Security Experts:

Connect with us

Hi, what are you looking for?


Management & Strategy

Tens of Vulnerabilities Found in Pentagon Travel Management System

HackerOne announced on Wednesday the results of “Hack the DTS,” the fifth bug bounty program run by the U.S. Department of Defense (DOD).

HackerOne announced on Wednesday the results of “Hack the DTS,” the fifth bug bounty program run by the U.S. Department of Defense (DOD).

The DTS (Defense Travel System) is a fully integrated and automated travel management system created specially for the DOD. The platform is said to be accessed by roughly 100,000 unique users every day, including for creating authorizations, receiving approvals, preparing reservations, and generating travel vouchers.

The Pentagon wanted to test the security of the platform and selected 19 vetted hackers from HackerOne to complete the task. Researchers, mainly from the United States and the United Kingdom, submitted more than 100 vulnerability reports, 65 of which were classified as unique and valid, including 28 that described critical and high severity flaws.

White hat hackers earned a total of $78,650 for their findings, with the highest single payout, $5,000, paid out eight times.

“DTS is relied on by DoD travelers. More than 9,500 sites operate worldwide, and the security of these systems is mission-critical,” said Jack Messer, project lead at Defense Manpower Data Center (DMDC). “The ‘Hack the DTS’ challenge helped uncover vulnerabilities we wouldn’t have found otherwise, complementing the great work DMDC is already doing to protect critical enterprise systems and the people those systems serve.”

HackerOne pointed out that Hack the DTS was the second government bug bounty program that allowed participants to use social engineering.

The Pentagon has awarded researchers hundreds of thousands of dollars for finding thousands of vulnerabilities in its systems. The money was paid out through the Hack the Pentagon, Hack the Air Force, Hack the Army, and Hack the Air Force 2.0 bug bounty programs.

Related: DOJ Helps Organizations Build Vulnerability Disclosure Programs

Related: HackerOne Offers Free Service to Open Source Projects

Related: General Services Administration Launches Bug Bounty Program

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.