Vulnerabilities / Threats

8/10/2017
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

White Hats Take Aim in 'Hack the Air Force' Bug Bounty Program

The inaugural Air Force bug bounty program involved 272 vetted hackers, who submitted 207 valid flaws in 24 days.

The Department of Defense (DoD) let white-hat hackers take aim at the U.S. Air Force in its latest, largest, and most successful federal bug bounty program. "Hack the Air Force" resulted in 207 valid vulnerabilities disclosed and more than $130,000 in awards to participants.

This is the third time HackerOne and the DoD have partnered on a program in which hackers are invited to hunt vulnerabilities in government networks. Earlier initiatives included Hack the Pentagon and Hack the Army, which resulted in 138 and 118 valid bugs, respectively.

Hack the Air Force was announced in April 2017 and ran from May 30 through June 23. In 24 days, hackers dug through public-facing domains for security flaws. The first vulnerability was reported in less than one minute, and 23 were submitted in the first 24 hours.

Nine of the 207 valid bugs they discovered were of high or critical severity, says HackerOne CEO Marten Mickos.

"Those are the bugs you typically will fix as soon as you possibly can," Mickos explains. "It's a good sign when you find high severity bugs because then you can fix them before an adversary will use them for malicious intent."

The program involved 272 vetted hackers representing a range of ages, professional backgrounds, and nationalities. Two participants were active duty military personnel and 33 were not from the United States - a first for this type of program. The Pentagon invited participants from outside countries including the UK, Canada, Australia, and New Zealand.

"[The DoD] and we know the diversity of the hacking community is what drives great results," said Mickos. "The more countries we allow into the program, the more likely you'll find vulnerabilities you wouldn't always find."

To his point, participants from outside the US discovered 50 of the 207 total valid vulnerabilities. While it's possible future programs will include the international community, Mickos says this decision will likely be made on a case-by-case basis.

Over the course of the program, participants worked remotely using their own tools. hackerOne filtered their reports, determined their validity, and submitted bugs to the DoD.

"They don't need any expensive infrastructure or expensive access," Mickos explains. "They are trying to mimic what a criminal would do … they have to think like the bad guys."

Will future programs expand to include more hackers? It's possible, but Mickos thinks the current size at 272 is both small and varied enough to be easily manageable and drive participants to compete. If it were larger, or exclusive to solely advanced hackers, the results may be less diverse and fruitful.

"On the one hand, you would want to invite only the best hackers," he says. "On the other hand, you must create diversity and have many points of view, and have people competing with one another.

Financial compensation for vulnerabilities ranged from $100 to $5,000 per valid bug. The program's highest earner was a 17-year-old hacker who submitted 30 valid reports.

HackerOne and the DoD have an ongoing contract for challenges like this. It's worth noting that although Hack the Air Force is now closed, hackers who discover vulnerabilities can still report them to the DoD, which has an ongoing disclosure program running on HackerOne.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Number of Retailers Impacted by Breaches Doubles
Ericka Chickowski, Contributing Writer, Dark Reading,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19990
PUBLISHED: 2018-07-23
October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable v...
CVE-2018-19990
PUBLISHED: 2018-07-23
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend pat...
CVE-2018-19990
PUBLISHED: 2018-07-23
FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fix...
CVE-2018-19990
PUBLISHED: 2018-07-23
FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provide...
CVE-2018-19990
PUBLISHED: 2018-07-23
FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially c...