16 ms·
Teen Becomes First Hacker to Earn $1M Through Bug Bounties
- umvi 8y agoI like the picture at the beginning of some CLI novice trying to git push his home directory
- aw3c2 8y agowell, the username is "dau" which in good old German computer slang is the Dümmster Anzunehmender User -> dumbest user possible.
- analogmemory 8y agoThat reminds me of my idea to create "tech" stock imagery that isn't a joke
- whichIsFunny 8y agoSomehow, I think most stock images are crafted from a position or vantage point of objectively stupid cluelessness. No matter the discipline depicted in stock photos and clip art, it always conveys a total detachment of context, campy corny sentiment and general lack of expertise. Not so much by accident, but by virtue of catering to clientelle disinterested in accuracy, and with the awareness that all participants (both buyers and sellers) are motivated to reduce costs at all levels of the creative process.
- jaredsohn 8y agoSo the opposite of what the Hacker Dojo did around 2012/2013: https://slate.com/technology/2013/02/hacker-photos-how-hacker-dojo-pranked-wired-with-hilariously-stereotypical-stock-images.html https://slate.com/technology/2013/02/hacker-photos-how-hacke...
- hn_throwaway_99 8y agoIf you'd like I can whip up a GUI interface in Visual Basic. You can use that to track an IP address.
- ericmcer 8y agoWho doesn't `git status` their home directory sometimes
- newman8r 8y agoI like the random nucleotide sequence in the background. super relevant.
- arthurcolle 8y agoThe terminal could have opacity at 75% and then have some bioinformatics stuff in the background in another application (browser, whatever). I want to believe.
- deleted 8y ago[deleted]
- aboutruby 8y agoThe double `ls` hits home :D (more like `git s` nowadays, also <esc>:w on repeat).
- armamut 8y agoI definitely do have respect to this guy named Santiago Lopez, while I'm literally twice as old as him.
- badfrog 8y agoWhat does the second part of that sentence have to do with the first?
- mattigames 8y agoHe had half the time to learn than many older people that also live off bugs bounties?
- tom_ 8y agoMx Armamut is perhaps not a native English speaker. Let us suppose that the first part of the sentence is a statement, and the second part is the rationale - then, by way of conjunction, a native speaker would probably choose something like "because", or similar. I expect there are languages where a word that translates neatly into "while" would be most appropriate, while actually meaning something more like "because". It's been a while since the last time I had to speak any foreign, but I remember stuff like this being very common - a large part of the reason I refuse to do it any more.
- dahart 8y agoI’d say ‘while’ is perfectly fine for a native speaker in place of ‘because’. You could leave ‘while’ out of the sentence, the comma alone implies ‘because’. The reason for the statement is implied by the two clauses sitting side by side, many connective words would do equally well, right? The only thing that suggests a non-native speaker to me is ‘respect to’, which is still sometimes correct. Respect to charitable interpretations, and respect to multi-lingual people.
- armamut 8y agoYes =) both @tom_ and @mattigames are right. I'm not a native English speaker, pardon my English usage. What I mean is, this guys achivement shows his self-motivation, dedication and knowledge level at a relatively younger age. (Maybe for some, he is old enough.)
- yoz-y 8y agoThis is great, especially that somebody with his skills could probably earn much more working for shady "security" companies.
- JMTQp8lwXL 8y agoI wish I had a knack for this type of work. That's quite a bit of cash. I do feel I am a competent software engineer, but understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities.
- quickthrower2 8y agoBeware survivorship bias, I wonder what the average hourly rate of bug hunters is?
- chronode 8y agoTrail of Bits has a nice summary[0] on that (they're discussing this[1] book). > As productive as the top 1% are, their earnings are equally depressing. The top seven participants in the Facebook data set averaged 0.87 bugs per month, earning an average yearly salary of $34,255; slightly less than what a pest control worker makes in Mississippi. --- [0] https://blog.trailofbits.com/2019/01/14/on-bounties-and-boffins/ https://blog.trailofbits.com/2019/01/14/on-bounties-and-boff... [1] https://mitpress.mit.edu/books/new-solutions-cybersecurity https://mitpress.mit.edu/books/new-solutions-cybersecurity
- whiskeykilo 8y agoThe Trail of Bits piece kinda ignores the amount of time invested however: https://www.techrepublic.com/article/bug-bounty-programs-everything-you-thought-you-knew-is-wrong/ https://www.techrepublic.com/article/bug-bounty-programs-eve...
- badfrog 8y ago> understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities. No, but it does suggest that you're likely capable of learning security work. Just like your data structure and algorithm knowledge didn't come for free, nobody is born knowing how to find security problems. You need to work for it.
- cosmin800 8y agoJust imagine the amount of cash if he went all black :p
- Narkov 8y agoI'm very happy for the kid and like the idea that these programs are available but does this incentivise companies to effectively outsource their bug finding? From a purely fiscal point of view, why hire expensive full time staff to go digging when you can just throw a few sheckles at stuff as it comes up?
- xfitm3 8y agoYou still neee security engineers to operate the program.
- cgb223 8y agoWhen your company is as massive as something like google and you have nation states, groups, and individuals literally trying to hack you every few minutes, it’s definitely more financially viable to have a full time security team Outsourcing bug finding is only a retroactive solution, not a proactive one
- Sebb767 8y agoBecause a bug bounty does not guarantee that people actually look into your code. Of course some white hats while invest time upfront, but there is no guarantee and absence of payed bounties is not evidence of absence of bugs. Also, a bug bounty usually limits the scope a lot more than a typical pentest does, i.e. no testing of infrastructure security, internal networks etc.. Lastly, if your bug bounty is high enough to make highly skilled people spent time to find your bugs its probably cheaper to just higher some security folks yourself and prevent excessive payouts (by preventing bugs). Of course all of this does not stop some C-levels from using a bug bounty as replacement, but the issue is not as clear cut and especially the last point should even make sense to non-technical people.
