Bug hunting: the rise of the ethical hacker in search of big bounties

“I would say [ethical hacking] has exploded in the past three or four years and we are up to seven or eight millionaires,” says Mattsson. “Before if you were an ethical hacker and you try to report something to a company you never really knew whether they would respond. In some cases, they would have threatened lawsuits and the whole shebang, so that doesn’t actually encourage someone who wants to do something good. That is where the bug bounty platforms come in and will help the researcher and the companies to do it in an organised way.” He adds: “By having a bug bounty programme, we get access to some of the most talented security researchers in the world who can help identify security vulnerabilities in our assets.”

Eyes on the prize

While the idea of finding security flaws in tech giants’ websites and apps and being rewarded handsomely for your skills sounds like a dream job for many cybersecurity enthusiasts and wannabe hackers, the reality is most won’t earn serious cash. For many it will be a steep learning curve slogging away at the lower funds of the bounty ladder, although there is still money to be made from programmes that pay a couple of hundred dollars per valid report. Little and often can be more profitable than the occasional big score. Indeed, SBG’s Pegden says every day companies are creating a “conveyor belt” of relatively easy-to-find vulnerabilities. “Those not capable of going after the big bucks can still make some decent money.” That said, Pegden does habour concerns about the future of the scene. “I do worry about the long-term viability of the industry,” he states. “We’re already seeing a stratification on the labour force where a very small percentage of hackers are responsible for claiming a very significant percentage of all the pay-outs, and it’s a sad fact that the quality of the reports soon tail off as you start to descend the ranks of hunters. Unless you’re looking to make use of the huge and growing pool of entry-level hackers who all compete for the same low-hanging fruit, then you really have to start working on attracting high quality hackers, who will often realise that there is easier money to be made on less well-secure programmes.” Others, perhaps unsurprisingly, are more bullish about the industry’s outlook. HackerOne CEO Marten Mickos penned a blog post recently in which he suggested ethical hackers will have earned a combined $1bn in bug bounties within the next five years. He also estimated there to be “100 million security vulnerabilities still out in the wild”, which, if even half true, still translates into an abundance of opportunities for security researchers, ethical hackers and bounty hunters. And with governments and federal agencies increasingly turning to bug bounty programmes in this era of cyberwarfare and cyberespionage, this is a part of the space with great growth potential. “I think more governments are seeing the value of having ethical hackers,” says Mattsson. Even HackerOne isn’t immune to the threats out there. Last December, the platform suffered the ignominy of being hacked itself by one of its community members. Yet, as you might expect, HackerOne opened its wallet and rewarded the user with the handle haxta4ok00 for exposing the flaw; a cool $20,000.