White Hats Take Aim in Hack the Air Force Bug Bounty Program

The inaugural Air Force bug bounty program involved 272 vetted hackers, who submitted 207 valid flaws in 24 days.

The Department of Defense (DoD) let white-hat hackers take aim at the U.S. Air Force in its latest, largest, and most successful federal bug bounty program. Hack the Air Force resulted in 207 valid vulnerabilities disclosed and more than $130,000 in awards to participants.
This is the third time HackerOne and the DoD have partnered on a program in which hackers are invited to hunt vulnerabilities in government networks. Earlier initiatives included Hack the Pentagon and Hack the Army, which resulted in 138 and 118 valid bugs, respectively.
Hack the Air Force was announced in April 2017 and ran from May 30 through June 23. In 24 days, hackers dug through public-facing domains for security flaws. The first vulnerability was reported in less than one minute, and 23 were submitted in the first 24 hours.
Nine of the 207 valid bugs they discovered were of high or critical severity, says HackerOne CEO Marten Mickos.
Those are the bugs you typically will fix as soon as you possibly can, Mickos explains. Its a good sign when you find high severity bugs because then you can fix them before an adversary will use them for malicious intent.
The program involved 272 vetted hackers representing a range of ages, professional backgrounds, and nationalities. Two participants were active duty military personnel and 33 were not from the United States - a first for this type of program. The Pentagon invited participants from outside countries including the UK, Canada, Australia, and New Zealand.
[The DoD] and we know the diversity of the hacking community is what drives great results, said Mickos. The more countries we allow into the program, the more likely youll find vulnerabilities you wouldnt always find.
To his point, participants from outside the US discovered 50 of the 207 total valid vulnerabilities. While its possible future programs will include the international community, Mickos says this decision will likely be made on a case-by-case basis.
Over the course of the program, participants worked remotely using their own tools. hackerOne filtered their reports, determined their validity, and submitted bugs to the DoD.
They dont need any expensive infrastructure or expensive access, Mickos explains. They are trying to mimic what a criminal would do … they have to think like the bad guys.
Will future programs expand to include more hackers? Its possible, but Mickos thinks the current size at 272 is both small and varied enough to be easily manageable and drive participants to compete. If it were larger, or exclusive to solely advanced hackers, the results may be less diverse and fruitful.
On the one hand, you would want to invite only the best hackers, he says. On the other hand, you must create diversity and have many points of view, and have people competing with one another.
Financial compensation for vulnerabilities ranged from $100 to $5,000 per valid bug. The programs highest earner was a 17-year-old hacker who submitted 30 valid reports.
HackerOne and the DoD have an ongoing contract for challenges like this. Its worth noting that although Hack the Air Force is now closed, hackers who discover vulnerabilities can still
report
them to the DoD, which has an ongoing disclosure program running on HackerOne.
Related Content:
Konni Malware Campaign Targets North Korean Organizations
2017 Pwnie Awards: Who Won, Lost, and Pwned
Steganography Use on the Rise Among Cyber Espionage, Cybercrime Groups
Voting System Hacks Prompt Push for Paper-Based Voting

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
White Hats Take Aim in Hack the Air Force Bug Bounty Program