Slashdot Mirror
Survey: Average Successful Hack Nets Less Than $15,000 (csoonline.com)
itwbennett writes: According to a Ponemon Institute survey, hackers make less than $15,000 per successful attack and net, on average, less than $29,000 a year. The average attacker conducts eight attacks per year, of which less than half are successful. Among the findings that will be of particular interest to defenders: Hackers prefer easy targets and will call off an attack if it is taking too long. According to the survey, 13 percent quit after a delay of five hours. A delay of 10 hours causes 24 percent to quit, a delay of 20 hours causes 36 to quit, and a majority of 60 percent will give up if an attack takes 40 additional hours. 'If you can delay them by two days, you can deter 60 percent of attacks,' said Scott Simkin, senior threat intelligence manager at Palo Alto Networks, which sponsored the study.
Oh wait, never mind.
They are making low wages... Boo Hoo.
Well stop hacking and get a real job.
Except for most of these hackers are outside the US where the $15,000 USD is a lot of money.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
" Hackers prefer easy targets and will call off an attack if it is taking too long. "
I'm shocked to hear that criminals using computers are exactly like criminals who have been practicing their trade since probably long before recorded history began.
AntiFA: An abbreviation for Anti First Amendment.
So, if they conduct 8 attacks per year, spending 70 hours per attack against a "typical" network, and earn 29,000 per year... that works out to $51 an hour, working from home. That would be rather lucrative for some countries.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
I can make "X" dollars flipping burgers, or I can make "XX" dollars committing crimes. Hard choices here.
Time is what keeps everything from happening all at once.
'If you can delay them by two days, you can deter 60 percent of attacks,' said Scott Simkin, senior threat intelligence manager at Palo Alto Networks, which sponsored the study.
So 40% of hackers are committed enough to still be working on a problem two days later.
I will hire all of them right now to replace my current Help Desk. Those kids give up within 10 minutes. I pay better than $29,000/year too.
A lot of these hackers are in Russia and other countries with $29,000 per year is a fair amount of money, plus they might also have other jobs.
hackers make less than $15,000 per successful attack and net, on average, less than $29,000 a year. The average attacker conducts eight attacks per year, of which less than half are successful.
Unless the first two numbers are way off, they suggest the average hacker has (less than) two successful attacks which would be (less than) a quarter of the average eight per year.
A quick rewrite:
hackers make more than $14,000 per successful attack and net, on average, more than $28,000 a year. The average attacker conducts eight attacks per year, of which more than a quarter are successful.
There, that's a much more positive spin on things!
If I was amoral and had the skills, I'd take up hacking at those prices. A 25% chance of $14,000 for a week's work? Where do I sign up?
systemd is Roko's Basilisk.
From TFA:
The average attacker conducts eight attacks per year, of which less than half are successful. Among the findings that will be of particular interest to defenders: Hackers prefer easy targets and will call off an attack if it is taking too long. According to the survey, 13 percent quit after a delay of five hours
So, you do 8 attacks, and give up if you don't succeed in five hours. Since unsuccessful attacks are part of the 8, I assume that the ones they give up on are also part of that. That means that they work 40 hours a year, for an average salary of 29k$, or around 800$/hr. Not bad al all :)
Indeed, they are almost in the top 1% highest earners in the world. To be the 1%, one must earn about $33K. (Different sources range between $32-$34K).
http://www.investopedia.com/ar...
It's funny, it was understanding that which made me realize the "your mom's basement" meme must actually be true for the majority of Slashdot commenters. I had thought we were mostly IT professionals and the like, but if so we'd all be earning twice as much as the 1%. In which case we wouldn't see all this hostility toward college grads (the 1%) that exists on Slashdot. So I guess most Slashdotters are indeed eating cheese puffs in their mom's basement, and resent those of us who aren't.
I would not be happy.
If you can only delay them by two days 40% of hacks won't be stopped.
Funny, my company seems to have no problems with rapid growth while paying US salaries (profits are plowed back into the business, for the most part). So far, it seems not only sustainable but highly successful.
In the US, anybody with more talent than a script kiddie can find a job making more than that. Unless they've got a criminal record, I guess, which is a good reason not to violate the CFAA for peanuts.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
This analysis does not appear to be bell curve friendly. A few big scores would bring the average up. If this is where it ends up, there isn't a huge income from this activity.
No, the secret is to only hack computers in another country, because the chances of your getting extradited for computer hacking are practically nil.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
You could just bypass the middleman and rent your ass out for XXX a week.
