Slashdot Mirror
Army Bug Bounty Researcher Compromises US Defense Department's Internal Network (threatpost.com)
Thursday the U.S. Army shared some surprising results from its first bug bounty program -- a three-week trial in which they invite 371 security researchers "trained in figuring out how to break into computer networks they're not supposed to."
An anonymous reader quotes Threatpost:
The Army said it received more than 400 bug reports, 118 of which were unique and actionable. Participants who found and reported unique bugs that were fixed were paid upwards of $100,000... The Army also shared high-level details on one issue that was uncovered through the bounty by a researcher who discovered that two vulnerabilities on the goarmy.com website could be chained together to access, without authentication, an internal Department of Defense website.
"They got there through an open proxy, meaning the routing wasn't shut down the way it should have been, and the researcher, without even knowing it, was able to get to this internal network, because there was a vulnerability with the proxy, and with the actual system," said a post published on HackerOne, which managed the two bounty programs on its platform. "On its own, neither vulnerability is particularly interesting, but when you pair them together, it's actually very serious."
"They got there through an open proxy, meaning the routing wasn't shut down the way it should have been, and the researcher, without even knowing it, was able to get to this internal network, because there was a vulnerability with the proxy, and with the actual system," said a post published on HackerOne, which managed the two bounty programs on its platform. "On its own, neither vulnerability is particularly interesting, but when you pair them together, it's actually very serious."
Tech worker that failed the DOD drug test: "No, that clearly says "Crisco". I know you have to go with the lowest bidder, but damn, you've bought your firewalled routers from a vegetable shortening company."
It pains me that this was a one-off, three week event, rather than something that is done daily or at regular intervals. Compsec is a perpetuity, not an annuity.
Of course, the is a simpler solution available to the US Army - take back the bounty money and declare publicly that military cyber-security is perfect and no successful expires were found.
Using swipe to input from an Android tablet . . . I've really got to start double-checking before I hit the 'submit' button.
Which don't seem to be preventing us from exporting weapons-grade stupidity, in any event.
How long have the Russians known about this, and what have they done with it?
don't worry, the army of old guys who know Linux will tell them what went wrong
"Old man yells at systemd"
Surprising how similar those two things are these days, isn't it?
Oh, real hacker. Hehe.
"Old man yells at systemd"
Posting anonymously for reasons.
The US army has competent personnel - very little of what goes on at Ft. Huachuca is public, the army ITOC has always been a good place for zero day exploits, and there's a small army of civilian contractors at places (Aberdeen and others) that do some interesting things.
Here's the thing: When an army grey hat / white hat discovers something interesting, or creates something interesting, they don't get PERSONAL credit - they don't go hack a database, or deface a website and splay their name and try making the news. You don't hear about them. The image of "solo rogue hacker" is out of a 90s movie, and most people classifying themselves as such - in need of a classification or identification - are script kiddies. We have shops. They have shops. It doesn't do anyone good for everyone to be talking about them.
But don't kid yourself that there's no talent - or that this fun PR event was the summation of assembled talent.
I think there is some truth to that. I wouldn't do well in the Army. My natural tendency is to challenge assumptions and manipulate, if not break, the rules. This personality has served me well in my infosec career.
My tendency to always think about what I can get away with fits infosec well, but probably not DoD. It has also meant that I have to be very careful about ethical and moral behavior. Since I'm always thinking about how I *could* steal something or how I *could* spy on someone, it would be easy to start actually stealing and spying of I'm not on guard.
Not a surprise when most government contracts these days go to lowest bidder. Lowest bidder often equates to low(est) quality...
[The Universe] has gone offline.
up or out! = stay good at your job and get forced out or get pushed up to more paper pushing management jobs.
Hey, at least in this case, he's right, and not spamming the board. When he behaves well we should treat him well.
That would be interesting if true, but the truth is "most" government contracts don't actually go to the lowest bidder. Especially in software, cyber, cloud, and data science. A cost/value tradeoff is determined using a wighted score combining the bid, the proposed technical & management solution, and the bidders' past-performance. Then, there is typically a downselection to the top 3, then more information and final bids are collected, and then the winner is selected by choosing the contractor with the highest combined score. What you're thinking of is called an LPTA aquisition and while they were popular for a few years in the late 2000s, that trend has largely reversed. Which is good for anything other than commodotized services and products.
You have a point, he is however spamming, just not here.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
*Yawn*
How childish. I thought you were retired and therefore should be more mature than me. When will you start looking into the mirror and fix yourself before attacking others?
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
No, there has been 0 attacking here from my side. I suggested, rather politely, that you should perhaps stop stalking and harassing raymorris. You are the one who then flipped shit and started your barrage of attacking.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?