Threat Intelligence

1/19/2018
11:34 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

You Break It, They Buy It: Economics, Motivations Behind Bug Bounty Hunting

Some bug hunters make 16 times the median salary of software engineers in their home countries.

As the momentum grows in both the private and public sector for crowdsourced bug bounty programs, freelance security researchers are increasingly finding their profession for finding software vulnerabilities turning into a lucrative career opportunity in its own right.

Once the primary domain for hobbyists, curious security moonlighters and passionate penetration testers, freelance vulnerability research has typically been a profitless and frequently thankless job. That's not to say bright security minds haven't made money off of their work in the past--just that it's typically come from consulting gigs, opportunities for better in-house security positions, very targeted and involved penetration testing engagements, and so on. All of which often require a broader set of business skills, a specific educational background and even geographical location not necessarily required for pure-play bug hunting.

Bug bounties are completely changing this economic equation, making it possible for organizations to tap into a collective of hackers who they may otherwise have not been able to leverage in the past. And that pool is maturing as it becomes possible to make a decent living hunting bounties. According to a new report out from HackerOne, the economics are such that bug bounties are becoming financially significant in the lives of many of these researchers.

Based on data from the nearly 1,700 researchers producing through the HackerOne platform, approximately 14% of hackers can now count on bounties to make up 90- to 100% of their annual income. An additional 25% say that they depend on bounties to make up at least half of their income. In dollars and cents, about 12% of hackers make $20,000 per year. The really dedicated top performers - about 3% of hackers - are pulling in $100,000 or more per year.

This particularly is a big deal in countries with low median salaries, as most bug bounties don't have geographic limiters, which means hackers can work from anywhere. This is giving people with strong coding skills and the hacking mindset a new avenue to seriously increase their earning potential.

According to the report, top-earning researchers pull in 2.7 times the median salary of a software engineer in their home country. And in countries like India, that multiplier is more along the lines of 16 times the median developer salary.

"This makes bounties enormously attractive and gets precisely the eyes you want looking at your security things. Bounties are a great leveler in terms of providing opportunity to all not solely money motivated," Troy Hunt, a security researcher and consultant, told HackerOne for this study.

This is a body of researchers who are largely self-taught. While about half of these researchers have studied computer science at a collegiate level, less than 5% learned hacking skills in the classroom. This is a big clue as to the passion they bring to their projects.

For the most part, these are people who would be hacking anyway - the money just makes it possible to dedicate more time to what they love because people are paying them to do it. Money is a top motivator but it's not the number one motivator, the survey found. Other motivators named more frequently were the drives for the challenge, the learning opportunity, and simply the fun of hacking.

But let's keep it real: the fact remains that bounties are still on the bleeding edge of best security best practices. Most companies today don't even have a formalized vulnerability disclosure program, let alone a full-fledged bug bounty program. Many of these researchers still find plenty of vulnerabilities with no expectation for remuneration but have difficulty disclosing them because organizations can't get their acts together to receive them properly.

According to this latest study, one in four freelance security researchers say they've not reported some vulnerabilities they've found because the target company didn't have a channel to disclose it. 

The silver lining: over 72% of researchers report that companies receiving recent vulnerabilities have been more open to hearing from researchers than they had in the past.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/22/2018 | 12:15:48 PM
Are bug bounties part of the cure, or part of the problem?
Seems we're putting a lot of trust in the members of a club; one with the only membership requirement being talent.

There have always been those who would, responsibly, inform software providers about errors or vulnerabilities - with recognition being the only reward. Bug hunters may, on average, be ethical and civic minded; but you don't have to be to find profit in finding vulnerabilities.  We've now created the expectation that if someone finds a vulnerability in your software - YOU will pay to learn what they found.  Odds are you will, one way or another.  Of course, there will also be those who will pay to find vulnerabilities in the code of their rivals.  Are bug bounties part of the cure, or part of the problem?
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.