5 ms·

This is a tangent but it's been fascinating watching the infosec community grow on twitter. It makes me feel super out of the loop with a huge part of my field

by mjayhn 6y ago

This is a tangent but it's been fascinating watching the infosec community grow on twitter. It makes me feel super out of the loop with a huge part of my field (i'm more dev/architecture but of course security is important). I kind of dove into it a tiny, tiny bit the last week. I figure with all this time at home for quarantine I might as well start playing in CTFs, etc and hone some skill I'm so used to only using in a reactionary manner. I'm honestly envious of their community and all of the tools they've created and tutorials and everything for newcomers. They've done a great job getting anyone who is remotely curious the ability to dabble. When I was coming up as a sysadmin "rtfm." Anyway, are people making lucrative careers out of bug bounties? What do these "infosec CEO" twitter people do day to day? Their goal is to hit bounties and sell pentesting/exploits I assume?

arkadiyt 6y ago
> Anyway, are people making lucrative careers out of bug bounties? There's a strong power law distribution - the top folks make a lot of money (say, > $500k/yr) and then it quickly drops off from there.
- lawnchair_larry 6y ago
  You know people making 500k/yr on HackerOne? That seems way higher than what I would estimate from anecdotes. Unless you’re talking about private exploit sales, which is totally different.
  - LilBytes 6y ago
    It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable bounties, easily make 5 figures USD from us in 12 months. And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is. We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)
  - lawnchair_larry 6y ago
    Found some data about this: https://www.hackerone.com/press-release/six-hackers-break-bug-bounty-record-earning-over-1-million-each-hackerone https://www.hackerone.com/press-release/six-hackers-break-bu... As of that date, 6 people made over $1M total since it launched (not per year). So maybe 1 or 2 have hit 500k in a year? Some of those names have been doing it for over 6 years. According to a previous report, only 0.3% have made over $5k in their lifetime on the platform. https://duo.com/decipher/taking-hype-out-of-bug-bounty-programs https://duo.com/decipher/taking-hype-out-of-bug-bounty-progr...
    - rfkrishnan 6y ago
      There are numerous Synack Red Team member millionaires too. The first in hacker history was an SRT member in mid-2018, but didn't want publicity. - Rajesh Krishnan, Synack
marinhero 6y ago
I've seen and experienced that too! I follow a bunch of members of the community and seeing all the support they have for newcomers and people of color makes the field even more attractive to me. Kudos to them!
lowdest 6y ago
>They've done a great job getting anyone who is remotely curious the ability to dabble. Any suggestions where to start? I'm several years out of the scene and would love to be reacquainted.
- deleted 6y ago
  [deleted]
- mjayhn 6y ago
  I've only done a few hours of research so far and done little hacktivities (https://tryhackme.com/hacktivities https://tryhackme.com/hacktivities). Then there's hackthebox https://www.hackthebox.eu/ https://www.hackthebox.eu/ I haven't used this yet. Mostly I just grab stuff off of twitter/reddit, I don't really know who to recommend right now, I kind of just followed a ton of relatively random open source infosec people organically, but none really scream "has guide for diving in or is a great intro person" off the top of my head.. (maybe @troyhunt), https://www.reddit.com/r/netsecstudents/ https://www.reddit.com/r/netsecstudents/ Hopefully someone else can chime in because I'd like to know more as well.
  - hnick 6y ago
    I've not seriously started but am considering it. I've only done a few toy problems myself. On the YouTube side for people who are a bit more casual like me, John Hammond and Live Overflow both seem pretty good for beginners. John has a bunch popping up on my feed where he runs through a CTF or hacking room and steps through his process, like this SQLite timing attack (https://www.youtube.com/watch?v=DYLDG_2Vs3E https://www.youtube.com/watch?v=DYLDG_2Vs3E) which I found interesting since I knew the concept but hadn't seen it in action before. Live Overflow also explains things pretty clearly and has covered a variety of topics like using Ghidra, hacking an intentionally hackable MMO, or recreating patched XSS flaws. I think it's really good to pick a niche first and stick to it, reverse engineering code looks fun but I'm not sure how commercial that skill is compared to busting open web apps. If you want something to poke and prod at there's also Damn Vulnerable Web Application (DVWA) at http://www.dvwa.co.uk/ http://www.dvwa.co.uk/
  - 6y ago
Kalium 6y ago
> Anyway, are people making lucrative careers out of bug bounties? I'm pretty sure a reasonable number are doing quite well for themselves after currency conversions. It would be quite challenging to replace a typical Bay Area security architecture salary with bug bounties, though. Few people are equipped to find and claim $10k+ bounties twice a month, every month.
chc4 6y ago
$100M is 1000 people getting paid $100k. $100k isn't a particularly good programmer salary, and is a very high bug bounty salary. From what I've heard, HackerOne/BugCrowd high earners basically just end up spamming as many companies as they can with web vulnerabilities like clickjacking that are low impact but everyone has, and live in very low cost-of-living areas like South America. It's a lot of repetitive hustle and not secure. Infosec twitter people aren't the ones doing bug bounties. A lot of them are blue team cybersecurity, doing network engineering and IT, or do penetration testing for networks which is a different wheelhouse. Some of them might be reporting exploits to Zerodium/ZDI/other exploit brokers, but they keep a low profile and it is very different from "bug bounties".
- Dayshine 6y ago
  > $100k isn't a particularly good programmer salary It's 95th percentile for a lead developer in the UK... and probably everywhere outside some areas in the US.
  - Kalium 6y ago
    It's been my experience that a good chunk of the researchers on HackerOne are exactly what this point would lead you predict. I recall working with some in Morocco, Pakistan, and Romania. This was admittedly a few years ago. No idea if that's still accurate.
LeonM 6y ago
> Anyway, are people making lucrative careers out of bug bounties? Not really, no. Sure, the top 20 hackers on H1 do make a very decent living (you can listen to the story of Dawgy-G on Darknet Diaries ep60 about that). But realistically, if you are that good at it you can get paid much more doing a 'real' infosec job. Bug bounty hunting platforms like H1 do give you the freedom to work whenever you want, wherever you want on your own terms. Basically gig economy. Personally I do bounty hunting every now and then because I enjoy the learning experience from it. But looking at the time it takes me to discover a bug and writing a detailed report only to receive a couple hundred USD for it, it really isn't worth my time in a professional sense. I'd say I make about 25USD/hour from it. Of course this is highly dependent on your skills. And it is also highly dependent on where you live whether 25 USD/hour is actually enough to make a living. Sometimes you can get lucky and stumble upon a valuable bug and make a couple of grand for only an hour worth of work, but most of research you'll do will yield you knowledge, not money.
- albntomat0 6y ago
  I've gone with a similar approach, kinda treating it like a CTF. I work on unique targets, with the goal of learning something along the way, which has worked well thus far.

