4 ms·

that caught my eye too, anyone have a rough estimate for what sort of profitability one could expect from full time work in this field?

ryanlol 9y ago
If you're good at exploit dev? You can take however much money you want. https://www.reuters.com/article/us-bitfinex-hacked-hongkong/bitcoin-worth-72-million-stolen-from-bitfinex-exchange-in-hong-kong-idUSKCN10E0KP https://www.reuters.com/article/us-bitfinex-hacked-hongkong/... If you're a world class exploit developer working full time, expect earn a few hundred million $ per year. Of course there exists a whole industry full of people that'll offer you silly 6 digit salaries.
- make3 9y ago
  source plz. for white hats, I mean
  - sirk1882 9y ago
    Probably depends on how willing you are to live and work in China.
  - ryanlol 9y ago
    Oh, I mean I guess you can probably find some country that'll be able to work out a profit-sharing agreement with you and allow you to legally steal money. https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogach... This guy is a good example of someone with a decent career in infosec operating on the right side of the law (Within his own jurisdiction, anyway). If you want to do charity reporting bugs, then you obviously will get paid like charity workers do.
    - tyingq 9y ago
      The question probably wasn't about whether an exploit specialist could net a lot of money, but rather, your claim of "a few hundred million $ per year". That's pretty extraordinary.
      - ryanlol 9y ago
        How is it extraordinary? Cryptocurrency heists of that scale happen regularly. Wire fraud in the high tens of millions is a daily thing. Shit out a OWA RCE bug and you can make billions swapping out bank account info in emails. All the money in the world is controlled by insecure computers, of course skilled exploit devs can drown themselves in it.
        tyingq 9y ago
        You are describing rare, single digit numbers of events that netted enough to be characterized as hundreds of millions / year for a short time period. That's "extraordinary". Meaning that skill alone doesn't guarantee that earning level. Generally, single digit millions/year seems a reasonable expectation for a very talented (and ethically flexible) exploit practitioner. Beyond that requires luck and right place / right time.
        ryanlol 9y ago
        Wire fraud is not rare. You can steal tens of millions by hacking a single companies webmail. It doesn’t even have to be a company with any infosec staff, think any big factory or a mine. Large wire transfers over email are a daily thing. I truly believe that the amount of people that could earn hundreds of millions a year doing this full time isn’t even that small.
        tyingq 9y ago
        Hundreds of millions, per year, to a single exploit specialist, is. Not arguing your general point of financial benefit for world class exploit specialists. Just arguing the scale. The most famous one I'm aware of got $100M over two years and didn't get to keep it. http://fortune.com/2017/04/27/facebook-google-rimasauskas/ http://fortune.com/2017/04/27/facebook-google-rimasauskas/
droopybuns 9y ago
Google doesn’t support app purchases in China. https://www.bloomberg.com/gadfly/articles/2017-02-06/google-china-app-entry-won-t-be-something-to-shout-about https://www.bloomberg.com/gadfly/articles/2017-02-06/google-... This has created a strange ecosystem for app stores in China, which depend on vulnerability exploitation in varying degrees for installation privileges. Maybe some of the work is dual use, but the primary motivation for funding this kind of vuln discovery and exploit development seems to have been App Store ecosystem development in China.
- izacus 9y ago
  > This has created a strange ecosystem for app stores in China, which depend on vulnerability exploitation in varying degrees for installation privileges. Can you explain that a bit more? 3rd party app stores are legitimate on Android, so why would they depend on vulnerability exploitation?
  - droopybuns 9y ago
    I am a little unclear on why they operate the way they do, but the k33n team guys are all employed by Tencent. I’ve asked them about it and this was the rationale they presented. https://en.m.wikipedia.org/wiki/Tencent https://en.m.wikipedia.org/wiki/Tencent

ryanlol 9y ago

If you're good at exploit dev? You can take however much money you want. https://www.reuters.com/article/us-bitfinex-hacked-hongkong/bitcoin-worth-72-million-stolen-from-bitfinex-exchange-in-hong-kong-idUSKCN10E0KP https://www.reuters.com/article/us-bitfinex-hacked-hongkong/... If you're a world class exploit developer working full time, expect earn a few hundred million $ per year. Of course there exists a whole industry full of people that'll offer you silly 6 digit salaries.

make3 9y ago
source plz. for white hats, I mean
- sirk1882 9y ago
  Probably depends on how willing you are to live and work in China.
- ryanlol 9y ago
  Oh, I mean I guess you can probably find some country that'll be able to work out a profit-sharing agreement with you and allow you to legally steal money. https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogach... This guy is a good example of someone with a decent career in infosec operating on the right side of the law (Within his own jurisdiction, anyway). If you want to do charity reporting bugs, then you obviously will get paid like charity workers do.
  - tyingq 9y ago
    The question probably wasn't about whether an exploit specialist could net a lot of money, but rather, your claim of "a few hundred million $ per year". That's pretty extraordinary.
    - ryanlol 9y ago
      How is it extraordinary? Cryptocurrency heists of that scale happen regularly. Wire fraud in the high tens of millions is a daily thing. Shit out a OWA RCE bug and you can make billions swapping out bank account info in emails. All the money in the world is controlled by insecure computers, of course skilled exploit devs can drown themselves in it.
      - tyingq 9y ago
        You are describing rare, single digit numbers of events that netted enough to be characterized as hundreds of millions / year for a short time period. That's "extraordinary". Meaning that skill alone doesn't guarantee that earning level. Generally, single digit millions/year seems a reasonable expectation for a very talented (and ethically flexible) exploit practitioner. Beyond that requires luck and right place / right time.
        ryanlol 9y ago
        Wire fraud is not rare. You can steal tens of millions by hacking a single companies webmail. It doesn’t even have to be a company with any infosec staff, think any big factory or a mine. Large wire transfers over email are a daily thing. I truly believe that the amount of people that could earn hundreds of millions a year doing this full time isn’t even that small.
        tyingq 9y ago
        Hundreds of millions, per year, to a single exploit specialist, is. Not arguing your general point of financial benefit for world class exploit specialists. Just arguing the scale. The most famous one I'm aware of got $100M over two years and didn't get to keep it. http://fortune.com/2017/04/27/facebook-google-rimasauskas/ http://fortune.com/2017/04/27/facebook-google-rimasauskas/

droopybuns 9y ago

Google doesn’t support app purchases in China. https://www.bloomberg.com/gadfly/articles/2017-02-06/google-china-app-entry-won-t-be-something-to-shout-about https://www.bloomberg.com/gadfly/articles/2017-02-06/google-... This has created a strange ecosystem for app stores in China, which depend on vulnerability exploitation in varying degrees for installation privileges. Maybe some of the work is dual use, but the primary motivation for funding this kind of vuln discovery and exploit development seems to have been App Store ecosystem development in China.

izacus 9y ago
> This has created a strange ecosystem for app stores in China, which depend on vulnerability exploitation in varying degrees for installation privileges. Can you explain that a bit more? 3rd party app stores are legitimate on Android, so why would they depend on vulnerability exploitation?
- droopybuns 9y ago
  I am a little unclear on why they operate the way they do, but the k33n team guys are all employed by Tencent. I’ve asked them about it and this was the rationale they presented. https://en.m.wikipedia.org/wiki/Tencent https://en.m.wikipedia.org/wiki/Tencent