An eighth iteration of the Pentagon\u2019s bug bounty program discovered a critical vulnerability in Department of Defense systems.<\/p>\n\n\n\n
HackerOne, the ethical hacking company partnered with the DoD for penetration testing, announced Oct. 14 it completed the Pentagon\u2019s \u201cHack the Proxy\u201d program, which allowed white hat hackers to probe the department\u2019s Virtual Private Networks, virtual desktops and proxies.<\/p>\n\n\n\n
The hackers found 31 vulnerabilities. Nine were considered \u201chigh severity” and 21 were \u201cmedium\/low severity.” The release did not offer any additional details on the critical vulnerability found. Last year, an Army secure file sharing site was taken offline because a critical vulnerability was found through a similar disclosure program.<\/p>\n\n\n\n
The goal was to find \u201cfind places where the many external DoDIN [Department of Defense Information Network] touchpoints might be used by adversaries to surveil information that is internal to the network.\u201d<\/p>\n\n\n\n
“Validating capabilities, closing previously unknown vulnerabilities, and enforcing standards improve our ability to conduct multidomain military operations,\u201d said Master Sgt. Michael Methven at U.S. Cyber Command\u2019s Directorate of Operations. \u201cHack the Proxy is an important approach that leverages crowd-sourced talent for an outside-in view of our vulnerabilities. At little cost, we identify and mitigate vulnerabilities more effectively, making the Department\u2019s networks more resilient and securing our data from malicious cyber actors.\u201d<\/p>\n\n\n\n
The Pentagon doled out $33,750 to hackers who submitted valid vulnerabilities between Sept. 3-18. In total, 81 hackers from across the world participated. The biggest prize was $5,000. One U.S.-based hacker won $16,000, nearly half the purse.<\/p>\n\n\n\n
\u201cWith each new initiative, the Department of Defense further bolsters its cyber defenses against rogue enemy actors thanks to white hat hackers from across the globe,\u201d said Alex Romero, digital service expert at the Department of Defense Defense Digital Service. \u201cAs our adversaries become more sophisticated in their tactics, we must stay one step ahead to protect our citizens and defense systems.”<\/p>\n\n\n\n
The \u201cHack the Proxy” program, sponsored by U.S. Cyber Command is a partnership between the DoD, Defense Digital Service and HackerOne. HackerOne leads several ethical hacking events with various Pentagon components, including several iterations of hacking the military services and Pentagon as a whole.<\/p>\n\n\n\n
Hack the Proxy was the first bug bounty focused on find vulnerabilities in government-owned, publicly accessible proxy servers. HackerOne disclosure programs, which started in 2016, have discovered over 10,000 vulnerabilities.<\/p>\n\n\n\n
“The DoD has embraced hacker-powered security with open arms by consistently collaborating with hackers worldwide to help them find areas where they can be vulnerable to attack,\u201d said Marten Mickos, CEO of HackerOne. \u201cEach initiative has not only bolstered the DoD\u2019s cybersecurity posture, but also served as an example of how trusting hackers can improve defense system on an ongoing basis.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The eighth iteration of the Department of Defense’s program used crowd-sourced talent to make networks more resilient.<\/p>\n","protected":false},"author":7,"featured_media":32595,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":16,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["it-networks","home","daily-brief","newsletters"],"primary_category":"it-networks"}}},"categories":[10,106,29,16,32],"tags":[],"coauthors":[3252],"class_list":["post-15900","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-daily-brief","category-home","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"JFLBOAMOZFE23IU23ZXTH4RQWQ","arc_canonical_url":"\/dod\/2019\/10\/14\/the-latest-pentagon-bug-bounty-revealed-a-critical-vulnerability\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n