4 ms·
Many former criminals do lead successful careers, so it's quite possible. However it should be noted that circumventing the Google Play store malware detections
by dsacco 11y ago
Many former criminals do lead successful careers, so it's quite possible. However it should be noted that circumventing the Google Play store malware detections is not particularly hard - it's definitely a start, and maybe even a conference talk, but for real notoriety in the security industry you'd want to be consistently discovering novel vulnerabilities in Android, not just figuring out how to sneak malware onto the operating system.
Now, all that said, if you are a competent reverse engineer and can reliably circumvent DRM/license protection, develop binary exploits for high-severity vulnerabilities or perform advanced malware analysis, you can easily earn north of half a million dollars a year in this industry. It is an extremely lucrative time to be working in security.
You don't need to start out as a criminal though. If you want to do things like this then work through CTFs like Microcorruption and OverTheWire and learn how to develop privilege escalation and sandbox escape exploits on very widely used software and operating systems.
- bitdivision 11y agoHuh, I didn't realise salaries were that high in malware / RE. What kind of positions do you mean? Presumably consulting?
- Moral_ 11y agohe means bug bounties
- ohitsdom 11y agoI'd be surprised if OP meant bug bounties. Most rewards seem to be in the $2,000 - 10,000 range. They take time to discover so you'd have to be pretty productive (and perhaps lucky) to regularly find enough bugs to earn a salary in that range.
- Lawtonfogle 11y agoFrom what I've seen of these, bug bounties are quite low. I, like GP, would assume consulting. Either for companies acting defensively or with nation states acting offensively.
- FreakLegion 11y agoCould be, but it's also applicable to general compensation for the skill set 'dsacco describes.
- dsacco 11y agoI definitely do not mean bug bounties. While it is possible to make a full salary pursuing bug bounties, they are a poor investment of time. For example, if I am paid to do an exhaustive penetration test and source code review for a company I'll be paid $10,000/week. I might not find a single vulnerability (doesn't happen often), but I still did the work. If I pursue a bug bounty for the same company I might find nothing at all, which means I earn nothing. I also most likely won't earn $10,000 in bug bounties in a week. Aside from this, there is a bit of classism in the security industry. Bug bounty hunters are predominantly people from developing countries who do not know how to find even the most simple CSRF flaw, which is really quite sad. They do not have access to the same education and they are mostly hopefuls who want to "break in" to the security industry. The "crowdsourced security" model touted by HackerOne and BugCrowd doesn't really work, where "work" means you can replace a real penetration test from a real security engineer with it. It works if you have people like Frans Rosen, fin1te or bitquark (famous bug bounty participants) pursue bug bounties on your software, but it doesn't work for the other 9/10 people who will fill your inbox with pointless, invalid reports. For this reason, bug bounty participants are not very well respected unless they have a reputation for good work because of how much noise the average bug bounty generates instead of valid reports. On the other hand, you'll find most successful security engineers don't spend much time pursuing them.
- liviu- 11y ago>It is an extremely lucrative time to be working in security. Is it though? The average salary of a security engineer seems to be lower than that of a software engineer, and there seem to be considerably fewer positions available. Those very high paid positions seem few and far between.
- sliverstorm 11y agoI wonder if the high power security positions just aren't publicly listed. That seems like the sort of job you fill exclusively by recommendation or pursuit of candidates, rather than a job listing on LinkedIn.
- dsacco 11y agoBingo. I'm not talking about "cybersecurity" positions. I'm talking about people doing advanced work in exploitation, reverse engineering and cryptography on a consulting basis or those who work in boutique shops. I pass the $300k mark annually through AppSec consulting, and this is not at maximum utilization, nor is it a particularly "hard" discipline in security.
- devonkim 11y agoThese are probably at least half the software engineer positions that pay more than $150k+ in the DC area. Most of the software jobs among start-ups and even commercial software development pretty much capped out a fair bit below that. I know I was dropped from several interviews just asking for a base of only $130k and not being very good exactly. There's a demand for people that are actually serious security professionals in the engineering sense just as much as there is a massive demand for the bureaucratic "security" folks (that focus upon certificates and such to get their feet in the door of some random defense contractor).
- rufugee 11y agoWill these sorts of challenges also give you the necessary cryptography background? If not, what will?