by mjayhn 6y ago

arkadiyt 6y ago

> Anyway, are people making lucrative careers out of bug bounties? There's a strong power law distribution - the top folks make a lot of money (say, > $500k/yr) and then it quickly drops off from there.

lawnchair_larry 6y ago
You know people making 500k/yr on HackerOne? That seems way higher than what I would estimate from anecdotes. Unless you’re talking about private exploit sales, which is totally different.
- LilBytes 6y ago
  It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable bounties, easily make 5 figures USD from us in 12 months. And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is. We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)
- lawnchair_larry 6y ago
  Found some data about this: https://www.hackerone.com/press-release/six-hackers-break-bug-bounty-record-earning-over-1-million-each-hackerone https://www.hackerone.com/press-release/six-hackers-break-bu... As of that date, 6 people made over $1M total since it launched (not per year). So maybe 1 or 2 have hit 500k in a year? Some of those names have been doing it for over 6 years. According to a previous report, only 0.3% have made over $5k in their lifetime on the platform. https://duo.com/decipher/taking-hype-out-of-bug-bounty-programs https://duo.com/decipher/taking-hype-out-of-bug-bounty-progr...
  - rfkrishnan 6y ago
    There are numerous Synack Red Team member millionaires too. The first in hacker history was an SRT member in mid-2018, but didn't want publicity. - Rajesh Krishnan, Synack

marinhero 6y ago

I've seen and experienced that too! I follow a bunch of members of the community and seeing all the support they have for newcomers and people of color makes the field even more attractive to me. Kudos to them!

lowdest 6y ago

>They've done a great job getting anyone who is remotely curious the ability to dabble. Any suggestions where to start? I'm several years out of the scene and would love to be reacquainted.

