Hackers paid big bounties to discover bugs, improve cyber security: report
SAN FRANCISCO - A new report shows that a growing number hackers are being paid big bounties by companies, organizations, and even the U.S. government to discover bugs and protect the platforms and products that consumers use every day.
The report was released by a San Francisco company called HackerOne which serves as a platform that links hackers with companies and organizations that hope to improve their cybersecurity.
The data came from a survey of some 1,700 people and focused on so called "white hat" or ethical computer hackers who are collecting money or bug bounties to help protect companies instead of exploit their vulnerabilities.
The survey shows those bounties are increasing in number and size.
"The business has grown dramatically in the past year. The government is now a pioneer in this, which is positive...and the top bounties have increased a lot," said Marten Mickos, CEO of HackerOne, who added that the top bounty claimed is $100,000 but some clients offer up to $250,000 for discoveries of critical vulnerabilities. HackerOne says a wide range of companies across different sectors are now using hackers, including companies such as Starbucks, Google, General Motors, Slack, Uber, Nintendo, Snapchat, Goldman Sachs, Toyota, and the U.S. military.
"The U.S. Air Force is highly secure but it took our hackers only 8 minutes to find the first vulnerability and in total we found something like 200 holes in their systems," said Mickos.
Joel Margolis, 20, is a junior in college and when he looks at his laptop screen, it's often not to play games or shop online. He's already become an accomplished hacker in a short time.
"I've been hacking for probably about 4-5 years," said Margolis, who adds he's already found bugs for major tech companies.
"Uber, Yahoo, Oath, AOL, all these companies. Huge companies. Facebook," Margolis said, "I found a bug on Google a couple months ago and like, anybody would expect that Google has the best security because everyone uses it. But just because it has a lot of use doesn't mean it has great security."
The report also looked at companies on the Forbes Global 2000 and found one common flaw. The report says 93% of those companies had no policy to receive, review, and resolve bug reports from outside their company.
Rebecca Jeschke, a spokeswoman and digital rights analyst with the Electronic Frontier Foundation says companies sometimes turn a blind eye to bugs.
"Lots of companies like to think that if no one knows about the bug then no one will exploit it. But that's not true," said Jeschke.
HackerOne's CEO says even in the tech-savvy Bay Area, there is a need for improvement.
"We have a problem in the world and in the SF Bay area that cyber security and computer science have been seen as two separate practices. They need to be one," said Mikos, "We need to design cybersecurity into the code from the very beginning."
HackerOne says their platform alone draws some 200,000 hackers to pursue bug bounties and they expect the number of these "white hat" hackers will only continue to grow.