- badfrog 8y agoWhy not both? The bounties are great for finding things your security team might not think about or might consider low-pri, but having a dedicated team is important to make sure you've got the core use cases covered.
- deleted 8y ago
- cryptokernel 8y agoCan I join the bug hunt too? Just leaving this here: https://coincircle.com/l/50VVxbObg3 https://coincircle.com/l/50VVxbObg3
- dooglius 8y agoI wonder if he's come up with some automated tooling to find them, seems like this might be the best way to monetize if so.
- tyingq 8y agoI found this, describing his specialty: "Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big scale.
- zulln 8y agoDo you have any suggestions on how? I do not doubt it can be automated, but it is one of few vulnerability types I do not have an intuitively understanding on how it should be done. It seems hard to automatically understanding the difference with IDOR-vulnerability in the HR-system (from your link), salary.php?employee=EMP-00000 where you can change the ID for another employee and article.php?id=123 in a newspaper site.
- dooglius 8y agoWould it have to understand the difference? You could do pretty well with a crawler that detects such fields (by checking a simple increment, say) that then spits out URL/field combinations. Then you just need to scan through those and follow up on the ones that look like security holes.
- tyingq 8y agoYou could focus on links that aren't in Google's cache, or links that match some numerical pattern in a set cookie, etc. Cookies are probably a whole thing on their own in this space too.
- nickpsecurity 8y ago
- shiado 8y agoPro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen twice. There needs to be a bug bounty site with some sort of bug escrow to prevent this behavior. Edit: pardon the tone, I understand that these types of problems are very very hard to solve because they aren't purely technical and involve humans.
- hartator 8y agoTo be on the other side of this, we do received unsolicited but welcomed bug and security reports. Some are legit and we pay bounties even if we don't have an official policy and we are an early startup. Others are just automated reports that people copy and paste. These ones are uninteresting, but these people still think they deserve money. Often more aggressively than the legitimate ones.
- thrwawy0001 8y agoCan you elaborate on the automated reports a bit more? What makes them uninteresting?
- throwawayjava 8y agoExamples of "vulnerability" reports I've received: - Dump of CVEs for "Web App X" or "Server X", even though literally zero of them apply to the version that I'm currently running. - Dumps of port scans with warnings like "Running SSH on port 22 is not recommended" and "Server accepts HTTP. Always use HTTPS". I assume there are tools that generate these reports because the reports use decent English but the accompanying emails are written in very broken English.
- rootsudo 8y agoI miss the days when nessus was good enough to justify being cool. Then again my favorite bug back in the day was veritas backup acting as a reverse shell. I only learned of that by running nessus.
- tptacek 8y agoThis is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.
- crapbone 8y agoBut no one is going to pay $330k to a 17 year old with no experience
- elpakal 8y agoAnd a pretty good income for 13/14 year old
- towawayzone 8y agoThe person in the article started at 16 and is now 19.
- mcv 8y agoEven so, it's an amazingly good income for a teenager. Live with your parents, and you're a millionaire before you're 20. Live anywhere outside Silicon Valley, and it's still a fantastic income for anyone.
- staticassertion 8y agoWell, they did, right? So that doesn't seem true.
- mirimir 8y agoThis is very cool, and props to the kid. But damn, I wonder what Srinivasa Ramanujan or Norbert Wiener would have focused on if they were 13 now. And maybe that's just whataboutism.
- vntok 8y agoBreaking SSL worldwide probably.
- danschumann 8y agoI wonder if anyone has "cobra effect"ed the bug bounty world yet.. whereby they leave vulnerabilities in their code in order to obtain a bug bounty.
- satellitec4t 8y agoObligatory Dilbert https://dilbert.com/strip/1995-11-13 https://dilbert.com/strip/1995-11-13
- masonic 8y agoFrom 23 years ago!
- danschumann 8y agoHow did you find such a specific reference lol
- satellitec4t 8y agoSomeone showed me this strip ~10 years ago when the place I was working briefly instituted a similarly counterproductive incentive policy. I just Googled "Dilbert code me a minivan"
- dasil003 8y agoI have never once heard of a bug bounty being paid to a former employee let alone to the same person who wrote the code. It strikes me as something that is likely to do damage to ones reputation far out of proportion the few thousands of dollars one might hope to gain.
- briansmith 8y agoI received a bug bounty from Mozilla after leaving, in a browser component I previously worked on. I didn't write the vulnerable code though. On the other hand, Google refused to pay me a bug bounty for a bug I found in the same component, in part because I used to work on it when I was at Mozilla, even though I didn't write the vulnerable code.
- thisisweirdok 8y agoWoo! We need more capable bug bounty hunters. So many reports are very very very bad.
- Proven 8y agoSo somehow in this case child labor is acceptable? Edit: would "Teen Earns $500 Collecting Garbage and Helps Family Pay Mortgage" be just as acceptable to SJWs?
- cstrat 8y agoImpressive! This one 19 year old has earned 2.5% of all cash paid out by HackerOne...
- philip1209 8y agoI'm still waiting on YC to set up a bug bounty program after having two verified reports :-)
- openloop 8y agoReconsider your strategy
- alexnewman 8y agonot saying in this case, but i’ve heard it can often be more effective to group bug reports into more or less accounts. obviously privacy is a huge concern in a bug bounty program and i find it absurd how much the vendors charge small companies
- plicense 8y agoI would love to see a breakdown of which company paid the most :) Shopify, Uber used to be at the top of the list.
- arbaawl 8y agoSangat membantu
- arbaawl 8y agoYhanks