Bugs on a Plane: Implementing a Bug Bounty in an Airline IT/OT Environment

on YouTube ↗49m

" summary

An airline moves from a public VDP to a Bugcrowd-run bug bounty, running a VDP for almost two years then an eight‑month bug bounty that surfaces 13 critical reports and four earlier VDP criticals, including a patched “fly for free” payment flow exploit. Legal flags on liability and disclosure privilege force procurement and contract work, triage relies on red/blue/purple teams plus interns, and deployment uses Bugcrowd’s iframe, security.txt, and an initial private program before expanding scope from the payment flow.

AI-written summary · about

" chapters (13)

1. 0:00Welcome
2. 1:52Bug bounty in aviation
3. 4:42Bug bounty vs disclosure
4. 7:55Air Canada’s bug bounty
5. 14:01Legal and cultural hurdles
6. 19:19Critical vulnerabilities learned
7. 24:57Internal relationships
8. 28:52Private programs engagement
9. 33:12Internal champions
10. 37:49Expanding scope future
11. 41:41Regulatory trends transparency
12. 45:13Airline-researcher collaboration
13. 46:15Closing advice

" related talks

• 50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual TemptationCassio Goldschmidt, Michael Gallagher, Sean Martin, Sean Melia, Michael Stoker · AppSec USA 2017
• 46mHow to run a successful bug bounty programmeShadab Siddiqui · Rootconf 2019
• 55mYour License for Bug Hunting SeasonCasey Ellis, Jim Denaro · AppSecUSA 2016
• 43mHard Knock Lessons On Bug BountiesJonathan Cran · OWASP AppSec Research (AppSecEU) 2015
• 11mBuilding a Bug Bounty Program: From the TrenchesYogesh Badwe · RSA Conference 2018
• 56mRunning a Bug Bounty Program @ SEEKJulian Berton · NDC Sydney 2017
• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and ManagementSerge Egelman, Primal Wijesekera, Noura Alomar, Edward Qiu · SOUPS 2020