Vulnerabilities / Threats

8/10/2017
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

White Hats Take Aim in 'Hack the Air Force' Bug Bounty Program

The inaugural Air Force bug bounty program involved 272 vetted hackers, who submitted 207 valid flaws in 24 days.

The Department of Defense (DoD) let white-hat hackers take aim at the U.S. Air Force in its latest, largest, and most successful federal bug bounty program. "Hack the Air Force" resulted in 207 valid vulnerabilities disclosed and more than $130,000 in awards to participants.

This is the third time HackerOne and the DoD have partnered on a program in which hackers are invited to hunt vulnerabilities in government networks. Earlier initiatives included Hack the Pentagon and Hack the Army, which resulted in 138 and 118 valid bugs, respectively.

Hack the Air Force was announced in April 2017 and ran from May 30 through June 23. In 24 days, hackers dug through public-facing domains for security flaws. The first vulnerability was reported in less than one minute, and 23 were submitted in the first 24 hours.

Nine of the 207 valid bugs they discovered were of high or critical severity, says HackerOne CEO Marten Mickos.

"Those are the bugs you typically will fix as soon as you possibly can," Mickos explains. "It's a good sign when you find high severity bugs because then you can fix them before an adversary will use them for malicious intent."

The program involved 272 vetted hackers representing a range of ages, professional backgrounds, and nationalities. Two participants were active duty military personnel and 33 were not from the United States - a first for this type of program. The Pentagon invited participants from outside countries including the UK, Canada, Australia, and New Zealand.

"[The DoD] and we know the diversity of the hacking community is what drives great results," said Mickos. "The more countries we allow into the program, the more likely you'll find vulnerabilities you wouldn't always find."

To his point, participants from outside the US discovered 50 of the 207 total valid vulnerabilities. While it's possible future programs will include the international community, Mickos says this decision will likely be made on a case-by-case basis.

Over the course of the program, participants worked remotely using their own tools. hackerOne filtered their reports, determined their validity, and submitted bugs to the DoD.

"They don't need any expensive infrastructure or expensive access," Mickos explains. "They are trying to mimic what a criminal would do … they have to think like the bad guys."

Will future programs expand to include more hackers? It's possible, but Mickos thinks the current size at 272 is both small and varied enough to be easily manageable and drive participants to compete. If it were larger, or exclusive to solely advanced hackers, the results may be less diverse and fruitful.

"On the one hand, you would want to invite only the best hackers," he says. "On the other hand, you must create diversity and have many points of view, and have people competing with one another.

Financial compensation for vulnerabilities ranged from $100 to $5,000 per valid bug. The program's highest earner was a 17-year-old hacker who submitted 30 valid reports.

HackerOne and the DoD have an ongoing contract for challenges like this. It's worth noting that although Hack the Air Force is now closed, hackers who discover vulnerabilities can still report them to the DoD, which has an ongoing disclosure program running on HackerOne.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.