Slashdot Mirror
Companies Are Paying Millions For White Hat Hacking (nypost.com)
White hat hackers "are in very high demand," says PwC's director of cyber investigation and breach response, in a New York Post article titled "Companies are paying millions to get hacked -- on purpose." An anonymous reader quotes their report:
HackerOne, a San Francisco-based "vulnerability coordination and bug bounty platform," reports that it has some 800 corporate customers who paid out more than $15 million in bonuses to white-hat hackers since its founding in 2012. Most of that bounty was paid in the past two years, as companies have become more aware of their cyber vulnerabilities. Clients that have used the platform include General Motors, Uber, Twitter, Starbucks and even the US Department of Defense.
Google paid $3 million last year through its own bounty program, according to HackerOne's CEO Marten Micko, who touts his company's "turn-key" solution -- a platform which now offers the services of 100,000 ethical (and vetted) hackers. "With a diverse group, all types of vulnerabilities can be found," Micko told TechRepublic. "This is a corollary to the 'given enough eyeballs' wisdom... they find them faster than other solutions, the hunting is ongoing and not happening at just one time, and the cost is a tenth of what it would be with other methods." And one of the platform's white hat hackers has already earned over $600,000 in just two years.
Google paid $3 million last year through its own bounty program, according to HackerOne's CEO Marten Micko, who touts his company's "turn-key" solution -- a platform which now offers the services of 100,000 ethical (and vetted) hackers. "With a diverse group, all types of vulnerabilities can be found," Micko told TechRepublic. "This is a corollary to the 'given enough eyeballs' wisdom... they find them faster than other solutions, the hunting is ongoing and not happening at just one time, and the cost is a tenth of what it would be with other methods." And one of the platform's white hat hackers has already earned over $600,000 in just two years.
10k to fix a bug that could destroy everything. The black market is still better.
A $3M expense from Google is not a considerable sum. They are cheaping out by only expending that little when you consider all data they store and are pseudo-responsible for.
So the world's best (or at least, best-paid) white-hat makes $150k/year? Unless they're just doing it in their free time, they could make more than that working a standard corporate security job in a good area, or they could make 5-10 times as much as a black-hat.
I was a black box tester for nearly seven years. When I graduated from community college with A.S. degree in computer programming in 2007, I wanted to get a job as a white box tester. Never got hired. Went into I.T. support and the rest was history.
Is "white hat hacker" a Millennial/hipster term? The described role sounds a lot like that of what we typically call a "network security analyst".
More young hackers need to learn to take advantage of these types of programs, vs. trying to get paid or hired on their own by finding vulnerabilities and then threatening the businesses or institutions with exposing them if they aren't paid to provide a fix.
This just happened at a community college in Maryland. One of the students started posting random flyers around the school, warning people that the network was insecure, and essentially trying to blackmail the college into hiring him (at least as a consultant) to fix the security problem.
He did, indeed, find a vulnerability. Not surprising at all, since security has been a weak sport for the school for quite some time. (There's currently a lot of hiring and firing going on behind the scenes, related to trying to get more competent and security-conscious people working in I.T. there. Like many places, they suffered from long-tome employees at the top of the chain of command trying to cling to outdated technology as long as possible, and refusing to keep up with changes.)
But his approach was NOT the right way to monetize his skill in finding the security flaw(s). The fact that the FBI escorted him off the campus last week attests to that.
The summary says:
--
one of the platform's white hat hackers has already earned over $600,000 in just two years.
--
From that you got:
> So the world's best (or at least, best-paid) white-hat makes $150k/year?
Over $600K in two years is over $300K per year. No, that's not "the world's best paid white-hat". That seems to be how much one freelancer made from Hackerone - he or she may have made just as much from other avenues, and there is no reason to think this person is "the world's best-paid white hat - in fact there is good reason to think they are not.
That is roughly the range of someone highly qualified, though - without pairing it with management or other fields such as writing. (Think Bruce Schneier - trained as a cryptologist, paid as an author and nerd-famous media personality).
Marketing term, mainly by companies pushing pentest certificates and their associated flotsam.
"the services of 100,000 ethical (and vetted) hackers."
Something tells me the vetting wasn't very thorough.
Also marketing from IT consulting companies trying to score security contracts with Fortune 500. It's working. A lot of corporate IT departments have taken up the "it's not if but when" mantra as gospel. Makes the current situation seem less fucked, but a lot of the higher ups will NEVER see it that way. Although, it's probably true for most companies with vendor support models. "No sir, there's no way this could have been prevented" will only work for so long.
Wow, one white hacker made over 600k! So we should just assume they all did!
600k in bugs at extremely shitty payouts...I wonder how much money this guy would have gotten on the black market.
...in the same sense that the NBA is paying millions for basketball-playing.
"When information is power, privacy is freedom" - Jah-Wren Ryel
This isn't news. As said above $3 million is a joke for google to spend. That's not sounding like a big market. What this post actually is, is an advertisement for HackerOne and PwC's own new product for contract based security people.
The problem here is that this will not keep. There is definitely luck involved, and if this person was, say, working 80h weeks, then the compensation still sucks.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It can also be a "system security analyst" and a "software security analyst" or a lot more fuzzily an "IT Security Expert" or "IT Security Consultant". Of course, in a time where the BS term "Cyber" gets attached to anything, "Hacker" is actually a significant improvement.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
My team and I do something similar periodically. Our experience is that luck is a short term phenomenon in the face of skill. Daniel may happen to find something pretty good in the morning, while I don't find much until the afternoon. Zach might find two interesting bits on Monday, none on Tuesday; Immad finds one on Monday and one on Tuesday. Over the course of a few days, our performance tends toward what you'd expect from our resume. Luck is very short term, skill is the controlling factor over the course of even days, and certainly over years.
For example, guy who knows how to analyze a system to divide it into its components then focuses on the interactions between those components will find many more vulnerabilities than someone who focuses on one component and tries to find vulnerabilities within that component, internal to it. It's the interfaces between systems where most of the weaknesses are. Looking in the right places, the most likely places, is a skill, not luck.
Code review and pentesting are two very different, yet complementary things. As you suggested, code review is likely to find a lot more, including things some people don't typically think of as "security" - points of fragility, for example. Code review is very useful, especially when done by people trained in security.
Pen testing *after* code review is also very useful. It isn't unusual for code review to have a lot of detailed findings. As an analogy, looking at the internals (code review) might find that the deadbolt is is only held in with two half-inch screws, it's a cheap, crappy lock, and the gap between the door and the frame allows the lock to be shimmed. After you address those a pen tester looking at things from a different perspective walks right in through the side door. A concrete example is the OS. You might code review the application extremely well, then I shellshock right past it. "But the OS is out of scope!", you exclaim. So what. The bad guy and the pentester don't care about your review scope. We just walked right into your database.
Two different, complementary things, both useful.