Full Disclosure Security Policy

Urban Airship’s security policy provides guidelines for interaction between our company and security researchers. Upon discovering a security issue and communicating it with security@urbanairship.com, a researcher can expect a response within five business days. If a researcher does not receive correspondence from someone at Urban Airship within those five business days, they’re entitled to publicly disclose the security problem. However, we’d much prefer to work on fixing the security problem before the public disclosure.

Urban Airship is responsible for delivering status updates at least once every five business days until the problem is resolved or a fix is scheduled for release. We ask for full participation from researchers during this period.

Urban Airship issues related to email spoofing (SPF / DKIM), TLS ciphers, and web server headers are, for the time being, out of scope.

Purpose

Our aim is to provide the best services we can in a highly secure fashion. We take security very seriously. Part of that is communication with the security community at large. We are providing this policy as a way to get in touch with us when researchers spot issues within our system. This gives researchers a way to give us feedback and to act as a guide for communication between the researcher and Urban Airship.

Working with Urban Airship is, of course, a voluntary choice, and a choice that hopefully researchers respect and accept accordingly. The goal of following this policy, above all else, is education: for Urban Airship, for the researcher, our customers, and the community.

In Scope Security Vulnerabilities

Threat
Injection
Bounty Acknowledgement + T-Shirt
Description SQL Injection, permanent data changes
Broken Authentication
Bounty Acknowledgement + T-Shirt
Description Session hijacking, improper logout, authentication replay
Cross-Site Scripting (XSS)
Bounty Acknowledgement
Description Unexpected alert boxes, forced IFrame loads
Insecure Direct Object References
Bounty Acknowledgement + T-Shirt
Description Bypassing standard user access controls to produce more data than is allowed by current user
Security Misconfiguration
Bounty Acknowledgement + T-Shirt
Description Basic security configurations missing, allowing improper information disclosure
Sensitive Data Exposure
Bounty Acknowledgement + T-Shirt
Description Fundamental encryption in place is bypassed allowing data disclosure
Missing Function Level Access Control
Bounty Acknowledgement + T-Shirt
Description Accessing privileged resources directly without user access control rules being applied
Cross-Site Request Forgery (CSRF)
Bounty Acknowledgement + T-Shirt
Description Allowing state changing behavior without a secret token
Invalidated Redirects and Forwards
Bounty Acknowledgement + T-Shirt
Description Allowing redirection to another URL without first validating the intended target
Remote Code Execution (RCE)
Bounty Case by Case basis
Description Allowing direct access to underlying Operating System or Database with privileged Access
Threat Bounty Description
Injection Acknowledgement + T-Shirt SQL Injection, permanent data changes
Broken Authentication Acknowledgement + T-Shirt Session hijacking, improper logout, authentication replay
Cross-Site Scripting (XSS) Acknowledgement Unexpected alert boxes, forced IFrame loads
Insecure Direct Object References Acknowledgement + T-Shirt Bypassing standard user access controls to produce more data than is allowed by current user
Security Misconfiguration Acknowledgement + T-Shirt Basic security configurations missing, allowing improper information disclosure
Sensitive Data Exposure Acknowledgement + T-Shirt Fundamental encryption in place is bypassed allowing data disclosure
Missing Function Level Access Control Acknowledgement + T-Shirt Accessing privileged resources directly without user access control rules being applied
Cross-Site Request Forgery (CSRF) Acknowledgement + T-Shirt Allowing state changing behavior without a secret token
Invalidated Redirects and Forwards Acknowledgement + T-Shirt Allowing redirection to another URL without first validating the intended target
Remote Code Execution (RCE) Case by Case basis Allowing direct access to underlying Operating System or Database with privileged Access

Out of Scope Vulnerabilities

Threat
Denial of Service
Bounty NONE
Description Any action that disables or makes Urban Airship resources unavailable
Distributed Denial of Service
Bounty NONE
Description Performance testing, maxing out network bandwidth, or overloading resources with multiple sources
Brute Force Attacks
Bounty NONE
Description Persistent or iterative attacks against Urban Airship production environments
Using components with Known Vulnerabilities
Bounty NONE
Description Reporting 3rd party components or libraries Urban Airship is currently using are out of date or vulnerable
Bulk Export of Data
Bounty NONE
Description Removing data from Urban Airship without our permission in bulk from our systems.
Non-Disclosure of Security Bug
Bounty NONE
Description No bounty or acknowledgement will be issued for disclosing a bug or vulnerability publicly without informing Urban Airship in accordance with this policy
Threat Bounty Description
Denial of Service NONE Any action that disables or makes Urban Airship resources unavailable
Distributed Denial of Service NONE Performance testing, maxing out network bandwidth, or overloading resources with multiple sources
Brute Force Attacks NONE Persistent or iterative attacks against Urban Airship production environments
Using components with Known Vulnerabilities NONE Reporting 3rd party components or libraries Urban Airship is currently using are out of date or vulnerable
Bulk Export of Data NONE Removing data from Urban Airship without our permission in bulk from our systems.
Non-Disclosure of Security Bug NONE No bounty or acknowledgement will be issued for disclosing a bug or vulnerability publicly without informing Urban Airship in accordance with this policy

Details

This hypothetical workflow illustrates the simple set of guidelines at work behind this policy:

  • Researcher discovers a security threat
  • Researcher documents the threat
  • Researcher sends email to security@urbanairship.com with the details of the security issue
  • Within five days, Urban Airship will responds to researcher with status regarding security issue and possible resolutions
  • Every five days thereafter, Urban Airship is required to send a status update to the researcher, and to seek feedback on solutions
  • When security issue has been satisfactorily resolved, researcher is welcome to publicly disclose finding

PGP Fingerprint

To send secure emails to our security team, please use the following PGP Fingerprint:

Fingerprint
0x95bcb1665c76c3a6

Questions

This is an open-ended dialogue. If there is anything missing, or if you’re just curious, please send us an email at security@urbanairship.com.

Hall of Fame

The hall of fame recognizes researchers findings publicly for the last four quarters. Thank you to everyone for your submissions and for working closely with Urban Airship.

Researcher Country Quarter Finding Date
Dmitry Ivanov Russia Q4 FY’16 XSS Vulnerability 2016/11/21
Mahad Ahmed Pakistan Q3 FY’17 XSS Vulnerability 2017/06/05