Hacker News Reader

Comment by liviu- | Hacker News Reader

One of the arrested ones is 20, and he allegedly created Dendroid — a malware that can take remote control of an Android device. He designed, developed and deployed this software (bypassing Google Play's malware detection system) which seems to be quite complex and capable [0]. This proves that he possess a certain set of marketable skills that are quite south after in the industry.

So I'm wondering - is this really bad news for them, or will it just bring them enough spotlight to be contacted for some security roles that pay better than what they were earning prior to the arrest?

[0] https://blog.lookout.com/blog/2014/03/06/dendroid/

View on HN

Many former criminals do lead successful careers, so it's quite possible. However it should be noted that circumventing the Google Play store malware detections is not particularly hard - it's definitely a start, and maybe even a conference talk, but for real notoriety in the security industry you'd want to be consistently discovering novel vulnerabilities in Android, not just figuring out how to sneak malware onto the operating system.

Now, all that said, if you are a competent reverse engineer and can reliably circumvent DRM/license protection, develop binary exploits for high-severity vulnerabilities or perform advanced malware analysis, you can easily earn north of half a million dollars a year in this industry. It is an extremely lucrative time to be working in security.

You don't need to start out as a criminal though. If you want to do things like this then work through CTFs like Microcorruption and OverTheWire and learn how to develop privilege escalation and sandbox escape exploits on very widely used software and operating systems.

Huh, I didn't realise salaries were that high in malware / RE. What kind of positions do you mean? Presumably consulting?

he means bug bounties

I'd be surprised if OP meant bug bounties. Most rewards seem to be in the $2,000 - 10,000 range. They take time to discover so you'd have to be pretty productive (and perhaps lucky) to regularly find enough bugs to earn a salary in that range.

From what I've seen of these, bug bounties are quite low. I, like GP, would assume consulting. Either for companies acting defensively or with nation states acting offensively.

Could be, but it's also applicable to general compensation for the skill set 'dsacco describes.

I definitely do not mean bug bounties. While it is possible to make a full salary pursuing bug bounties, they are a poor investment of time.

For example, if I am paid to do an exhaustive penetration test and source code review for a company I'll be paid $10,000/week. I might not find a single vulnerability (doesn't happen often), but I still did the work.

If I pursue a bug bounty for the same company I might find nothing at all, which means I earn nothing. I also most likely won't earn $10,000 in bug bounties in a week.

Aside from this, there is a bit of classism in the security industry. Bug bounty hunters are predominantly people from developing countries who do not know how to find even the most simple CSRF flaw, which is really quite sad. They do not have access to the same education and they are mostly hopefuls who want to "break in" to the security industry.

The "crowdsourced security" model touted by HackerOne and BugCrowd doesn't really work, where "work" means you can replace a real penetration test from a real security engineer with it. It works if you have people like Frans Rosen, fin1te or bitquark (famous bug bounty participants) pursue bug bounties on your software, but it doesn't work for the other 9/10 people who will fill your inbox with pointless, invalid reports. For this reason, bug bounty participants are not very well respected unless they have a reputation for good work because of how much noise the average bug bounty generates instead of valid reports. On the other hand, you'll find most successful security engineers don't spend much time pursuing them.

>It is an extremely lucrative time to be working in security.

Is it though? The average salary of a security engineer seems to be lower than that of a software engineer, and there seem to be considerably fewer positions available. Those very high paid positions seem few and far between.

I wonder if the high power security positions just aren't publicly listed. That seems like the sort of job you fill exclusively by recommendation or pursuit of candidates, rather than a job listing on LinkedIn.

Bingo. I'm not talking about "cybersecurity" positions. I'm talking about people doing advanced work in exploitation, reverse engineering and cryptography on a consulting basis or those who work in boutique shops.

I pass the $300k mark annually through AppSec consulting, and this is not at maximum utilization, nor is it a particularly "hard" discipline in security.

These are probably at least half the software engineer positions that pay more than $150k+ in the DC area. Most of the software jobs among start-ups and even commercial software development pretty much capped out a fair bit below that. I know I was dropped from several interviews just asking for a base of only $130k and not being very good exactly.

There's a demand for people that are actually serious security professionals in the engineering sense just as much as there is a massive demand for the bureaucratic "security" folks (that focus upon certificates and such to get their feet in the door of some random defense contractor).

Will these sorts of challenges also give you the necessary cryptography background? If not, what will?

I guess if people have that level of knowledge, the market dangles money, and they are still willing to take risks to do something different, it could be seen as evidence about how damn boring writing normal code for phones is!

Great article. It's quite amazing what malware devs pull off with each new toolkit.

The first comment on the post is however... not so great.

Reply on news.ycombinator.com