4 ms·

With the increasing number and value of these bounty programs, how viable is a career in professional free lance security bug hunting?

by crsv 9y ago

tptacek 9y ago
It's doable, but if you're good enough to somewhat routinely find bounty-worthy bugs but not spooky good at it, it's not the most lucrative way to put bug-hunting skills to work.
- cperciva 9y ago
  I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a point where bug-hunters' ability to use sophisticated tools will be what earns them the most money, rather than their ability to eyeball code and see the bugs. Speaking just for myself: A few years ago I was saying "I should really set aside a few months to learn to use fuzzing tools"; now I'm saying "it's easier to just offer bounties and let someone else do the fuzzing for me".
  - dsacco 9y ago
    As those tools become more widely used and more easy to use, you'll be able to lower the mean bug bounty reward payment as well.
  - mindingdata 9y ago
    There was this thing called "Hostile Subdomain Takeover" where a company would point a subdomain to a particular SaaS product (Say Zendesk), sometime later, they would cancel their subscription but not change the A record. Someone could then go and register a new Zendesk account (If the service doesn't require proof of ownership of domain), and say that they want to use the same subdomain. Now they have a Zendesk account with the URL of http://help.somedomain.com http://help.somedomain.com as an example. And they can phish people quite easily. Anyway, the reason I bring it up is because for a while, I saw people spamming the shit out of bug bounties with this stuff. Because it's super simple to do. So I'm not sure what is more lucrative for an average joe, actually learning proper techniques or trying to piggy back on some low hanging fruit that may be easy to automate.
    - thaumasiotes 9y ago
      This is definitely still a thing.
  - dsl 9y ago
    I did this on a popular bug bounty platform. Wrote a tool to look for the top 10 most common issues with mobile apps and auto submit bugs. Fuzzing is where you are going to find most memory corruption bugs these days, bounties or not.
  - deleted 9y ago
    [deleted]
- dsacco 9y ago
  And even if you're "spooky good", you only really need to be spooky good for six - 12 months before something like Google Project Zero will pick you up to (in all likelihood) pay you far more anyway.
- deleted 9y ago
  [deleted]
marcoperaza 9y ago
My understanding is that the grey market for exploits is way more lucrative than the bug bounty programs.
- tptacek 9y ago
  It is in the very specific case that: (1) You are effective at finding the specific kinds of vulnerabilities that the grey market actually purchases. People have _very_ weird ideas about what the grey market wants. In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. (2) You are willing to get your hands dirty with shady purchasers. If you're talented, you can make good money in the grey market, or you can retain plausible deniability about what your work is being used for, but you can't do both of those things. That first case is really the limiting factor. And remember, if you can reliably sell bugs to the grey market, that strongly implies you have lucrative options in the legitimate market. Bug bounties are not the most competitive alternative to the grey market!
  - dsl 9y ago
    > In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. That sounds like black market buyers (maybe we disagree on where the "gray" line is). Governments are very interested in bugs that allow pivoting and lateral movement.
    - daddyo 9y ago
      How would one, hypothetically, go about selling exploits/bugs to governments as a freelancer?
      - big_youth 9y ago
        Plenty of brokers exist, I'm personally familiar with Exodus Intelligence and Zerodium
      - dsacco 9y ago
j0hnml 9y ago
I wonder the same thing. The only downside I can see is that the more days that go by while bug-hunting, the more anxious I'll get about not having a consistent biweekly paycheck. It would be a very results-driven career à la sales, but I'm not sure I could take that stress. If you are legitimately good enough, there are certainly companies out there who will pay you well and consistently to hunt for bugs/vulns.

With the increasing number and value of these bounty programs, how viable is a career in professional free lance security bug hunting?

by crsv 9y ago

With the increasing number and value of these bounty programs, how viable is a career in professional free lance security bug hunting?

tptacek 9y ago

It's doable, but if you're good enough to somewhat routinely find bounty-worthy bugs but not spooky good at it, it's not the most lucrative way to put bug-hunting skills to work.

cperciva 9y ago
I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a point where bug-hunters' ability to use sophisticated tools will be what earns them the most money, rather than their ability to eyeball code and see the bugs. Speaking just for myself: A few years ago I was saying "I should really set aside a few months to learn to use fuzzing tools"; now I'm saying "it's easier to just offer bounties and let someone else do the fuzzing for me".
- dsacco 9y ago
  As those tools become more widely used and more easy to use, you'll be able to lower the mean bug bounty reward payment as well.
- mindingdata 9y ago
  There was this thing called "Hostile Subdomain Takeover" where a company would point a subdomain to a particular SaaS product (Say Zendesk), sometime later, they would cancel their subscription but not change the A record. Someone could then go and register a new Zendesk account (If the service doesn't require proof of ownership of domain), and say that they want to use the same subdomain. Now they have a Zendesk account with the URL of http://help.somedomain.com http://help.somedomain.com as an example. And they can phish people quite easily. Anyway, the reason I bring it up is because for a while, I saw people spamming the shit out of bug bounties with this stuff. Because it's super simple to do. So I'm not sure what is more lucrative for an average joe, actually learning proper techniques or trying to piggy back on some low hanging fruit that may be easy to automate.
  - thaumasiotes 9y ago
    This is definitely still a thing.
- dsl 9y ago
  I did this on a popular bug bounty platform. Wrote a tool to look for the top 10 most common issues with mobile apps and auto submit bugs. Fuzzing is where you are going to find most memory corruption bugs these days, bounties or not.
- deleted 9y ago
  [deleted]
dsacco 9y ago
And even if you're "spooky good", you only really need to be spooky good for six - 12 months before something like Google Project Zero will pick you up to (in all likelihood) pay you far more anyway.
deleted 9y ago
[deleted]

marcoperaza 9y ago

My understanding is that the grey market for exploits is way more lucrative than the bug bounty programs.

tptacek 9y ago
It is in the very specific case that: (1) You are effective at finding the specific kinds of vulnerabilities that the grey market actually purchases. People have _very_ weird ideas about what the grey market wants. In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. (2) You are willing to get your hands dirty with shady purchasers. If you're talented, you can make good money in the grey market, or you can retain plausible deniability about what your work is being used for, but you can't do both of those things. That first case is really the limiting factor. And remember, if you can reliably sell bugs to the grey market, that strongly implies you have lucrative options in the legitimate market. Bug bounties are not the most competitive alternative to the grey market!
- dsl 9y ago
  > In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. That sounds like black market buyers (maybe we disagree on where the "gray" line is). Governments are very interested in bugs that allow pivoting and lateral movement.
  - daddyo 9y ago
    How would one, hypothetically, go about selling exploits/bugs to governments as a freelancer?
    - big_youth 9y ago
      Plenty of brokers exist, I'm personally familiar with Exodus Intelligence and Zerodium
    - dsacco 9y ago

j0hnml 9y ago

I wonder the same thing. The only downside I can see is that the more days that go by while bug-hunting, the more anxious I'll get about not having a consistent biweekly paycheck. It would be a very results-driven career à la sales, but I'm not sure I could take that stress. If you are legitimately good enough, there are certainly companies out there who will pay you well and consistently to hunt for bugs/vulns.