Hack the Air Force: USAF awards record bounties to white-hat hackers.

Hack the Air Force was HackerOne’s third partnership with the US Department of Defense (DoD), following the Hack the Pentagon and Hack the Army bug bounty challenges. The Hack the Air Force challenge ran for 24-days from May 30, 2017 through June 23, 2017. It engaged 272 vetted hackers to scour its public-facing IT domains for security vulnerabilities, awarding financial incentives between $100 and $5,000 per valid vulnerability reported. Two participants in the program were active duty military personnel and 33 participants came from outside the United States. Top participating hackers were under 20 years old, including a 17-year-old who submitted 30 valid reports and earned the largest bounty sum during the duration of the challenge.

“Every organization needs to identify and fix their software vulnerabilities. The most effective way is to ask the external world for help,” said Marten Mickos, CEO of HackerOne. “We’ve seen new levels of success with every federal bug bounty challenge and Hack the Air Force is no exception. Activating the global hacker community to shore up their digital defenses is enabling faster progress than ever before.”

The diverse pool of Hack the Air Force participants contributed to the program’s success and unprecedented results. With 207 valid vulnerabilities disclosed, Hack the Air Force was the DoD’s most successful bug bounty program to date. The first vulnerability was reported in less than one minute. Within the first 24 hours, 23 valid reports were submitted. The first federal bug bounty program, Hack the Pentagon, resulted in 138 valid vulnerability reports and the second program, Hack the Army, culminated in 118 valid reports.

“Adversaries are constantly attempting to attack our websites, so we welcome a second opinion — and in this case, hundreds of second opinions — on the health and security of our online infrastructure,” said Peter Kim, U.S. Air Force Chief Information Security Officer. “By engaging a global army of security researchers, we’re better able to assess our vulnerabilities and protect the Air Force’s efforts in the skies, on the ground and online.”

While the Hack the Air Force challenge is now closed, any hackers who become aware of vulnerabilities can disclose them to the DoD through its ongoing vulnerability disclosure program on HackerOne.