10 ms·

I wish I had a knack for this type of work. That's quite a bit of cash. I do feel I am a competent software engineer, but understanding data structures and algo

I wish I had a knack for this type of work. That's quite a bit of cash. I do feel I am a competent software engineer, but understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities.

quickthrower2 8y ago
Beware survivorship bias, I wonder what the average hourly rate of bug hunters is?
- chronode 8y ago
  Trail of Bits has a nice summary[0] on that (they're discussing this[1] book). > As productive as the top 1% are, their earnings are equally depressing. The top seven participants in the Facebook data set averaged 0.87 bugs per month, earning an average yearly salary of $34,255; slightly less than what a pest control worker makes in Mississippi. --- [0] https://blog.trailofbits.com/2019/01/14/on-bounties-and-boffins/ https://blog.trailofbits.com/2019/01/14/on-bounties-and-boff... [1] https://mitpress.mit.edu/books/new-solutions-cybersecurity https://mitpress.mit.edu/books/new-solutions-cybersecurity
  - whiskeykilo 8y ago
    The Trail of Bits piece kinda ignores the amount of time invested however: https://www.techrepublic.com/article/bug-bounty-programs-everything-you-thought-you-knew-is-wrong/ https://www.techrepublic.com/article/bug-bounty-programs-eve...
badfrog 8y ago
> understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities. No, but it does suggest that you're likely capable of learning security work. Just like your data structure and algorithm knowledge didn't come for free, nobody is born knowing how to find security problems. You need to work for it.
- HeavenBanned 8y ago
  What's a way to learn security work? Genuinely curious.
  - badfrog 8y ago
    I'm not a security expert by any means, but based on learning other niche-ish areas of technology, the following probably exist for security: * Books * MOOCs * Lecture notes, slides, and assignments from university courses * Subreddits, Quora topics, etc * Prominent community members you can follow on Twitter
    - saagarjha 8y ago
      In my experience, security has much fewer of those resources. Most of the information seems to shared through word-of-mouth, conference presentations, and blog posts.
      - lucb1e 8y ago
        Much of the information is also just RTFM. I don't think it's a stretch to say that security is a lifestyle: if I read the documentation of an API, more often than not I'll wonder if something can be abused for something. Or when trying to register for health insurance, the password field required special characters, so I set my password generator to include them, after which the form broke, and so I investigated and found that I could inject scripts there. It's just stuff I come across when I'm not even trying. Word of mouth, chat groups where things are shared, conferences, blog posts... yes, those are resources. But it's also just a whole lot of curiosity and poking at systems.
        Izmaki 8y ago
        And experience. Knowing what to look for, even if it's just the HTML source of a web page, is rather important in the first steps of breaking the system. How do you learn what to look for? Well, certainly there are blog posts and even playgrounds with virtual systems and components one can have a go at.
blondin 8y ago
no one mentioned it but the secret sauce is to have a "thing" for breaking and exploiting things. whether it's good or not is yours to decide. but here's my experience... talented hackers, white, gray, black, whatever, excel at breaking and exploiting things. and people. and i have always struggled with that... in college i took a computer security class. my class had the team ranked #1 in Maryland (US) among young coming up group of hackers. what i saw them do is always, and i mean always, thinking of ways to break things. i mean, well, it's broken a tad bit, adding this or that will fix it. no! i saw them exploit every little tiny thing! i wanted to "fix" things. i wanted to be a "good" programmer. i was like: "oh they didn't do this, what should they have done to make more secure?". a good hacker was like "oh they didn't do this, what can i do to exploit it?" i hope my little experience convey to you how they think. or at least what i saw first hand while taking that class. for me it's hard, i wanted to fix things. they wanted to break things. i didn't fail my class. i wasn't good at it either... but i admire them and i am still amazed by what these people can pull off.
ndnxhs 8y ago
I feel like there are probably a lot of easy targets available. Look at the network requests between the client and server and see if there is anything that looks like its not validated. If you see ids try changing them and see what happens. Quite often it seems that the back end just trusts whatever the client sends. Especially if its a mobile app or a SPA because new devs seem to think the api is only visible to them. From reading some of these hacks on peoples blogs it seems like quite often they just man in the middle a mobile app and find out the api provides way more info than should be shown to the user and the ui hides it.
sigi45 8y ago
That is indeed a lot of money. Not sure why there are not more people doing it. I thought about it as well for years but still don't do it.

