4 ms·
source plz. for white hats, I mean
by make3 9y ago
source plz. for white hats, I mean
- sirk1882 9y agoProbably depends on how willing you are to live and work in China.
- ryanlol 9y agoOh, I mean I guess you can probably find some country that'll be able to work out a profit-sharing agreement with you and allow you to legally steal money. https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogach... This guy is a good example of someone with a decent career in infosec operating on the right side of the law (Within his own jurisdiction, anyway). If you want to do charity reporting bugs, then you obviously will get paid like charity workers do.
- tyingq 9y agoThe question probably wasn't about whether an exploit specialist could net a lot of money, but rather, your claim of "a few hundred million $ per year". That's pretty extraordinary.
- ryanlol 9y agoHow is it extraordinary? Cryptocurrency heists of that scale happen regularly. Wire fraud in the high tens of millions is a daily thing. Shit out a OWA RCE bug and you can make billions swapping out bank account info in emails. All the money in the world is controlled by insecure computers, of course skilled exploit devs can drown themselves in it.
- tyingq 9y agoYou are describing rare, single digit numbers of events that netted enough to be characterized as hundreds of millions / year for a short time period. That's "extraordinary". Meaning that skill alone doesn't guarantee that earning level. Generally, single digit millions/year seems a reasonable expectation for a very talented (and ethically flexible) exploit practitioner. Beyond that requires luck and right place / right time.
- ryanlol 9y agoWire fraud is not rare. You can steal tens of millions by hacking a single companies webmail. It doesn’t even have to be a company with any infosec staff, think any big factory or a mine. Large wire transfers over email are a daily thing. I truly believe that the amount of people that could earn hundreds of millions a year doing this full time isn’t even that small.
- tyingq 9y agoHundreds of millions, per year, to a single exploit specialist, is. Not arguing your general point of financial benefit for world class exploit specialists. Just arguing the scale. The most famous one I'm aware of got $100M over two years and didn't get to keep it. http://fortune.com/2017/04/27/facebook-google-rimasauskas/ http://fortune.com/2017/04/27/facebook-google-rimasauskas/
- ryanlol 9y agoSure, I would expect that most people doing this sort of work don’t actually work full time. But the amounts of money you could steal with relatively little work are truly immense. >The most famous one I'm aware of got $100M over two years and didn't get to keep it. >http://fortune.com/2017/04/27/facebook-google-rimasauskas/ http://fortune.com/2017/04/27/facebook-google-rimasauskas/ This guy seems to be the polar opposite of a world class exploit dev, but he got pretty far. However he was also a pretty small player, I’m on my phone now but I’ll try to post some useful links in the morning.