I'm not sure there's much of a market for renting donkeys in the industrialized world now that bikes, cars, and trucks exist, apart from some fairly small niches. And in the less-industrialized world, where pack animals are still regularly used to move goods over rugged terrain, wages are lower anyway so you might not make much money that way either.
I think that the article's point, from an American perspective, is that one probably isn't going to get rich hacking, in the same way that one isn't going to get rich robbing banks. Like robbing banks, the more one hacks, the greater the chances one is caught, so trying to get rich is the fastest way to get caught.
It's also kind of interesting to note that both crimes are investigated by the FBI, rather than solely by local authorities. The FBI has a better track record of not forgetting cold cases too, so depending on the statute of limitations one may never be in-the-clear.
Do not look into laser with remaining eye.
I wonder how script kiddies and inside jobs skew the results.
In the case of script kiddies, these are people who are running a program to detect vulnerable points in various systems. They can run this script while doing something else so (as another poster pointed out), they can be working a legitimate job during the day while the script runs and then making money by hacking the vulnerable servers at night. In this case, making $15K isn't a "low wage" but a "nice side income." (Especially if they don't report it on their taxes - hey, what's a little more crime if you're willing to make money via criminal activities?)
In the case of inside jobs, I would think that the person would be a) more likely to make more money off their hack and b) need to spend less time on their hack. Since I work in IT, I have elevated permissions for many systems. If I wanted to, I could use this to gain access to data that would sell for a lot of money on some shady sites. To be clear: I would never actually do this, but someone in a position like mine but with less moral restraint could easily pull it off. They might even go undetected and remain at their day job, making their hacks a side income (like the script kiddies). Or they might move from job to job, waiting until they have high enough access to get sensitive data before moving on.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
See the story posted yesterday (or Tuesday?) about averages. You can't, generally, do math with averages of different measurements and expect to come out with a meaningful average of something else.
As people said yesterday, 99.99% of people have more than the average number of eyes. Also, the average person has one testicle.
As for stopping 60% of attacks by delaying them for 2 days - again, this doesn't sound like much of a deterrent. In fact when you couple it with the above statistic, it just shows that the serious hackers are willing to carry on for days, to make their year's income.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
No more itwbennet! We don't want paid schills for cio.com or csoonline.com. Notice every single one of his posts links to these two sites? Enough is enough!
> Being in the global one percent doesn't cut it when you're in a country where not many fall within the global poor 99%.
Yeah beng rich isn't enough when you're neighbors are rich too - anything other than being the richest of the rich just won't cut it. You can see that too in Orange County - when all the neighbors have BMWs, the brats whine that they don't have a Maserati. In Texas, we call that "spoiled" .
In California and New York you'll find a lot of people who are really, really blind because although they are rich live in a country where most people are rich (richer than 95% globally) they are unhappy SO THEY DEMAND THAT THE RICH COUNTRY STOP DOING RICH THINGS AND BECOME MORE LIKE THE BROKE SOCIALIST COUNTRIES WHERE THE PEOPLE ARE POORER. In Texas, we call that "dumb as a box of rocks".
If your whole country is rich, maybe it would make sense to find out why, and do MORE of the stuff that made you rich. If America makes people rich (and as you said, it does), then maybe be MORE of the American way, not less.
Hint- we got rich mainly in the 1950s - 1960s, then leveled off. We did well in the 1800s too, minus the civil war.
Morning Guys,
ITWBennet is the sort of poster that I, and I believe a lot of crusty slashdot users, are not a fan of. He has no post history and doesn't participate on the site and appears to solely push articles from CSO Online. I know that you need to be putting content on to slashdot but I would rather things others on the site picked as interesting than to read press releases.
You know, I've heard lots of people saying that the US is going to fall, and providing no good reasons. If you want me to take you more seriously than a bunch of failures, you're going to have to give me reasons.
US wages are, apparently, generally lower than the workers' value to their employers, allowing employers to pay them, pay other expenses, and still typically have a profit. If a company concludes that parts of the labor force are paid more than their worth, it usually results in a layoff. In what way are wages that fit into that structure insane?
BTW, the second car allows both my wife and me to work in our jobs, which are widely separated in the metro area. Without it, our combined contribution to the economy would be much lower.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
They're only likely to stop if the time taken is their actual time, they will routinely leave scripts running slow attempts for months if nothing is done to stop them...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Wages have to be higher because the cost of living is higher, and the cost of living is higher because companies charge more for goods and services, part of the reason why they charge more is because they have to pay their workers more.
The problem is that companies are greedy and short sighted, so they will outsource to cheaper countries to reduce their costs... This will cut costs in the short term, but long term there will no longer be anyone able to afford your products.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!