Slashdot Mirror
DoD Announces New Bug Bounty Program Called Hack the Pentagon (npr.org)
Quince alPillan writes: Announcing what it calls "the first cyber bug bounty program in the history of the federal government," the Department of Defense says it's inviting vetted hackers to test the security of its web pages and networks. Vetted hackers will need to pass a background check and will be attacking a predetermined system that is not a part of critical operations. This program is being put together by the Digital Defense Service, launched last fall.
The FBI should follow suit with iPhones instead of litigation.
like, I cannot imagine this going hilariously astray
HACK THE PLANET!
MANic wmd on credit psychopaths refuse to share the stage with anyone? truth+mercy=justice.. cease fire.. in the moms we trust
Report a bug, get 10 year vacation at Guantanamo Bay?
'vetted' participants only testing things that don't matter = security theater. Meanwhile the unvetted Chinese and Russian hackers are hacking their critical operations.
it's a trap
The financial payoff is likely to be several orders of magnitude higher if you figure out how to hack ANY Department of Defense network and sell it on the black market vs working for the USG and pointing out the same flaws.
If the USG is serious about such a program, they might want to take this into consideration.
North Korea just announced a Bug Bounty program called, "Hack the Pentagon" too. Except, they're encouraging the hacking of critical systems. "Tell us first, get big reward!" is the slogan for the program. Oh, if I were only an Onion contributor...
In other news, the Chinese government projects a massive surge in revenue from "foreign sources." Economists are unclear on the details, but speculate it could lead to increased spending in the second quarter of 2016.
Not sure if it pays better though.
Are they going to clarify why a background check is required for people to test the security of their systems?
I can think of two reasons:
1: They have shown that a core interest is to protect what they're doing from the view of law-abiding citizens, so it makes sense to test it against law-abading citizens.
2: Republicans would cry foul if they paid out prize money to anyone with a criminal history. All punishment must be based on revenge because the bible says so, disproportionate because it gets their rocks off, eternal, so they can continue to feel superior, and rehabilitation is ungodly commie speak.
river of dreams award nominees.... infinite passion & patience, our real creators of traceable origin? no wonder they fuss?
For who's curious, some industry opinions about their so-called bug bounty. Not that good apparently.
http://news.softpedia.com/news/us-launches-bug-bounty-program-called-hack-the-pentagon-501261.shtml?utm_content=buffer150bd&utm_medium=social&utm_source=linkedin.com&utm_campaign=buffer
Are they going to clarify why a background check is required for people to test the security of their systems?
Because fewer and less qualified hackers will make it much easier to pass the test and declare their systems secure.
If you ever worked for the government, you would understand exactly how this situation arose. There is a committee (there is always a committee). Some members liked the idea of the bounty, and others opposed it. So instead of making a clear decision, they compromised, and passed a resolution to offer the bounty, but with so many restrictions and exclusions that it was essentially meaningless. That way, everyone can take credit if there are no breaches in the future, and everyone can disavow responsibility if there is an intrusion.
The article says, "According to DDS Director Chris Lynch, "Bringing in the best talent, technology and processes from the private sector..." Because the best are just waiting to volunteer to work without clear compensation.
What could possibly go wrong? :)
Come on, blaming republican narcissism is about one step away from blaming it on the second law of thermodynamics.
First price for the "hack the Pentagon" bug bounty program is a one way trip and indefinite accommodations at a tropical island not of your choosing. Stay in a sprawling complex overlooking a beautiful "bay," in one of the most up and coming tourist destinations in the world, Cuba.
storing our unsalable crude oil in railroad tanker cars all over the place starting our towns on fire poisoning & suffocating people,,. whose fault is that?
I don't really need to spell it out, do I?
Lacking <sarcasm> tags,
of thought contend. said Mao before the great purge.
We are having a contest to see who is the best hacker. You'll have to register first to be put on our special watch/no fly/no hire list.
LOL lapalooza
is not to play.
the Department of Defense says it's inviting vetted hackers to test the security of its web pages and networks. Vetted hackers will need to pass a background check"
thats like cops inviting vetted thieves to try and break into a house, after passing a background check yeah.... that will work! LULZ
Why don't they just hire infosys or TCS?
Or better yet why don't you get Disney to test your servers. They have cheap enough labor now....
To fish out Hackers?
None of the articles I Googled showed numbers. I'm skeptical the public side of the government can compete with the private business sector. Facebook split $900k over 210 people (or a whopping $4,300k per person) for their bug bounty program, and I can't believe that many people put that much effort into cracking top-notch security at Facebook for that little. In contrast, "black market" (I'm pretty sure vulnerability disclosure isn't illegal, yet) prices for an iOS RCE are $1m+, and I bet our government would pay more for it. http://www.tripwire.com/state-...
Chris Hanson is interviewing for baby sitters.
well, hacking the irs worked so well I guess they needed to expand the program
I think they call this a "Honey Pot."
you will be on 51 different lists and files, and you may be arrested and sent to prison.
It's pretty obvious why they should require background checks. Simply knowing what the DoD wants you to hack is information that's valuable to spies. Also, I guarantee you there are some Chinese and Russian hackers who would pass background checks. That's the whole point of inserting your agents into a foreign country.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
sounds like a huge waste of time
For those wanting to add "passed DoD background check" to their resume, this might be an opportunity to do it for free (as in no up-front monetary cost).
Omne ignotum pro magnifico.
How about mirroring the critical systems and their traffic, and arrange a continuous and monitored war game for the recruits of the relevant institutions? The best can then be selected for the oh-so-fashionable-and-futuristic cyber-divisions.
What's really amusing here is just how absurd the "must pass background check" hurdle is. It's an isolated system. There is zero risk. The DOD would benefit from any reveal of a vulnerability within this system from anyone. And of course there are many accomplished hackers out there who could contribute and would likely do so for the bounty, assuming it isn't trivial. but couldn't pass a background check under any circumstances. This approach is a poster child for "cutting off your nose to spite your face."
"Oh, you've hacked corporation X? Getoudaheah, you backround-check-failing-lowlife"
Sure. That will help them out a lot. Oh, the pitfalls of not having an actual profit motive...
I've fallen off your lawn, and I can't get up.
First,
The Pentagon has demonstrated they are not trustworthy to do a background check.
They are the folks who put the results in the OPM database where it got hacked and published.
Second, /honeypot/getmeifyoucan file which is fair game and comes with a reward.
If the hacking is only happening on honey pots, then the background check is not required for the hacking.
Hopefully the honey pot limit is only a first stage to find the easy holes.
The goal should be to actually secure the Pentagon, but the limit makes a mockery of that goal.
Long term, every machine should have a
Fair game means is you get on the machine and only go there, you get a get out of jail free card and the cash.
The interesting question is why are they asking for the background check. Maybe:
1) Their security folks only have one way to do things, even when they don't make sense
2) They are using the program as a tool to hire hackers for something more useful
3) They are using the program as a tool to catalog hackers who might be doing bad stuff somewhere else.
4) Most likely is all of the above.
Screw vetting and permission. If you want results publically announce a target and dispense with terms and conditions bullshit. Otherwise your just wasting everyone's time.
All anybody has to do is figure out what email server Hillary is using and the data will be free to collect.