7 ms·

Teen hacks Pentagon websites, gets thanked for finding 'bugs'

48 points by ourmandave 10y ago

Dystopian 10y ago
"It's not a small sum, but if we had gone through the normal process of hiring an outside firm to do a security audit and vulnerability assessment, which is what we usually do, it would have cost us more than $1 million," ... It seems like a a pretty small sum to me. They paid out amount between $100-15000 for the bounties with a total of $75000. Gauging that one of the bounties at $15K sucked up around 20% of the overall budget and there were 137 other reports - it's literally the equivalent of paying outsourced-ODesk rates for security testing in time/value. What reason would anyone have for wanting to actively participate (not just poke-around like I'm sure quite a few employed professionals did) vs selling the exploits off on the dark web or just working in security for a company that pays a reasonable rate?
- k-mcgrady 10y ago
  >> "What reason would anyone have for wanting to actively participate (not just poke-around like I'm sure quite a few employed professionals did) vs selling the exploits off on the dark web or just working in security for a company that pays a reasonable rate?" The answer the your first alternative is pretty obvious: morals. That and not wanting to do jail time. To the second alternative I'm sure the people participating mostly have jobs or other commitments are are doing it for reasons other than the money.
  - ddworken 10y ago
    Yeah exactly. I certainly was in it for more than the money and would have happily worked on it even if there were no bounties.
- x5n1 10y ago
  Usually they use this as a recruiting tool.
- imglorp 10y ago
  The kids will find some low hanging fruit for cheap. It's a quick smoke test. After they get done fixing those, one would hope they still hire the pros.
us0r 10y ago
"approached by recruiters about potential internships." - Insulting. I would add those to my never list.
- Retr0spectrum 10y ago
  Why is this insulting?
  - raziel2702 10y ago
    I think it's because the parent would expect a job offer instead of an internship.
    - Retr0spectrum 10y ago
      That seems like an unreasonable expectation, considering he's still in full-time education - so he wouldn't be likely to accept a job offer in any case. It sounds like he only found XSS, which isn't exactly worthy of a job offer anyway.
      - startling 10y ago
        > isn't exactly worthy of a job offer anyway. 1) XSS is game over for sites with authentication. What kind of vulnerabilities do you think are more important than XSS? 2) XSS is a result. There are a lot of complicated XSS bugs.
      - ddworken 10y ago
        Yup planning on going to college so not interested in any full time job offers (though I have received them...).
    - chillacy 10y ago
      > Dworken, who graduated on Monday from Maret high school in Washington, D.C. I would've loved an internship as a new high school grad... most people don't get a tech internship till 2 or 3 years into college.
SOLAR_FIELDS 10y ago
The title makes it seem as if he was accessing these sites without the government expecting him to. In reality, this was a federal program called "Hack the Pentagon": https://hackerone.com/hackthepentagon https://hackerone.com/hackthepentagon
- labrador 10y ago
  The article also makes it sound like he is casual about it. He actually has a lot of experience and takes it pretty seriously. http://blog.daviddworken.com/ http://blog.daviddworken.com/
  - ddworken 10y ago
    While I do have a bit of experience with it, I still try to remain casual about it. Not by any means the only thing I do (Heading out hiking on the appalachian trail tomorrow!) so I try not to take it seriously. Thanks though! Also if anyone has any questions, let me know!
- meowface 10y ago
  Yeah, very misleading title. If he were just doing this on a whim, even if it were for 100% white hat purposes, he'd almost definitely have been arrested.
- iLoch 10y ago
  Presumably, otherwise he'd be an enemy of the state and probably living in Guantanamo by now.
smaili 10y ago
The most severe vulnerability submitted and the highest awarded was a SQL Injection. Can someone explain why this is still in existence? With the plethora of web frameworks and built in parameterization and ORM abstraction, I don't understand how this can still be exploited. Especially when we're talking about the Pentagon of all places.
- ourmandave 10y ago
  These are the guys that still use floppy disks to run the nuclear program. http://www.cnn.com/2016/05/26/us/pentagon-floppy-disks-nuclear/ http://www.cnn.com/2016/05/26/us/pentagon-floppy-disks-nucle... So probably on a legacy system before SQL injection was a thing.
- tetrep 10y ago
  Legacy code? It can't be very surprising that entities, especially the government, aren't quick to refactor old, "just works" code.
  - malux85 10y ago
    This is exactly it. From what I have found, these places either have 1) No programming resource internally. 2) Some programming resource internally, but they're so swamped with other, poorly managed timeframes and projects, there's no extra resources. So Light to Medium sized projects get outsourced - but if the delivered product "works" (at least visually) then who is going to QA the code? In fact, go one step back -- who is even going to think that the code needs to be checked? The management who chose the vendor? Hell no, that would look bad for them. The programmers who are swamped on other projects? Hell no, they're so busy they dont even want to talk to you. So management takes one glance at it, see's that it works, and it gets thrown into production. The first time it's security is tested, is when the international hackers come knocking... I'm not defending these actions in any way - I think it's a goddamn joke - but this is the reality
- onion2k 10y ago
  Practically every framework gives a developer the capability to run raw SQL queries on a database. The latest version of the popular PHP framework Laravel still has DB::raw. Express in NodeJS uses the NPM MySQL client that offers connection.query for raw SQL. Python's Flask framework uses SQLAlchemy and gives a developer db.engine.execute access. And so on for every language people make database driven websites in. Using a framework well stops SQL injection attacks dead in their tracks. Using one badly though, and they're still just as dangerous.
zyb09 10y ago
Suprised this link didn't go to theonion.com
4rt 10y ago
they should do the same moratorium for hackers as is suggested for weed smokers maybe

