120 hackers report 125 issues during Hâck The Hague
During Cybersecurity Week in The Hague, 120 ethical hackers examined the City of The Hague’s digital infrastructure. Working from the City Hall Atrium, students and professional hackers attempted to gain access to the systems during the seventh edition of Hâck The Hague.
A total of 125 reports were submitted, most of which were resolved the same day. The vulnerabilities identified included overdue updates and misconfigurations in suppliers’ systems.
“In a society that is rapidly becoming more digital, digital security is essential to providing reliable services to our staff, residents and businesses. We are continually working to improve the security of our systems. We cannot do this without the human creativity of both our own security experts and ethical hackers. That can be daunting, but it also generates many new insights that are enormously helpful to us. Hâck The Hague demonstrates this every year.”
Adeel Mahmood, Deputy Mayor for Public Services at the City of The Hague
Chain Reaction in cybersecurity
ThemeThe theme of this seventh edition was Chain Reaction. In cybersecurity, a chain reaction refers to an attack in which several small, separate vulnerabilities or actions are cleverly combined in sequence. The resulting impact is far greater and more damaging than that of the individual actions.
Hackers use this technique to bypass security defences. An attacker often gains initial access through a relatively minor vulnerability, such as an outdated website plug-in or the account of an employee with limited access rights who has fallen victim to phishing. From that position, the attacker looks for a second weakness, such as a misconfigured system or a script running with administrator privileges. By using the initial access to exploit the second weakness, the hacker can sometimes gain full access rights. This is a situation every organisation wants to prevent.
Through this theme, Hâck The Hague placed particular emphasis on how small, seemingly harmless vulnerabilities can combine to create significant risks. It demonstrates why testing entire chains of systems is at least as important as testing individual components.
Lilian Knippenberg, Chief Information Security Officer (CISO) at the City of The Hague, said:
“We are very pleased with all the findings from this edition. Hackers bring a fresh, critical perspective to our systems, providing insights we do not always identify ourselves. Our team was able to resolve some of the reported issues on the day, including in collaboration with our suppliers. Digital security is a shared responsibility. Hâck The Hague reinforces that message every year.”
Vulnerabilities identified and prizes awarded
Cash prizes were awarded this year in the categories Most Creative Hack, Most Sophisticated Hack, Most Impactful Hack and The Hackademic Award, alongside two bonus prizes: Best Use of AI and Best Report. A total of €17,000 in prize money was awarded.
Strong turnout
This year, 120 hackers took part: 80 professional hackers and 40 student hackers.
In a digital society, every organisation faces daily risks from cybercrime. In the physical world, the scope of a city’s powers and responsibilities is clear. In the digital world, this often remains uncharted territory. Hâck The Hague gives the City of The Hague a fresh, external perspective on its own ICT systems. The competition also helps inspire students to pursue a career in cybersecurity. This is much needed, as demand for cybersecurity specialists is set to increase further in the coming years.
