U.S. military invites vetted experts to 'Hack the Pentagon' | Hacker News Reader

U.S. military invites vetted experts to 'Hack the Pentagon'

reuters.com

65 pointsstephenhuey21 comments

What could possibly go wrong? :D

I do think this is an interesting effort, and I've met Chris Lynch in his DDS capacity. It's terribly interesting to see a Senior Executive government employee with Silicon Valley cred, who wears hoodies/jeans/sneakers to meet Admirals and Generals, who are (in terms of rank equivalency) his peers. Literally the first time I've seen someone knuckle-bump an Admiral rather than shake his hand after a meeting.

I think there is some value in this culture-clash/disruption, but I also know of some government-employed very skillful hackers who resent the assumption that non-government hackers are by-default more skillful than them.

fist bump

LoLs! I stand corrected! :)

I'm going for firmware and processor errata if they let me in on this. Their failure will be so expensive that I'll finally have the numbers to justify either semi-custom work from Intel/AMD for legacy or a multi-core, secure RISC-V. :)

Is there any info on where to sign up?

Edit: From the press release:

The pilot program will launch in April and the department will provide more details on requirements for participation and other ground rules in the coming weeks.

http://www.defense.gov/News/News-Releases/News-Release-View/...

From the "what, they weren't doing that already?" department.

They had their own internal groups, but this is now open to external pentesters.

Pentesters, I like the term. Clever combination

Works better than Testagons.

"Testagons" is even better, a jewel. Testa (= Head) + Gone

This is a word that wants to be discovered. Practical example: "Hi, we call from the medicus mundi hospital, some of your damned testagons are bombing us again". Pure gold for journalists.

They've always used external pens, but through contracts. This seems to be more like an "open" bug bounty program which just requires prior vetting for obvious reasons.

How about "Hack the OPM"? Let's start with the easy stuff first.

> Details and rules were still being worked out but the competition could involve monetary awards, the Pentagon said.

What do you all think are some decent choices for details and rules?

If you find Tic Tac Toe and Chess, it's OK to play those; if you find Global Thermonuclear War, it's not OK to play that.

"The only winning move is not to play."

Soon nearly every pentagon employee will be social-engineered and compromised. People will begin to believe that every single system they access is a MITM or phishing attempt.

Probably better than the alternative, since they'd at least be thinking about security as something more than an abstract "thing." If that. Then they just need to take that fear and find a way to funnel it into proper security education without that fear becoming crippling.

I'm glad this is being implemented and not just considered.

So basically they're crowdsourcing penetration testing.

That's called "being on the internet"

It's also called bug bounties (see Hacker1, BugCrowd, synack)

Reply on news.ycombinator.com