120 ethical hackers examined the digital infrastructure of the Municipality of The Hague yesterday, October 5. From the Atrium of City Hall, students and professional hackers attempted to infiltrate the systems during the seventh edition of Hâck The Hague. A total of 125 reports were submitted. The majority of the reports were resolved the same day. The vulnerabilities found included overdue updates or misconfigurations at vendors.
Adeel Mahmood, Alderman for Service Delivery at the Municipality of The Hague: “In a society that is digitising at a rapid pace, digital security is an important prerequisite for reliable service delivery to our employees, residents, and entrepreneurs. We are constantly working on improving the security of our systems. We cannot do this without the human creativity of both our own security experts and honest hackers. That is quite exciting, but at the same time, it yields many new insights that help us enormously. This is evident every year during Hack The Hague.”
Chain Reaction in cyber security
The theme of this seventh edition was chain reaction. In cybersecurity, a chain reaction refers to an attack in which various small, standalone vulnerabilities or actions are cleverly combined in sequence. The end result is much larger and more damaging than the individual actions.
Hackers use this technique to bypass defense systems. The hacker often breaks in through a relatively harmless vulnerability, such as an outdated plugin on a website or a ‘phished’ employee with minimal privileges. From that position, the attacker looks for a second flaw, such as a system misconfiguration or a script running with administrator privileges. By using the first access to trigger the second flaw , the hacker can sometimes gain maximal privileges. That is a situation every organization wants to prevent.
With this theme, Hâck The Hague places extra emphasised how small, seemingly innocent vulnerabilities can combine to lead to major risks. This shows why testing entire chains of systems is at least as important as testing individual components.
Vulnerabilities and prices found
Various cash prizes were awarded this year in the categories Most Creative Hack , Most Sophisticated Hack, Most Impactful Hack , and The Hackademic Award , supplemented by two bonus prizes: Best Use of AI and Best Report . A total of €17,000 in prize money was distributed.
Lilian Knippenberg, CISO at the Municipality of The Hague: “We are incredibly pleased with all the findings from this edition. Hackers look at our systems with a fresh, critical eye, and that yields insights that we do not always see ourselves. We were already able to resolve some of the reports with the team today, also together with our suppliers. Digital security is a responsibility for all of us. This is also underscored year after year by Hâck The Hague.”
Large turnout
120 hackers participated this year, including students and professional hackers. Of the total, there were 80 professional hackers and 40 student hackers.
In the digital society, every organization is exposed to the risks of cybercrime on a daily basis. In the physical world, it is clear where a municipality’s responsibilities lie. In the digital world, this is often still a pioneering effort. During Hâck The Hague, the Municipality of The Hague gains a fresh, external perspective on its own municipal ICT systems. Moreover, this competition day contributes to inspiring students to pursue a career in cybersecurity. This is sorely needed, as the demand for cybersecurity specialists will continue to increase in the coming years.