Slashdot Mirror
Survey: Average Successful Hack Nets Less Than $15,000 (csoonline.com)
itwbennett writes: According to a Ponemon Institute survey, hackers make less than $15,000 per successful attack and net, on average, less than $29,000 a year. The average attacker conducts eight attacks per year, of which less than half are successful. Among the findings that will be of particular interest to defenders: Hackers prefer easy targets and will call off an attack if it is taking too long. According to the survey, 13 percent quit after a delay of five hours. A delay of 10 hours causes 24 percent to quit, a delay of 20 hours causes 36 to quit, and a majority of 60 percent will give up if an attack takes 40 additional hours. 'If you can delay them by two days, you can deter 60 percent of attacks,' said Scott Simkin, senior threat intelligence manager at Palo Alto Networks, which sponsored the study.
Oh wait, never mind.
They are making low wages... Boo Hoo.
Well stop hacking and get a real job.
Except for most of these hackers are outside the US where the $15,000 USD is a lot of money.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Most Americans take a few months to make that money. And in my native country, that money is more than most people make in a year. So yes, for such little work to make the hack, that is good money.
And also, if you don't want it, I'll gladly take the money.
" Hackers prefer easy targets and will call off an attack if it is taking too long. "
I'm shocked to hear that criminals using computers are exactly like criminals who have been practicing their trade since probably long before recorded history began.
AntiFA: An abbreviation for Anti First Amendment.
So the secret is to hack at night to supplement your income.
So, if they conduct 8 attacks per year, spending 70 hours per attack against a "typical" network, and earn 29,000 per year... that works out to $51 an hour, working from home. That would be rather lucrative for some countries.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
I can make "X" dollars flipping burgers, or I can make "XX" dollars committing crimes. Hard choices here.
Time is what keeps everything from happening all at once.
'If you can delay them by two days, you can deter 60 percent of attacks,' said Scott Simkin, senior threat intelligence manager at Palo Alto Networks, which sponsored the study.
So 40% of hackers are committed enough to still be working on a problem two days later.
I will hire all of them right now to replace my current Help Desk. Those kids give up within 10 minutes. I pay better than $29,000/year too.
A lot of these hackers are in Russia and other countries with $29,000 per year is a fair amount of money, plus they might also have other jobs.
So if we delay all internet traffic bij 40 hours the problem is solved ?
hackers make less than $15,000 per successful attack and net, on average, less than $29,000 a year. The average attacker conducts eight attacks per year, of which less than half are successful.
Unless the first two numbers are way off, they suggest the average hacker has (less than) two successful attacks which would be (less than) a quarter of the average eight per year.
A quick rewrite:
hackers make more than $14,000 per successful attack and net, on average, more than $28,000 a year. The average attacker conducts eight attacks per year, of which more than a quarter are successful.
There, that's a much more positive spin on things!
If I was amoral and had the skills, I'd take up hacking at those prices. A 25% chance of $14,000 for a week's work? Where do I sign up?
systemd is Roko's Basilisk.
$29K is a damn good salary in most parts of the world. That is serious money for most of us. US salaries are absurdly inflated and unsustainable.
From TFA:
The average attacker conducts eight attacks per year, of which less than half are successful. Among the findings that will be of particular interest to defenders: Hackers prefer easy targets and will call off an attack if it is taking too long. According to the survey, 13 percent quit after a delay of five hours
So, you do 8 attacks, and give up if you don't succeed in five hours. Since unsuccessful attacks are part of the 8, I assume that the ones they give up on are also part of that. That means that they work 40 hours a year, for an average salary of 29k$, or around 800$/hr. Not bad al all :)
Indeed, they are almost in the top 1% highest earners in the world. To be the 1%, one must earn about $33K. (Different sources range between $32-$34K).
http://www.investopedia.com/ar...
It's funny, it was understanding that which made me realize the "your mom's basement" meme must actually be true for the majority of Slashdot commenters. I had thought we were mostly IT professionals and the like, but if so we'd all be earning twice as much as the 1%. In which case we wouldn't see all this hostility toward college grads (the 1%) that exists on Slashdot. So I guess most Slashdotters are indeed eating cheese puffs in their mom's basement, and resent those of us who aren't.
Is that it would be beneficial to consider a security bounty program if your company does not already possess one. The reward the hackers obtain are much less than the costs for the business side. Paying out 15k or so for what would have been a successful breach is an obvious cost savings for the business.
I would not be happy.
