On Ethical Hacking And The Budding Bug Bounty Hunting Business

What is this whole bug bounty business all about?

Ok so now there’s a trend coming up which is bug bounty hunting, where white hat hackers report bugs and get rewarded. There are a lot of public bug bounty programs from big companies like Google, Facebook, and even Grab.

- Zachary Chan

How big of an industry is this?

In Asia, it is still very immature. But even the (Singapore) government has finally started going into the bug bounty direction, and more mindsets will start changing and be more open to this. They’ve done two successful programs already, and the hackers that participated are also in our pool of hackers.

So, “Bug Bounty Hunter” is a real profession then?

Yes. The good ones actually earn millions of dollars. In the middle range, there are people who earn at least US$2,000 up to US$10,000 easily on a monthly average.

For example, in the recent 2nd Singapore Government Bug Bounty Programme, the local guy who won second place got US$1,750 just for that short period of time. He could have worked on multiple projects, not just one. If you actually work more than 10 projects, and each project earn you even just $1,000 each, you’d have $10,000.

How does one become a bug bounty hunter? Do you need elite programming skills to be a hacker?

Not really. There are actually a lot of hackers who don’t have a programming background at all, but they do have deep knowledge of how networks connect with each other, and how websites work.

A lot of hacking doesn’t even involve programming. You are using tools to ask like the router who is inside your network, and then from there you try to test each computer individually for a vulnerability to go in.

We all probably only know of hackers through Hollywood movies, what’s it really like?

So, all these old Hollywood shows, like Hackers, are not realistic at all and more of Hollywood drama. Some hacking shows even have 3D graphics, but there is no such thing in the real hacking world.