White Hats Take Aim in 'Hack the Air Force' Bug Bounty Program

The Department of Defense (DoD) let white-hat hackers take aim at the U.S. Air Force in its latest, largest, and most successful federal bug bounty program. "Hack the Air Force" resulted in 207 valid vulnerabilities disclosed and more than $130,000 in awards to participants.

This is the third time HackerOne and the DoD have partnered on a program in which hackers are invited to hunt vulnerabilities in government networks. Earlier initiatives included Hack the Pentagon and Hack the Army, which resulted in 138 and 118 valid bugs, respectively.

Hack the Air Force was announced in April 2017 and ran from May 30 through June 23. In 24 days, hackers dug through public-facing domains for security flaws. The first vulnerability was reported in less than one minute, and 23 were submitted in the first 24 hours.

Nine of the 207 valid bugs they discovered were of high or critical severity, says HackerOne CEO Marten Mickos.

"Those are the bugs you typically will fix as soon as you possibly can," Mickos explains. "It's a good sign when you find high severity bugs because then you can fix them before an adversary will use them for malicious intent."

The program involved 272 vetted hackers representing a range of ages, professional backgrounds, and nationalities. Two participants were active duty military personnel and 33 were not from the United States - a first for this type of program. The Pentagon invited participants from outside countries including the UK, Canada, Australia, and New Zealand.

"[The DoD] and we know the diversity of the hacking community is what drives great results," said Mickos. "The more countries we allow into the program, the more likely you'll find vulnerabilities you wouldn't always find."

To his point, participants from outside the US discovered 50 of the 207 total valid vulnerabilities. While it's possible future programs will include the international community, Mickos says this decision will likely be made on a case-by-case basis.

Over the course of the program, participants worked remotely using their own tools. hackerOne filtered their reports, determined their validity, and submitted bugs to the DoD.

"They don't need any expensive infrastructure or expensive access," Mickos explains. "They are trying to mimic what a criminal would do … they have to think like the bad guys."

Will future programs expand to include more hackers? It's possible, but Mickos thinks the current size at 272 is both small and varied enough to be easily manageable and drive participants to compete. If it were larger, or exclusive to solely advanced hackers, the results may be less diverse and fruitful.

"On the one hand, you would want to invite only the best hackers," he says. "On the other hand, you must create diversity and have many points of view, and have people competing with one another.

Financial compensation for vulnerabilities ranged from $100 to $5,000 per valid bug. The program's highest earner was a 17-year-old hacker who submitted 30 valid reports.

HackerOne and the DoD have an ongoing contract for challenges like this. It's worth noting that although Hack the Air Force is now closed, hackers who discover vulnerabilities can still report them to the DoD, which has an ongoing disclosure program running on HackerOne.

Related Content: