White hat hackers, or 'ethical hackers', are computer hackers or computer security experts who specialize in penetration testing and in other testing methodologies to ensure digital security of information systems.
A contrast to black hat hackers or malicious hackers, ethical hackers work under good intentions, and also with permission. These people are often hired directly or indirectly to hack into a system, and report bugs.
And here, the U.S. Department of Defense’s Cyber Crime Center (DC3) released numbers from its Vulnerability Disclosure Program (VDP), showing that the agency processed 4,013 vulnerability reports, 2,836 of which led to mitigation activities. According to a statement, 8% of all submissions were labelled as critical or high severity.
In other words, outside security researchers alerted the Pentagon about more software vulnerabilities in its networks, more than ever before.
“It was our busiest year to date with a staggering 21.7% increase of submitted reports from 2017,” the DC3 report says.
In 2019, white hackers were submitting unpatched virtual private network (VPN) endpoints, where the vulnerabilities allowed malicious hackers to steal user credentials and monitor traffic.
According to the report, these submissions from the program were the “most severe”.
“VPN endpoints are not the only issue,” the report notes. “We also see unpatched and exploitable content management servers such as DotNetNuke, WordPress, and even vBulletin with vulnerabilities ranging from simple reflected cross-site scripting and Denial of Service all the way to remote command execution.”
The top two most common weaknesses that the vulnerability disclosures exposed in 2019 also included cases where DoD entities were exposing information to unauthorized individuals, as well as violations of secure design principles.
From script issues, business logic errors, secure design issues, information disclosure issues, improper access control, operating system command injection issues, open redirect flaws and others, all of which could make it easy for black hat hackers to carry out their attacks.
The Department of Defense has been working to uncover vulnerabilities with the help of white hat hackers for years.
Back in 2016, the department launched what it called “Hack the Pentagon”, a program that rewarded white hat hackers who initially uncovered about 140 vulnerabilities in five public websites, and paid out a nearly $150,000 for the bug bounty.
The program was a success that the U.S. government was even willing to spend $34 million since the initial Hack the Pentagon, to expand the program.
Back in February, the director of the VDP, Kristopher Johnson, said that many organizations remain reluctant to work with hackers. The Pentagon however, has taken a contrast approach, and has gone through an internal transformation to partner with white hat hackers in the interest of bolstering government defenses.
“Working with hackers to improve an organization’s cyber hygiene was considered a revolutionary idea in 2016, but it has evolved to become almost commonplace in DoD,” Johnson said. “Trust is the foundation of the disclosure program…We trust that the hackers will follow the policy and do no harm.”
Knowing that the program has indeed attracted many talented individuals submitting bugs for patching, the VDP is working with both the Defense Counterintelligence and Security Agency (DCSA) and the DC3’s Defense Industrial Base Collaborative Information Sharing Environment (DCISE) to test a possible launch of a vulnerability disclosure program for the defense industrial base.
“We hope to replicate our success by leveraging both the DoD’s knowledge and capabilities for private defense companies that do not have the ability or resources to do this on their own,” the annual report says.
