Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Becomes First Hacker to Earn $1M Through Bug Bounties

digit.fyi

Post reply on HN
Print view View original

101–110 of 178 posts

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#101

Post by masonic »

shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

  just tell the submitter that it is a duplicate
Or simply close it immediately with a nonsensical message unrelated to the problem report and then immediately change the code. (This happened to me last month.)

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#102

Post by mettamage »

HeavenBanned wrote: post #25
badfrog wrote: post #18

Earlier quoted context omitted.

> understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities. No, but it does suggest that you're likely capable of learning security work. Just like your data structure and algorithm knowledge didn't come for free, nobody is born knowing how to find security problems. You need to work for it.

What's a way to learn security work? Genuinely curious.

I followed a couple of courses at the VU University Amsterdam. I'll tell you what I've learned about security, it gives you a couple of terms to type into a search engine at least.

There are 3 courses they give for it:

1) Computer & Network Security

2) Binary and Malware Analysis

3) Hardware Security

The lower level it gets, the better they are at it. Each course costs 1200 euro's for non-EU students. I recommend it.

I learned about (in random order):

- Rowhammer (I hope memory vendors will fix this)

- Cache attacks (I hope Intel will fix this)

- Stack smashing

- String buffer trickery in C

- Spoofing IPs

- DNS cache poisoning

- Using machine learning to fingerprint things

- Dictionary attacks for password cracking

- Portscanning

- Cold boot attacks

- Spotting vulnerabilities in C code

- Reverse engineering binaries with IDA Pro and knowing x86 and x64 assembly

- Taint analysis

- Instrumenting binaries with PIN

- Using SMT solvers to crack passwords in binaries

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#103

Post by masonic »

satellitec4t wrote: post #82
danschumann wrote: post #73

I wonder if anyone has "cobra effect"ed the bug bounty world yet.. whereby they leave vulnerabilities in their code in order to obtain a bug bounty.

Obligatory Dilbert https://dilbert.com/strip/1995-11-13

From 23 years ago!

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#104

Post by alexcnwy »

shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

Sounds like an actual use case for staking - bug bounties on teh blockchain!

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#106

Post by kiliankoe »

technion wrote: post #81
thrwawy0001 wrote: post #66

Earlier quoted context omitted.

Can you elaborate on the automated reports a bit more? What makes them uninteresting?

I don't run a bug bounty but I do sit on a security@ inbox. I don't believe I've ever seen a report I would want to pay out on even if I could, but if you discount blatant spam (often peddling EV certificates), I've received reports asking about bounties for: - nginx version disclosed in headers - "Feature-Policy" header missing - DNSSEC not set up on zone - Domain not in HSTS preload list Responding to this sort of…

If I remember correctly VLC regularly receives bug bounty reports declaring it as a security vulnerability that their source code is available...

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#107

Post by yen223 »

geofft wrote: post #29
Narkov wrote: post #13

I'm very happy for the kid and like the idea that these programs are available but does this incentivise companies to effectively outsource their bug finding? From a purely fiscal point of view, why hire expensive full time staff to go digging when you can just throw a few sheckles at stuff as it comes up?

This is similar to Katie Moussouris's argument from the article: > Moussouris, who created the bug bounty at Microsoft, warned that if badly implemented such programmes could see talent leaving organisations in favour of pursuing bug bounties, and thus damage the talent pipeline. I've seen her argue this on Twitter before - the argument IIRC is that bug bounties should always pay less than getting a job helping the b…

Step one: Work at a company with a bug bounty program

Step two: Introduce subtle vulnerabilities

Step three: Claim bug bounty under a pseudonym (or just get someone else to claim it)

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#108

Post by yashap »

tptacek wrote: post #34

This is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.

From some Googling, seems like a typical software developer salary in Buenos Aires is around $10K USD/year. So this is dramatically more, ~30x that.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#109

Post by mcv »

towawayzone wrote: post #100
elpakal wrote: post #43

Earlier quoted context omitted.

And a pretty good income for 13/14 year old

The person in the article started at 16 and is now 19.

Even so, it's an amazingly good income for a teenager. Live with your parents, and you're a millionaire before you're 20. Live anywhere outside Silicon Valley, and it's still a fantastic income for anyone.
Post reply on HN