Legal
Full Disclosure Security Policy – Ending April 17, 2019
Urban Airship’s security policy provides guidelines for interaction between our company and security researchers. Upon discovering a security issue and communicating it with security@urbanairship.com, a researcher can expect a response within five business days. If a researcher does not receive correspondence from someone at Urban Airship within those five business days, they’re entitled to publicly disclose the security problem. However, we’d much prefer to work on fixing the security problem before the public disclosure.
Urban Airship is responsible for delivering status updates at least once every five business days until the problem is resolved or a fix is scheduled for release. We ask for full participation from researchers during this period.
Urban Airship issues related to email spoofing (SPF / DKIM), TLS ciphers, and web server headers are, for the time being, out of scope.
Purpose
Our aim is to provide the best services we can in a highly secure fashion. We take security very seriously. Part of that is communication with the security community at large. We are providing this policy as a way to get in touch with us when researchers spot issues within our system. This gives researchers a way to give us feedback and to act as a guide for communication between the researcher and Urban Airship.
Working with Urban Airship is, of course, a voluntary choice, and a choice that hopefully researchers respect and accept accordingly. The goal of following this policy, above all else, is education: for Urban Airship, for the researcher, our customers, and the community.
In Scope Security Vulnerabilities
| Threat | |
|---|---|
| Injection | |
| Bounty | Acknowledgement + T-Shirt |
| Description | SQL Injection, permanent data changes |
| Broken Authentication | |
| Bounty | Acknowledgement + T-Shirt |
| Description | Session hijacking, improper logout, authentication replay |
| Cross-Site Scripting (XSS) | |
| Bounty | Acknowledgement |
| Description | Unexpected alert boxes, forced IFrame loads |
| Insecure Direct Object References | |
| Bounty | Acknowledgement + T-Shirt |
| Description | Bypassing standard user access controls to produce more data than is allowed by current user |
| Security Misconfiguration | |
| Bounty | Acknowledgement + T-Shirt |
| Description | Basic security configurations missing, allowing improper information disclosure |
| Sensitive Data Exposure | |
| Bounty | Acknowledgement + T-Shirt |
| Description | Fundamental encryption in place is bypassed allowing data disclosure |
| Missing Function Level Access Control | |
| Bounty | Acknowledgement + T-Shirt |
| Description | Accessing privileged resources directly without user access control rules being applied |
| Cross-Site Request Forgery (CSRF) | |
| Bounty | Acknowledgement + T-Shirt |
| Description | Allowing state changing behavior without a secret token |
| Invalidated Redirects and Forwards | |
| Bounty | Acknowledgement + T-Shirt |
| Description | Allowing redirection to another URL without first validating the intended target |
| Remote Code Execution (RCE) | |
| Bounty | Case by Case basis |
| Description | Allowing direct access to underlying Operating System or Database with privileged Access |
| Threat | Bounty | Description |
|---|---|---|
| Injection | Acknowledgement + T-Shirt | SQL Injection, permanent data changes |
| Broken Authentication | Acknowledgement + T-Shirt | Session hijacking, improper logout, authentication replay |
| Cross-Site Scripting (XSS) | Acknowledgement | Unexpected alert boxes, forced IFrame loads |
| Insecure Direct Object References | Acknowledgement + T-Shirt | Bypassing standard user access controls to produce more data than is allowed by current user |
| Security Misconfiguration | Acknowledgement + T-Shirt | Basic security configurations missing, allowing improper information disclosure |
| Sensitive Data Exposure | Acknowledgement + T-Shirt | Fundamental encryption in place is bypassed allowing data disclosure |
| Missing Function Level Access Control | Acknowledgement + T-Shirt | Accessing privileged resources directly without user access control rules being applied |
| Cross-Site Request Forgery (CSRF) | Acknowledgement + T-Shirt | Allowing state changing behavior without a secret token |
| Invalidated Redirects and Forwards | Acknowledgement + T-Shirt | Allowing redirection to another URL without first validating the intended target |
| Remote Code Execution (RCE) | Case by Case basis | Allowing direct access to underlying Operating System or Database with privileged Access |
Out of Scope Vulnerabilities
| Threat | |
|---|---|
| Denial of Service | |
| Bounty | NONE |
| Description | Any action that disables or makes Urban Airship resources unavailable |
| Distributed Denial of Service | |
| Bounty | NONE |
| Description | Performance testing, maxing out network bandwidth, or overloading resources with multiple sources |
| Brute Force Attacks | |
| Bounty | NONE |
| Description | Persistent or iterative attacks against Urban Airship production environments |
| Using components with Known Vulnerabilities | |
| Bounty | NONE |
| Description | Reporting 3rd party components or libraries Urban Airship is currently using are out of date or vulnerable |
| Bulk Export of Data | |
| Bounty | NONE |
| Description | Removing data from Urban Airship without our permission in bulk from our systems. |
| Non-Disclosure of Security Bug | |
| Bounty | NONE |
| Description | No bounty or acknowledgement will be issued for disclosing a bug or vulnerability publicly without informing Urban Airship in accordance with this policy |
| Threat | Bounty | Description |
|---|---|---|
| Denial of Service | NONE | Any action that disables or makes Urban Airship resources unavailable |
| Distributed Denial of Service | NONE | Performance testing, maxing out network bandwidth, or overloading resources with multiple sources |
| Brute Force Attacks | NONE | Persistent or iterative attacks against Urban Airship production environments |
| Using components with Known Vulnerabilities | NONE | Reporting 3rd party components or libraries Urban Airship is currently using are out of date or vulnerable |
| Bulk Export of Data | NONE | Removing data from Urban Airship without our permission in bulk from our systems. |
| Non-Disclosure of Security Bug | NONE | No bounty or acknowledgement will be issued for disclosing a bug or vulnerability publicly without informing Urban Airship in accordance with this policy |
Details
This hypothetical workflow illustrates the simple set of guidelines at work behind this policy:
- Researcher discovers a security threat
- Researcher documents the threat
- Researcher sends email to security@urbanairship.com with the details of the security issue
- Within five days, Urban Airship will responds to researcher with status regarding security issue and possible resolutions
- Every five days thereafter, Urban Airship is required to send a status update to the researcher, and to seek feedback on solutions
- When security issue has been satisfactorily resolved, researcher is welcome to publicly disclose finding
PGP Fingerprint
To send secure emails to our security team, please use the following PGP Fingerprint:
| Fingerprint |
| 0x95bcb1665c76c3a6 |
Questions
This is an open-ended dialogue. If there is anything missing, or if you’re just curious, please send us an email at security@urbanairship.com.
Hall of Fame
The hall of fame recognizes researchers findings publicly for the last four quarters. Thank you to everyone for your submissions and for working closely with Urban Airship.
| Researcher | Country | Quarter | Finding | Date |
|---|---|---|---|---|
| Dmitry Ivanov | Russia | Q4 FY’16 | XSS Vulnerability | 2016/11/21 |
| Mahad Ahmed | Pakistan | Q3 FY’17 | XSS Vulnerability | 2017/06/05 |