Threat Intelligence

1/19/2018
11:34 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

You Break It, They Buy It: Economics, Motivations Behind Bug Bounty Hunting

Some bug hunters make 16 times the median salary of software engineers in their home countries.

As the momentum grows in both the private and public sector for crowdsourced bug bounty programs, freelance security researchers are increasingly finding their profession for finding software vulnerabilities turning into a lucrative career opportunity in its own right.

Once the primary domain for hobbyists, curious security moonlighters and passionate penetration testers, freelance vulnerability research has typically been a profitless and frequently thankless job. That's not to say bright security minds haven't made money off of their work in the past--just that it's typically come from consulting gigs, opportunities for better in-house security positions, very targeted and involved penetration testing engagements, and so on. All of which often require a broader set of business skills, a specific educational background and even geographical location not necessarily required for pure-play bug hunting.

Bug bounties are completely changing this economic equation, making it possible for organizations to tap into a collective of hackers who they may otherwise have not been able to leverage in the past. And that pool is maturing as it becomes possible to make a decent living hunting bounties. According to a new report out from HackerOne, the economics are such that bug bounties are becoming financially significant in the lives of many of these researchers.

Based on data from the nearly 1,700 researchers producing through the HackerOne platform, approximately 14% of hackers can now count on bounties to make up 90- to 100% of their annual income. An additional 25% say that they depend on bounties to make up at least half of their income. In dollars and cents, about 12% of hackers make $20,000 per year. The really dedicated top performers - about 3% of hackers - are pulling in $100,000 or more per year.

This particularly is a big deal in countries with low median salaries, as most bug bounties don't have geographic limiters, which means hackers can work from anywhere. This is giving people with strong coding skills and the hacking mindset a new avenue to seriously increase their earning potential.

According to the report, top-earning researchers pull in 2.7 times the median salary of a software engineer in their home country. And in countries like India, that multiplier is more along the lines of 16 times the median developer salary.

"This makes bounties enormously attractive and gets precisely the eyes you want looking at your security things. Bounties are a great leveler in terms of providing opportunity to all not solely money motivated," Troy Hunt, a security researcher and consultant, told HackerOne for this study.

This is a body of researchers who are largely self-taught. While about half of these researchers have studied computer science at a collegiate level, less than 5% learned hacking skills in the classroom. This is a big clue as to the passion they bring to their projects.

For the most part, these are people who would be hacking anyway - the money just makes it possible to dedicate more time to what they love because people are paying them to do it. Money is a top motivator but it's not the number one motivator, the survey found. Other motivators named more frequently were the drives for the challenge, the learning opportunity, and simply the fun of hacking.

But let's keep it real: the fact remains that bounties are still on the bleeding edge of best security best practices. Most companies today don't even have a formalized vulnerability disclosure program, let alone a full-fledged bug bounty program. Many of these researchers still find plenty of vulnerabilities with no expectation for remuneration but have difficulty disclosing them because organizations can't get their acts together to receive them properly.

According to this latest study, one in four freelance security researchers say they've not reported some vulnerabilities they've found because the target company didn't have a channel to disclose it. 

The silver lining: over 72% of researchers report that companies receiving recent vulnerabilities have been more open to hearing from researchers than they had in the past.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/22/2018 | 12:15:48 PM
Are bug bounties part of the cure, or part of the problem?
Seems we're putting a lot of trust in the members of a club; one with the only membership requirement being talent.

There have always been those who would, responsibly, inform software providers about errors or vulnerabilities - with recognition being the only reward. Bug hunters may, on average, be ethical and civic minded; but you don't have to be to find profit in finding vulnerabilities.  We've now created the expectation that if someone finds a vulnerability in your software - YOU will pay to learn what they found.  Odds are you will, one way or another.  Of course, there will also be those who will pay to find vulnerabilities in the code of their rivals.  Are bug bounties part of the cure, or part of the problem?
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9978
PUBLISHED: 2019-03-24
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CVE-2019-9977
PUBLISHED: 2019-03-24
The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code execution, and display a crafted message to vehicle occupants.
CVE-2019-9962
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to VCRUNTIME140!memcpy.
CVE-2019-9963
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlFreeHeap.
CVE-2019-9964
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey.