Threat Intelligence

1/19/2018
11:34 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

You Break It, They Buy It: Economics, Motivations Behind Bug Bounty Hunting

Some bug hunters make 16 times the median salary of software engineers in their home countries.

As the momentum grows in both the private and public sector for crowdsourced bug bounty programs, freelance security researchers are increasingly finding their profession for finding software vulnerabilities turning into a lucrative career opportunity in its own right.

Once the primary domain for hobbyists, curious security moonlighters and passionate penetration testers, freelance vulnerability research has typically been a profitless and frequently thankless job. That's not to say bright security minds haven't made money off of their work in the past--just that it's typically come from consulting gigs, opportunities for better in-house security positions, very targeted and involved penetration testing engagements, and so on. All of which often require a broader set of business skills, a specific educational background and even geographical location not necessarily required for pure-play bug hunting.

Bug bounties are completely changing this economic equation, making it possible for organizations to tap into a collective of hackers who they may otherwise have not been able to leverage in the past. And that pool is maturing as it becomes possible to make a decent living hunting bounties. According to a new report out from HackerOne, the economics are such that bug bounties are becoming financially significant in the lives of many of these researchers.

Based on data from the nearly 1,700 researchers producing through the HackerOne platform, approximately 14% of hackers can now count on bounties to make up 90- to 100% of their annual income. An additional 25% say that they depend on bounties to make up at least half of their income. In dollars and cents, about 12% of hackers make $20,000 per year. The really dedicated top performers - about 3% of hackers - are pulling in $100,000 or more per year.

This particularly is a big deal in countries with low median salaries, as most bug bounties don't have geographic limiters, which means hackers can work from anywhere. This is giving people with strong coding skills and the hacking mindset a new avenue to seriously increase their earning potential.

According to the report, top-earning researchers pull in 2.7 times the median salary of a software engineer in their home country. And in countries like India, that multiplier is more along the lines of 16 times the median developer salary.

"This makes bounties enormously attractive and gets precisely the eyes you want looking at your security things. Bounties are a great leveler in terms of providing opportunity to all not solely money motivated," Troy Hunt, a security researcher and consultant, told HackerOne for this study.

This is a body of researchers who are largely self-taught. While about half of these researchers have studied computer science at a collegiate level, less than 5% learned hacking skills in the classroom. This is a big clue as to the passion they bring to their projects.

For the most part, these are people who would be hacking anyway - the money just makes it possible to dedicate more time to what they love because people are paying them to do it. Money is a top motivator but it's not the number one motivator, the survey found. Other motivators named more frequently were the drives for the challenge, the learning opportunity, and simply the fun of hacking.

But let's keep it real: the fact remains that bounties are still on the bleeding edge of best security best practices. Most companies today don't even have a formalized vulnerability disclosure program, let alone a full-fledged bug bounty program. Many of these researchers still find plenty of vulnerabilities with no expectation for remuneration but have difficulty disclosing them because organizations can't get their acts together to receive them properly.

According to this latest study, one in four freelance security researchers say they've not reported some vulnerabilities they've found because the target company didn't have a channel to disclose it. 

The silver lining: over 72% of researchers report that companies receiving recent vulnerabilities have been more open to hearing from researchers than they had in the past.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/22/2018 | 12:15:48 PM
Are bug bounties part of the cure, or part of the problem?
Seems we're putting a lot of trust in the members of a club; one with the only membership requirement being talent.

There have always been those who would, responsibly, inform software providers about errors or vulnerabilities - with recognition being the only reward. Bug hunters may, on average, be ethical and civic minded; but you don't have to be to find profit in finding vulnerabilities.  We've now created the expectation that if someone finds a vulnerability in your software - YOU will pay to learn what they found.  Odds are you will, one way or another.  Of course, there will also be those who will pay to find vulnerabilities in the code of their rivals.  Are bug bounties part of the cure, or part of the problem?
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.