One of the main firms associated with the Hack the Army effort released the results of the service's first bug bounty program.
In a blog post published Jan. 19, HackerOne said from Nov. 30 to Dec. 21:
- 371 eligible participants registered.
- 416 total reports were received.
- 118 total valid reports were received
- It took five minutes to receive the first vulnerability report.
HackerOne touted the preliminary results posted on their website as a success. Twenty-five of the 371 eligible and invited were government employees including 17 military personnel — a difference in the original Hack the Pentagon initiative.
An estimated $100,000 in bounties was paid to hackers.
HackerOne said the most significant vulnerability discovered was a series of chained vulnerabilities in which a researcher could move from the public-facing goarmy.com to an internal Department of Defense website requiring special credentials.
HackerOne also promised more to come from this effort.
Like the Defense Digital Service — a Silicon Valley-modeled node within the Pentagon focused on difficult problems, such as Hack the Pentagon — the Army and Air Forcehave stood up their own iteration.
Mark Pomerleau is a reporter for C4ISRNET, covering information warfare and cyberspace.
