5 ms·

One of the arrested ones is 20, and he allegedly created Dendroid — a malware that can take remote control of an Android device. He designed, developed and depl

by liviu- 11y ago

One of the arrested ones is 20, and he allegedly created Dendroid — a malware that can take remote control of an Android device. He designed, developed and deployed this software (bypassing Google Play's malware detection system) which seems to be quite complex and capable [0]. This proves that he possess a certain set of marketable skills that are quite south after in the industry. So I'm wondering - is this really bad news for them, or will it just bring them enough spotlight to be contacted for some security roles that pay better than what they were earning prior to the arrest? [0] https://blog.lookout.com/blog/2014/03/06/dendroid/ https://blog.lookout.com/blog/2014/03/06/dendroid/

contingencies 11y ago
I guess if people have that level of knowledge, the market dangles money, and they are still willing to take risks to do something different, it could be seen as evidence about how damn boring writing normal code for phones is!
Cyph0n 11y ago
Great article. It's quite amazing what malware devs pull off with each new toolkit. The first comment on the post is however... not so great.
dsacco 11y ago
Many former criminals do lead successful careers, so it's quite possible. However it should be noted that circumventing the Google Play store malware detections is not particularly hard - it's definitely a start, and maybe even a conference talk, but for real notoriety in the security industry you'd want to be consistently discovering novel vulnerabilities in Android, not just figuring out how to sneak malware onto the operating system. Now, all that said, if you are a competent reverse engineer and can reliably circumvent DRM/license protection, develop binary exploits for high-severity vulnerabilities or perform advanced malware analysis, you can easily earn north of half a million dollars a year in this industry. It is an extremely lucrative time to be working in security. You don't need to start out as a criminal though. If you want to do things like this then work through CTFs like Microcorruption and OverTheWire and learn how to develop privilege escalation and sandbox escape exploits on very widely used software and operating systems.
- bitdivision 11y ago
  Huh, I didn't realise salaries were that high in malware / RE. What kind of positions do you mean? Presumably consulting?
  - Moral_ 11y ago
    he means bug bounties
    - ohitsdom 11y ago
      I'd be surprised if OP meant bug bounties. Most rewards seem to be in the $2,000 - 10,000 range. They take time to discover so you'd have to be pretty productive (and perhaps lucky) to regularly find enough bugs to earn a salary in that range.
    - Lawtonfogle 11y ago
      From what I've seen of these, bug bounties are quite low. I, like GP, would assume consulting. Either for companies acting defensively or with nation states acting offensively.
    - FreakLegion 11y ago
      Could be, but it's also applicable to general compensation for the skill set 'dsacco describes.
    - dsacco 11y ago
      I definitely do not mean bug bounties. While it is possible to make a full salary pursuing bug bounties, they are a poor investment of time. For example, if I am paid to do an exhaustive penetration test and source code review for a company I'll be paid $10,000/week. I might not find a single vulnerability (doesn't happen often), but I still did the work. If I pursue a bug bounty for the same company I might find nothing at all, which means I earn nothing. I also most likely won't earn $10,000 in bug bounties in a week. Aside from this, there is a bit of classism in the security industry. Bug bounty hunters are predominantly people from developing countries who do not know how to find even the most simple CSRF flaw, which is really quite sad. They do not have access to the same education and they are mostly hopefuls who want to "break in" to the security industry. The "crowdsourced security" model touted by HackerOne and BugCrowd doesn't really work, where "work" means you can replace a real penetration test from a real security engineer with it. It works if you have people like Frans Rosen, fin1te or bitquark (famous bug bounty participants) pursue bug bounties on your software, but it doesn't work for the other 9/10 people who will fill your inbox with pointless, invalid reports. For this reason, bug bounty participants are not very well respected unless they have a reputation for good work because of how much noise the average bug bounty generates instead of valid reports. On the other hand, you'll find most successful security engineers don't spend much time pursuing them.
deleted 11y ago
[deleted]

by liviu- 11y ago

contingencies 11y ago

I guess if people have that level of knowledge, the market dangles money, and they are still willing to take risks to do something different, it could be seen as evidence about how damn boring writing normal code for phones is!

Cyph0n 11y ago

Great article. It's quite amazing what malware devs pull off with each new toolkit. The first comment on the post is however... not so great.

dsacco 11y ago

Many former criminals do lead successful careers, so it's quite possible. However it should be noted that circumventing the Google Play store malware detections is not particularly hard - it's definitely a start, and maybe even a conference talk, but for real notoriety in the security industry you'd want to be consistently discovering novel vulnerabilities in Android, not just figuring out how to sneak malware onto the operating system. Now, all that said, if you are a competent reverse engineer and can reliably circumvent DRM/license protection, develop binary exploits for high-severity vulnerabilities or perform advanced malware analysis, you can easily earn north of half a million dollars a year in this industry. It is an extremely lucrative time to be working in security. You don't need to start out as a criminal though. If you want to do things like this then work through CTFs like Microcorruption and OverTheWire and learn how to develop privilege escalation and sandbox escape exploits on very widely used software and operating systems.

bitdivision 11y ago
Huh, I didn't realise salaries were that high in malware / RE. What kind of positions do you mean? Presumably consulting?
- Moral_ 11y ago
  he means bug bounties
  - ohitsdom 11y ago
    I'd be surprised if OP meant bug bounties. Most rewards seem to be in the $2,000 - 10,000 range. They take time to discover so you'd have to be pretty productive (and perhaps lucky) to regularly find enough bugs to earn a salary in that range.
  - Lawtonfogle 11y ago
    From what I've seen of these, bug bounties are quite low. I, like GP, would assume consulting. Either for companies acting defensively or with nation states acting offensively.
  - FreakLegion 11y ago
    Could be, but it's also applicable to general compensation for the skill set 'dsacco describes.
  - dsacco 11y ago
    I definitely do not mean bug bounties. While it is possible to make a full salary pursuing bug bounties, they are a poor investment of time. For example, if I am paid to do an exhaustive penetration test and source code review for a company I'll be paid $10,000/week. I might not find a single vulnerability (doesn't happen often), but I still did the work. If I pursue a bug bounty for the same company I might find nothing at all, which means I earn nothing. I also most likely won't earn $10,000 in bug bounties in a week. Aside from this, there is a bit of classism in the security industry. Bug bounty hunters are predominantly people from developing countries who do not know how to find even the most simple CSRF flaw, which is really quite sad. They do not have access to the same education and they are mostly hopefuls who want to "break in" to the security industry. The "crowdsourced security" model touted by HackerOne and BugCrowd doesn't really work, where "work" means you can replace a real penetration test from a real security engineer with it. It works if you have people like Frans Rosen, fin1te or bitquark (famous bug bounty participants) pursue bug bounties on your software, but it doesn't work for the other 9/10 people who will fill your inbox with pointless, invalid reports. For this reason, bug bounty participants are not very well respected unless they have a reputation for good work because of how much noise the average bug bounty generates instead of valid reports. On the other hand, you'll find most successful security engineers don't spend much time pursuing them.

deleted 11y ago

[deleted]