Who wants to make millions from hacking? For most technically-skilled people starting out in the cyber world, getting paid a lot of money is a daunting prospect, as they fear they will be targeted and end up in jail. So the career of an ethical hacker is generally considered a bit uncertain, but there are a number of bounty programs from various companies that offer hackers big bucks if they can find specific vulnerabilities. Apple is offering $1 million to anyone who can hack the iOS of an iPhone without requiring any user clicks. The Zerodium, meanwhile, is offering $2 million (£1.6 million) to anyone who can perform a “zero-click” remote jailbreak on an iPhone. Six hackers on the HackerOne bug bounty platform have also earned more than $1 million each.
HackerOne: bug bounty platform
HackerOne announced today that six hackers registered on its Bug Bounty platform have each won more than $1 million. HackerOne acts as a conduit between approximately 1,500 organizations, including General Motors, Goldman Sachs, Google, Intel, Microsoft, Spotify, Starbucks, Twitter and even the U.S. Department of Defense, and hackers who can find vulnerabilities in their systems and services before malicious actors can find and exploit them.
“HackerOne has half a million registered hackers and 600 new members join every day,” says Laurie Mercer, a security engineer at HackerOne, “and they’ve discovered over 130,000 vulnerabilities so far.” The idea of offering money to find vulnerabilities is not new. Mercer believes the first bug bounty program was launched about 30 years ago when a reward of $820 was offered to anyone who could find flaws in the operating system that powered the Hubble telescope.
Things have changed somewhat since then, with HackerOne having paid out around $65m (£53m) in bounty payments to hackers from 150 different countries, according to Mercer. By the end of 2020, HackerOne CEO Marten Mickos predicted that “hackers will earn $100m (£82m)” and hopes HackerOne will have “1 million ethical hackers on its platform.”.
If you want some arguments about whether a career in hacking can be profitable, then you should take a look at this year’s Hacker Summer Camp. That’s the name given to the August week that joins the Black Hat USA and DEF CON hacker conferences that take place in Las Vegas. At the live hacking event “H1-702,” around 100 hackers gathered for three days of vulnerability hunting, with a total of $1.9 million (£1.5 million) split between the hackers for finding more than 1,000 bugs.
While attending the H1-702 event, the odd thing that emerged was the six millionaire hackers. The names of the six hackers are: Santiago Lopez, 19 years old from Argentina, Mark Litchfield from the United Kingdom, Tommy DeVoss, 35 years old from the United States, Ron Chan, 28 years old from Hong Kong, Nathaniel Wakelam, 22 years old from Australia, and Frans Rosen from Sweden.
The lure of ethical hacking
It may seem like these six hackers are the exception to the rule, and that the real money is being made by those doing the illegal work. However, that doesn't sit well with HackerOne's Laurie Mercer. "The incentive to illegally sell bugs is not for serious security researchers," says Mercer, "the path to wealth is to have a public reputation so that you get invited to more and more interesting projects, find more and more bugs, do what you love, and make money making the Internet safer."
One thing is for sure; these six hackers are great role models for anyone thinking about how to make the most of their potential. “Security specialists can now earn more than 40 times the average salary of software engineers by hunting for bugs,” Mercer concludes, and thus a new profession has been created: one where hackers can be paid handsomely to help create a safer digital world.”