48 points by ourmandave 10y ago

"It's not a small sum, but if we had gone through the normal process of hiring an outside firm to do a security audit and vulnerability assessment, which is what we usually do, it would have cost us more than $1 million," ... It seems like a a pretty small sum to me. They paid out amount between $100-15000 for the bounties with a total of $75000. Gauging that one of the bounties at $15K sucked up around 20% of the overall budget and there were 137 other reports - it's literally the equivalent of paying outsourced-ODesk rates for security testing in time/value. What reason would anyone have for wanting to actively participate (not just poke-around like I'm sure quite a few employed professionals did) vs selling the exploits off on the dark web or just working in security for a company that pays a reasonable rate?

k-mcgrady 10y ago
>> "What reason would anyone have for wanting to actively participate (not just poke-around like I'm sure quite a few employed professionals did) vs selling the exploits off on the dark web or just working in security for a company that pays a reasonable rate?" The answer the your first alternative is pretty obvious: morals. That and not wanting to do jail time. To the second alternative I'm sure the people participating mostly have jobs or other commitments are are doing it for reasons other than the money.
- ddworken 10y ago
  Yeah exactly. I certainly was in it for more than the money and would have happily worked on it even if there were no bounties.
x5n1 10y ago
Usually they use this as a recruiting tool.
imglorp 10y ago
The kids will find some low hanging fruit for cheap. It's a quick smoke test. After they get done fixing those, one would hope they still hire the pros.

us0r 10y ago

"approached by recruiters about potential internships." - Insulting. I would add those to my never list.

Retr0spectrum 10y ago
Why is this insulting?
- raziel2702 10y ago
  I think it's because the parent would expect a job offer instead of an internship.
  - Retr0spectrum 10y ago
    That seems like an unreasonable expectation, considering he's still in full-time education - so he wouldn't be likely to accept a job offer in any case. It sounds like he only found XSS, which isn't exactly worthy of a job offer anyway.
    - startling 10y ago
      > isn't exactly worthy of a job offer anyway. 1) XSS is game over for sites with authentication. What kind of vulnerabilities do you think are more important than XSS? 2) XSS is a result. There are a lot of complicated XSS bugs.
    - ddworken 10y ago
      Yup planning on going to college so not interested in any full time job offers (though I have received them...).
  - chillacy 10y ago
    > Dworken, who graduated on Monday from Maret high school in Washington, D.C. I would've loved an internship as a new high school grad... most people don't get a tech internship till 2 or 3 years into college.

SOLAR_FIELDS 10y ago

The title makes it seem as if he was accessing these sites without the government expecting him to. In reality, this was a federal program called "Hack the Pentagon": https://hackerone.com/hackthepentagon https://hackerone.com/hackthepentagon

labrador 10y ago
The article also makes it sound like he is casual about it. He actually has a lot of experience and takes it pretty seriously. http://blog.daviddworken.com/ http://blog.daviddworken.com/
- ddworken 10y ago
  While I do have a bit of experience with it, I still try to remain casual about it. Not by any means the only thing I do (Heading out hiking on the appalachian trail tomorrow!) so I try not to take it seriously. Thanks though! Also if anyone has any questions, let me know!
meowface 10y ago
Yeah, very misleading title. If he were just doing this on a whim, even if it were for 100% white hat purposes, he'd almost definitely have been arrested.
iLoch 10y ago
Presumably, otherwise he'd be an enemy of the state and probably living in Guantanamo by now.

smaili 10y ago

The most severe vulnerability submitted and the highest awarded was a SQL Injection. Can someone explain why this is still in existence? With the plethora of web frameworks and built in parameterization and ORM abstraction, I don't understand how this can still be exploited. Especially when we're talking about the Pentagon of all places.

ourmandave 10y ago
These are the guys that still use floppy disks to run the nuclear program. http://www.cnn.com/2016/05/26/us/pentagon-floppy-disks-nuclear/ http://www.cnn.com/2016/05/26/us/pentagon-floppy-disks-nucle... So probably on a legacy system before SQL injection was a thing.
tetrep 10y ago
Legacy code? It can't be very surprising that entities, especially the government, aren't quick to refactor old, "just works" code.
- malux85 10y ago
  This is exactly it. From what I have found, these places either have 1) No programming resource internally. 2) Some programming resource internally, but they're so swamped with other, poorly managed timeframes and projects, there's no extra resources. So Light to Medium sized projects get outsourced - but if the delivered product "works" (at least visually) then who is going to QA the code? In fact, go one step back -- who is even going to think that the code needs to be checked? The management who chose the vendor? Hell no, that would look bad for them. The programmers who are swamped on other projects? Hell no, they're so busy they dont even want to talk to you. So management takes one glance at it, see's that it works, and it gets thrown into production. The first time it's security is tested, is when the international hackers come knocking... I'm not defending these actions in any way - I think it's a goddamn joke - but this is the reality
onion2k 10y ago
Practically every framework gives a developer the capability to run raw SQL queries on a database. The latest version of the popular PHP framework Laravel still has DB::raw. Express in NodeJS uses the NPM MySQL client that offers connection.query for raw SQL. Python's Flask framework uses SQLAlchemy and gives a developer db.engine.execute access. And so on for every language people make database driven websites in. Using a framework well stops SQL injection attacks dead in their tracks. Using one badly though, and they're still just as dangerous.

zyb09 10y ago

Suprised this link didn't go to theonion.com

4rt 10y ago

they should do the same moratorium for hackers as is suggested for weed smokers maybe