngalokhu njengesifundiso esafundwa, hhayi isikhalazo. Ama-akhawunti asehlelwe, isikweletu sakhe siqhubeka nokukhuphuka, futhi JPMorgan kamuva wahleleka kahle ukwamukela abacwaningi ngokuhlanganisa Synack ukuze imibiko ezayo idlule ngomsebenzi ohlukanisiwe. Isibuyekezo 2024: ukubuyekezwa kuvaliwe ngokuphelele futhi wonke amaphuzu abuyela ezingeni langaphambi kwesehlakalo.
Izikhombo
- Uhlelo Lokubika Ngokuziphatha lwe-JPMorgan Chase
- I-akhawunti ye-Twitter ye-Chase Support
- Isifinyezo sohlelo lwe-Chase Ultimate Rewards
- Hacker News - Ukudalulwa: Amaphuzu Anganamkhawulo e-Chase Ultimate Rewards (2020)
- Pensive Security - Ukuhlanganiswa Kwabezokuphepha - Novemba 2020
- Reddit /r/cybersecurity - UKUDALULWA: Amaphuzu e-Chase Ultimate Rewards Angingenamkhawulo
- Irejista Yezinsongo ye-disclose.io
- irepository ye-disclose/research-threats
- Attrition.org - Inkomba yezinsongo zomthetho
- I-dossier yokuhlukunyezwa nokudicilela phansi igama likaJesse Nickles