Management & Strategy

Tens of Vulnerabilities Found in Pentagon Travel Management System

HackerOne announced on Wednesday the results of “Hack the DTS,” the fifth bug bounty program run by the U.S. Department of Defense (DOD).

Eduard Kovacs

May 31, 2018

HackerOne announced on Wednesday the results of “Hack the DTS,” the fifth bug bounty program run by the U.S. Department of Defense (DOD).

The DTS (Defense Travel System) is a fully integrated and automated travel management system created specially for the DOD. The platform is said to be accessed by roughly 100,000 unique users every day, including for creating authorizations, receiving approvals, preparing reservations, and generating travel vouchers.

The Pentagon wanted to test the security of the platform and selected 19 vetted hackers from HackerOne to complete the task. Researchers, mainly from the United States and the United Kingdom, submitted more than 100 vulnerability reports, 65 of which were classified as unique and valid, including 28 that described critical and high severity flaws.

White hat hackers earned a total of $78,650 for their findings, with the highest single payout, $5,000, paid out eight times.

“DTS is relied on by DoD travelers. More than 9,500 sites operate worldwide, and the security of these systems is mission-critical,” said Jack Messer, project lead at Defense Manpower Data Center (DMDC). “The ‘Hack the DTS’ challenge helped uncover vulnerabilities we wouldn’t have found otherwise, complementing the great work DMDC is already doing to protect critical enterprise systems and the people those systems serve.”

HackerOne pointed out that Hack the DTS was the second government bug bounty program that allowed participants to use social engineering.

The Pentagon has awarded researchers hundreds of thousands of dollars for finding thousands of vulnerabilities in its systems. The money was paid out through the Hack the Pentagon, Hack the Air Force, Hack the Army, and Hack the Air Force 2.0 bug bounty programs.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar

Secrets to a Good Security Webinar or Conference Presentation

Tips for making a presentation that will help improve the state of security programs and reflect favorably on the presenters and their companies

Joshua Goldfarb

Application Security

Source Code Security Firm Cycode Launches With $4.6 Million in Funding

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Eduard KovacsSeptember 24, 2019