quickthrower2 8y ago

Beware survivorship bias, I wonder what the average hourly rate of bug hunters is?

chronode 8y ago
Trail of Bits has a nice summary[0] on that (they're discussing this[1] book). > As productive as the top 1% are, their earnings are equally depressing. The top seven participants in the Facebook data set averaged 0.87 bugs per month, earning an average yearly salary of $34,255; slightly less than what a pest control worker makes in Mississippi. --- [0] https://blog.trailofbits.com/2019/01/14/on-bounties-and-boffins/ https://blog.trailofbits.com/2019/01/14/on-bounties-and-boff... [1] https://mitpress.mit.edu/books/new-solutions-cybersecurity https://mitpress.mit.edu/books/new-solutions-cybersecurity
- whiskeykilo 8y ago
  The Trail of Bits piece kinda ignores the amount of time invested however: https://www.techrepublic.com/article/bug-bounty-programs-everything-you-thought-you-knew-is-wrong/ https://www.techrepublic.com/article/bug-bounty-programs-eve...

badfrog 8y ago

> understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities. No, but it does suggest that you're likely capable of learning security work. Just like your data structure and algorithm knowledge didn't come for free, nobody is born knowing how to find security problems. You need to work for it.

HeavenBanned 8y ago
What's a way to learn security work? Genuinely curious.
- badfrog 8y ago
  I'm not a security expert by any means, but based on learning other niche-ish areas of technology, the following probably exist for security: * Books * MOOCs * Lecture notes, slides, and assignments from university courses * Subreddits, Quora topics, etc * Prominent community members you can follow on Twitter
  - saagarjha 8y ago
    In my experience, security has much fewer of those resources. Most of the information seems to shared through word-of-mouth, conference presentations, and blog posts.
    - lucb1e 8y ago
      Much of the information is also just RTFM. I don't think it's a stretch to say that security is a lifestyle: if I read the documentation of an API, more often than not I'll wonder if something can be abused for something. Or when trying to register for health insurance, the password field required special characters, so I set my password generator to include them, after which the form broke, and so I investigated and found that I could inject scripts there. It's just stuff I come across when I'm not even trying. Word of mouth, chat groups where things are shared, conferences, blog posts... yes, those are resources. But it's also just a whole lot of curiosity and poking at systems.
      - Izmaki 8y ago
        And experience. Knowing what to look for, even if it's just the HTML source of a web page, is rather important in the first steps of breaking the system. How do you learn what to look for? Well, certainly there are blog posts and even playgrounds with virtual systems and components one can have a go at.

blondin 8y ago

no one mentioned it but the secret sauce is to have a "thing" for breaking and exploiting things. whether it's good or not is yours to decide. but here's my experience... talented hackers, white, gray, black, whatever, excel at breaking and exploiting things. and people. and i have always struggled with that... in college i took a computer security class. my class had the team ranked #1 in Maryland (US) among young coming up group of hackers. what i saw them do is always, and i mean always, thinking of ways to break things. i mean, well, it's broken a tad bit, adding this or that will fix it. no! i saw them exploit every little tiny thing! i wanted to "fix" things. i wanted to be a "good" programmer. i was like: "oh they didn't do this, what should they have done to make more secure?". a good hacker was like "oh they didn't do this, what can i do to exploit it?" i hope my little experience convey to you how they think. or at least what i saw first hand while taking that class. for me it's hard, i wanted to fix things. they wanted to break things. i didn't fail my class. i wasn't good at it either... but i admire them and i am still amazed by what these people can pull off.

ndnxhs 8y ago

I feel like there are probably a lot of easy targets available. Look at the network requests between the client and server and see if there is anything that looks like its not validated. If you see ids try changing them and see what happens. Quite often it seems that the back end just trusts whatever the client sends. Especially if its a mobile app or a SPA because new devs seem to think the api is only visible to them. From reading some of these hacks on peoples blogs it seems like quite often they just man in the middle a mobile app and find out the api provides way more info than should be shown to the user and the ui hides it.

sigi45 8y ago

That is indeed a lot of money. Not sure why there are not more people doing it. I thought about it as well for years but still don't do it.