deleted 6y ago
[deleted]
mjayhn 6y ago
I've only done a few hours of research so far and done little hacktivities (https://tryhackme.com/hacktivities https://tryhackme.com/hacktivities). Then there's hackthebox https://www.hackthebox.eu/ https://www.hackthebox.eu/ I haven't used this yet. Mostly I just grab stuff off of twitter/reddit, I don't really know who to recommend right now, I kind of just followed a ton of relatively random open source infosec people organically, but none really scream "has guide for diving in or is a great intro person" off the top of my head.. (maybe @troyhunt), https://www.reddit.com/r/netsecstudents/ https://www.reddit.com/r/netsecstudents/ Hopefully someone else can chime in because I'd like to know more as well.
- hnick 6y ago
  I've not seriously started but am considering it. I've only done a few toy problems myself. On the YouTube side for people who are a bit more casual like me, John Hammond and Live Overflow both seem pretty good for beginners. John has a bunch popping up on my feed where he runs through a CTF or hacking room and steps through his process, like this SQLite timing attack (https://www.youtube.com/watch?v=DYLDG_2Vs3E https://www.youtube.com/watch?v=DYLDG_2Vs3E) which I found interesting since I knew the concept but hadn't seen it in action before. Live Overflow also explains things pretty clearly and has covered a variety of topics like using Ghidra, hacking an intentionally hackable MMO, or recreating patched XSS flaws. I think it's really good to pick a niche first and stick to it, reverse engineering code looks fun but I'm not sure how commercial that skill is compared to busting open web apps. If you want something to poke and prod at there's also Damn Vulnerable Web Application (DVWA) at http://www.dvwa.co.uk/ http://www.dvwa.co.uk/
- 6y ago

Kalium 6y ago

> Anyway, are people making lucrative careers out of bug bounties? I'm pretty sure a reasonable number are doing quite well for themselves after currency conversions. It would be quite challenging to replace a typical Bay Area security architecture salary with bug bounties, though. Few people are equipped to find and claim $10k+ bounties twice a month, every month.

chc4 6y ago

$100M is 1000 people getting paid $100k. $100k isn't a particularly good programmer salary, and is a very high bug bounty salary. From what I've heard, HackerOne/BugCrowd high earners basically just end up spamming as many companies as they can with web vulnerabilities like clickjacking that are low impact but everyone has, and live in very low cost-of-living areas like South America. It's a lot of repetitive hustle and not secure. Infosec twitter people aren't the ones doing bug bounties. A lot of them are blue team cybersecurity, doing network engineering and IT, or do penetration testing for networks which is a different wheelhouse. Some of them might be reporting exploits to Zerodium/ZDI/other exploit brokers, but they keep a low profile and it is very different from "bug bounties".

Dayshine 6y ago
> $100k isn't a particularly good programmer salary It's 95th percentile for a lead developer in the UK... and probably everywhere outside some areas in the US.
- Kalium 6y ago
  It's been my experience that a good chunk of the researchers on HackerOne are exactly what this point would lead you predict. I recall working with some in Morocco, Pakistan, and Romania. This was admittedly a few years ago. No idea if that's still accurate.

LeonM 6y ago

> Anyway, are people making lucrative careers out of bug bounties? Not really, no. Sure, the top 20 hackers on H1 do make a very decent living (you can listen to the story of Dawgy-G on Darknet Diaries ep60 about that). But realistically, if you are that good at it you can get paid much more doing a 'real' infosec job. Bug bounty hunting platforms like H1 do give you the freedom to work whenever you want, wherever you want on your own terms. Basically gig economy. Personally I do bounty hunting every now and then because I enjoy the learning experience from it. But looking at the time it takes me to discover a bug and writing a detailed report only to receive a couple hundred USD for it, it really isn't worth my time in a professional sense. I'd say I make about 25USD/hour from it. Of course this is highly dependent on your skills. And it is also highly dependent on where you live whether 25 USD/hour is actually enough to make a living. Sometimes you can get lucky and stumble upon a valuable bug and make a couple of grand for only an hour worth of work, but most of research you'll do will yield you knowledge, not money.

albntomat0 6y ago
I've gone with a similar approach, kinda treating it like a CTF. I work on unique targets, with the goal of learning something along the way, which has worked well thus far.