Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Recent computer hacking convictions and employability?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 158 posts

Ask HN: Recent computer hacking convictions and employability?

#1

Post by dk79XuL9 »

I was involved in a high-profile computer hacking case in 2015 which received international interest. I eventually pleaded guilty to charges of blackmail, fraud, and computer hacking. Following that, I was sentenced to four years in prison. I'm currently on probation for a year, and I'm also under the supervision of the Serious Organised Crime Unit for another four years. I'm bound by a number of technical constraints. The authorities in charge of my supervision are happy for me to find legal work in cybersecurity, but given my current circumstances, I just wanted opinions on how I should approach this.

I'm completely self-taught, and while on bail, I did a lot of responsible disclosure. I collaborated closely with CIRT teams, system administrators, website developers, and government agencies to ensure the remediation of over 3,000 web-application vulnerabilities. I wrote technical reports, provided remediation guidance, and validated patches to ensure that security issues were properly closed (in an informal capacity). My first bug bounty contribution took place in 2012 which was a GET-based reflective XSS on a subdomain belonging to Microsoft.

Over 30 private and public sector entities have sent me letters of acknowledgement. I've also been inducted into a number of hall of fames for uncovering vulnerabilities. In 2019, I was also ranked 11th out of 25,000 active researchers on a bug bounty platform.

I can't just walk into employment with my skillset because I'm not particularly talented, just proficient in web-application security and various methodology used to identify vulnerabilities. This leads me to believe that I should look for entry-level positions but I've been told I'm overqualified. Some opinions would be appreciated.

Re: Ask HN: Recent computer hacking convictions and employability?

#2

Post by core-utility »

On an episode of Darknet Diaries [1] (great podcast by the way), there was someone in a similar situation as you who goes by DAWGYG, who found his stride after incarceration on HackerOne [2]. If I remember correctly, he holds the record for highest single payout. You could give that a try, though income wouldn't be steady you'd effectively be working for yourself and utilizing your skillsets for good.

[1]: https://darknetdiaries.com/episode/60/ [2]: https://www.hackerone.com/

Re: Ask HN: Recent computer hacking convictions and employability?

#3

Post by nefitty »

My God that is impressive. You seem like you tried to make it sound easy with your last paragraph. Technically speaking, what were the top three most impactful things you mastered on the journey to where you are?

In terms of employment, have you found it too difficult to make living off of bug bounties? Maybe there's crews that would see you as an asset. Or maybe contract based solo consultation?

Re: Ask HN: Recent computer hacking convictions and employability?

#4

Post by inetknght »

> I'm not particularly talented

Stop telling yourself that. You wouldn't be #11 out of 25,000 if you weren't talented.

As long as you're open about your past and convictions, and your legal standing permits employment doing the work you'd do, then there's nothing stopping you from applying.

When you see a job posting then look at what the requirements are. If you fit more than half then you should apply. The things you don't know can be learned on-the-fly. You'll no doubt have interviews that try to find your strong points and weak points. You'll have failures. But that's not a problem: everyone has those.

This is your market: there are tons of companies that are hiring for your skillset and you'll land a job quickly if you're good enough at the core skills that are needed... which I'm sure you are.

Edit: I would also add that I'm also completely self-taught. The only computer class I've taken was typing... and I got kicked out for cheating because it was boring. I've been employed in software for over 20 years and currently make $160k salary in TX, USA building software for drones. There are a lot of people in the computer industry who are self-taught. Don't let that stop you.

Re: Ask HN: Recent computer hacking convictions and employability?

#6

Post by 3pt14159 »

Apply for everything. Let other people say no for you. If people find out about your past be 100% straight with them, but you don't need to be the one to bring it up. Work your hardest to provide value, ask for feedback and correct where necessary. You'll be fine. There's a lot of work in cybersecurity these days.

Also, you should list the country you're in. Who knows, someone on HN could reach out with an opportunity.

Re: Ask HN: Recent computer hacking convictions and employability?

#7

Post by zeepzeep »

Do you know @thedawgyg?

I guess blackmail & fraud are a problem but if it was related to hacking I guess you'll still find a job. It's gonna be hard, but there are companies that care about your hacking skills, not about your past.

> This leads me to believe that I should look for entry-level positions but I've been told I'm overqualified

You sound like a senior pentester if you'd ask me...

Re: Ask HN: Recent computer hacking convictions and employability?

#8

Post by inglor »

A bunch of friends just look for and then sell vulnerabilities (the good ones to bug boundary programs the less ethical ones to governments or companies).

The price of a zero day exploit is quite high (for both sides) and I have friends who make much more money than I do doing this.

That said they mostly work alone or in small groups in their basement rather than at a large security company.

I would hire (or at least interview you) with a prior conviction though I am not hiring for a security role.

I don't think the conviction is a serious impediment for employment in this particular field (since it's for a non-violent crime) though it might warrant supervision on your employer's side and I can definitely see the larger companies not wanting to take the risk.

Re: Ask HN: Recent computer hacking convictions and employability?

#10

Post by throwawaynay »

employability? lmao

smart employers would kill to get someone like you

I personally know a guy who got convicted at an early age for similar stuff, he never had any trouble finding work, even worked for some governments

any decent security startup would do anything to get you

bro I'm actually jealous

also: freelancing of course, rarely seen background checks for freelancers

Post reply on HN