Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Security Bug The Almighty Buck Transportation

Ethical Hackers Donate 1,000,000 Air Miles To Charity (offensi.com) 81

An anonymous reader writes:Certified ethical hackers at Offensi.com identified a bug allowing remote code execution on one of United Airlines' sites, and submitted their findings to the airline's "bug bounty" program. After a fix was placed into production, their team was awarded 1,000,000 Mileage Plus air miles, which they say was accompanied by an email informing them that the IRS would consider their award as $20,000 of taxable income. "If after evaluating the taxable amount you choose not to accept your award, you are also able to donate your award to charity," the e-mail explained. The hackers ultimately chose to distribute their air miles among three charities -- the Ronald McDonald house, the Muscular Dystrophy Association, and the Casa de Esperanza de los Ninos Organization.
Another security researcher complained in November that United failed to close a serious vulnerability he'd identified for almost six months.
This discussion has been archived. No new comments can be posted.

Ethical Hackers Donate 1,000,000 Air Miles To Charity

Comments Filter:
  • by Anonymous Coward on Sunday May 15, 2016 @12:34PM (#52115921)

    the IRS would consider their award as $20,000 of taxable income

    Yet another reason to sell exploits on the black market instead of disclosing them responsibly.

    • the IRS would consider their award as $20,000 of taxable income

      Yet another reason to sell exploits on the black market instead of disclosing them responsibly.

      Or the scumbags at United could pay them in actual money.

      • Or the scumbags at United could pay them in actual money.

        Money is taxable. Also, FF miles can be exchanged for money (which is why they are taxable).

        • Re: (Score:3, Insightful)

          by Anonymous Coward

          You can pay the tax on money with part of the money.
          You can't pay the tax on miles with miles.

          • This.

            I suspect that, by the time they would have converted the miles to dollars, their net profit was negligible. Can anyone point us to the exchange rate for United miles to USD (specifically, how much you can sell a million miles for)?
            • I suspect that, by the time they would have converted the miles to dollars, their net profit was negligible.

              And had they actually used the miles, their profit would be negative. United has some very high co-pays for award travel. So much so that it is almost cheaper to just buy an economy ticket in the first place.

    • Why not complete the chain of logic and decide that people asking you to pay for stuff is yet another reason for you to just steal what you want instead?

    • by Ogive17 ( 691899 )
      They do work, get paid, pay taxes.. that's life.

      The real bitch is the airline not actually paying in cash, but something they consider a cash equivalent.
    • by PPH ( 736903 )

      Is Offensi.com a US entity? Because if they are foreign, the IRS doesn't get diddly. If they are Irish, tax (10%) only applies to income earned in Ireland.

      Time to move your corporate 'home' overseas.

    • Not just white hat behavior, of course. Any mutually-beneficial exchange.

      Well, any _documented_ mutually-beneficial exchange. Not a problem, if you operate in the underground, er, "undocumented", economy.

      Unless you get caught not forking over a piece of the action. Then it can be a big problem.

  • taxable income for limited miles?

    • Yes, if you get "10% off at Pennys", the IRS agent at the door will collect a tax on the money you saved.

      • How exactly does that compute? I mean they weren't getting a 10% discount on all future tickets, they were getting the equivalent to a cash card or a car. This is not to mention that there is usually a dollar threshold before the IRS actively cares about winnings being reported by people other than yourself.

        If you must compare it to something other than work and compensation for the work, compare it to game show or casino winnings.

        • Facetious

          Sorry, sometimes the magic works, sometimes it doesn't. Whatever, we are letting the IRS run out of control. And really, they can tax what they want, but they should have to do the paperwork, put the 'Service' back into the name.

  • what happens if the IRS says bug boueny people are w2 employees?

  • The problem was the Flight that had the information was delayed to the point that it missed it's connecting flight so It's stuck somewhere wandering around the Denver Airport.

    United has the WORST scheduling ever. they always try and schedule flights way too close together to ensure that any delays will result in missed flights.

    • by Nkwe ( 604125 )

      United has the WORST scheduling ever. they always try and schedule flights way too close together to ensure that any delays will result in missed flights.

      United doesn't schedule your connections, you schedule your connections (or your travel agent / website does on your behalf). Yes, United has many issues, and they have many delayed flights (along with the other airlines), but if you purchase trips with tight connections and don't expect to occasionally miss one, it is your own fault.

      • United doesn't schedule your connections, you schedule your connections (or your travel agent / website does on your behalf).

        However, their website does offer flights with connections that are ridiculously short, usually as the cheapest or cheaper options. That may be a natural result of trying to help optimize YOUR travel time (shortest layovers are usually shortest trips overall), but I don't believe it is a conspiracy to try to get you to miss flights. Why would they do that? It costs them money. If they run out of standbys for the flight you missed, they have an empty seat. If they have to reimburse you, they lose money.

        But

  • Most people who trade miles (risky, wouldn't recommend it, but it exists) value United miles at around 1.4 cents/mile. It used to be 2+ cents because United is a member of Star Alliance [united.com], arguably the best airline partner program out there. But the last few years they've added a lot of restrictions on how you can use miles from one partner airline on a different partner.

    Income and prizes (sweepstakes) have always been taxed, even if the prize is merchandise. So I don't see why this would be any differe
    • Usually, just donating the prize to charity is the simplest way to avoid it becoming a tax windfall for the government. The charity gets the full value of the donation, and you get a tax deduction for that value (even though you never actually received the value of the prize - another flaw in our tax code).

      You only get a deduction to offset the income you had from the receipt of the prize. You don't end up any better off than if you'd never won the prize in the first place.

  • That's enough for a business class upgrade!

    • Great! We'll put you on the upgrade request list. You're currently #523 on the wait list for upgrade for your flight.
      • To be fair, hitting 1M miles is usually enough to automatically put you in the highest catgeory of elite status - for life. Not a bad thing for whatever your taxes would be on $20k.
  • by wardrich86 ( 4092007 ) on Sunday May 15, 2016 @03:48PM (#52116771)
    Sooo, I can pay my taxes in coupons, Air Miles, and other loyalty points? Awesome!
    • If the IRS didn't tax high dollar gifts then savvy people would legally avoid taxes by structuring income as gifts. In lieu of $40k income or bonus, an employer gives employee a $40k car and reduces their taxable income by $40k. Instead of $200/mo going to groceries, here's a $200 grocery store gift card. Etc, etc.

      And this airline miles gift is effectively income in the same way a cash prize from a bug bounty program is income.

      Now it may well be inconvenient to receive high-dollar gifts that are also tax

  • Every dollar you receive is taxed. And you have to pay estimated taxes every quarter. And then you gotta pay the self-employment tax. [hrblock.com]

    It makes me much more keenly aware of the difference between pre-tax dollars and post-tax dollars. When I have to pay say, 100 dollars for something, I know how much I have to make in order to net 100 dollars, after tax.

    There is at least one exception (of which I'm aware, I'm sure there are more): house flipping. The first 250K (500K if married) of profit is tax free (exclu [irs.gov]

Sigmund Freud is alleged to have said that in the last analysis the entire field of psychology may reduce to biological electrochemistry.

Working...