If you can only delay them by two days 40% of hacks won't be stopped.
ssh targethost.com
[[ Intrusion detected. Please wait 48 hours for login to complete. If you wish to log in sooner, please pay $2 ]]
ls -l
[[ Intrusion detected. Please wait 48 hours for login to complete. If you wish to complete your request sooner, please pay $2 ]]
top
[[ Intrusion detected. Please wait 48 hours for login to complete. If you wish to complete your request sooner, please pay $2 ]]
chmod
[[ Intrusion detected. Please wait 48 hours for login to complete. If you wish to complete your request sooner, please pay $20000 ]]
sudo make sandwich
[[ Okay. $2.49 if you want it now. Otherwise you will have to wait 48 hours, and by that time, the tomato sauce will have gone bad. ]]
This analysis does not appear to be bell curve friendly. A few big scores would bring the average up. If this is where it ends up, there isn't a huge income from this activity.
You could just bypass the middleman and rent your ass out for XXX a week.
I'm not sure there's much of a market for renting donkeys in the industrialized world now that bikes, cars, and trucks exist, apart from some fairly small niches. And in the less-industrialized world, where pack animals are still regularly used to move goods over rugged terrain, wages are lower anyway so you might not make much money that way either.
I wonder how script kiddies and inside jobs skew the results.
In the case of script kiddies, these are people who are running a program to detect vulnerable points in various systems. They can run this script while doing something else so (as another poster pointed out), they can be working a legitimate job during the day while the script runs and then making money by hacking the vulnerable servers at night. In this case, making $15K isn't a "low wage" but a "nice side income." (Especially if they don't report it on their taxes - hey, what's a little more crime if you're willing to make money via criminal activities?)
In the case of inside jobs, I would think that the person would be a) more likely to make more money off their hack and b) need to spend less time on their hack. Since I work in IT, I have elevated permissions for many systems. If I wanted to, I could use this to gain access to data that would sell for a lot of money on some shady sites. To be clear: I would never actually do this, but someone in a position like mine but with less moral restraint could easily pull it off. They might even go undetected and remain at their day job, making their hacks a side income (like the script kiddies). Or they might move from job to job, waiting until they have high enough access to get sensitive data before moving on.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
See the story posted yesterday (or Tuesday?) about averages. You can't, generally, do math with averages of different measurements and expect to come out with a meaningful average of something else.
As people said yesterday, 99.99% of people have more than the average number of eyes. Also, the average person has one testicle.
As for stopping 60% of attacks by delaying them for 2 days - again, this doesn't sound like much of a deterrent. In fact when you couple it with the above statistic, it just shows that the serious hackers are willing to carry on for days, to make their year's income.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
No more itwbennet! We don't want paid schills for cio.com or csoonline.com. Notice every single one of his posts links to these two sites? Enough is enough!
Don't these hackers know that you can make 10x that much working from home part-time doing 'web stuff'? We see ads for them all the time on forums and in comment sections for news stories. Just like those Nigerian princes that are giving away $ millions just for giving out your bank info.
> Being in the global one percent doesn't cut it when you're in a country where not many fall within the global poor 99%.
Yeah beng rich isn't enough when you're neighbors are rich too - anything other than being the richest of the rich just won't cut it. You can see that too in Orange County - when all the neighbors have BMWs, the brats whine that they don't have a Maserati. In Texas, we call that "spoiled" .
In California and New York you'll find a lot of people who are really, really blind because although they are rich live in a country where most people are rich (richer than 95% globally) they are unhappy SO THEY DEMAND THAT THE RICH COUNTRY STOP DOING RICH THINGS AND BECOME MORE LIKE THE BROKE SOCIALIST COUNTRIES WHERE THE PEOPLE ARE POORER. In Texas, we call that "dumb as a box of rocks".
If your whole country is rich, maybe it would make sense to find out why, and do MORE of the stuff that made you rich. If America makes people rich (and as you said, it does), then maybe be MORE of the American way, not less.
Hint- we got rich mainly in the 1950s - 1960s, then leveled off. We did well in the 1800s too, minus the civil war.
Morning Guys,
ITWBennet is the sort of poster that I, and I believe a lot of crusty slashdot users, are not a fan of. He has no post history and doesn't participate on the site and appears to solely push articles from CSO Online. I know that you need to be putting content on to slashdot but I would rather things others on the site picked as interesting than to read press releases.
They're only likely to stop if the time taken is their actual time, they will routinely leave scripts running slow attempts for months if nothing is done to stop them...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Like average global temperature or average phone number. What matters is the 1% of hackers that make billions of bucks by robbing millions of people.