Back in 2002, Tommy DeVoss had some unwanted guests at his front door: FBI agents, ready to raid his home.
He’d been leading a hacking crew through a yearlong run attacking government websites and internet giants like Yahoo.
A decade and a half later, he’s the one knocking on the door of some of the biggest websites out there, and the businesses behind them are gladly paying him thousands of dollars for his hacking efforts.
DeVoss is part of a rare group of full-time bug bounty hunters, hacking experts who dedicate their days to finding vulnerabilities on websites in hopes of big rewards, the digital equivalent of Indiana Jones. These bug hunters have been helpful to companies that don’t have resources to hire full-time experts to test their security. They can help find flaws that could prevent major hacks by cybercriminals.
At a time when malicious hackers are exploiting vulnerabilities in a big way — consider the 145 million people affected by Equifax’s breach, or the — companies are more vigilant about the need to protect themselves. For DeVoss, that means business is good.
Indeed, he went from struggling to find a job, given his conviction record, to quitting a comfortable, pedestrian job as a software developer that paid $90,000 a year. That was in late 2016, when he turned his focus to hunting for software bugs full time.
DeVoss and other bug hunters been busy. Companies like Google, Apple and Facebook, as well as government agencies including the Department of Defense, often launch bug bounty programs to reward hackers who find security flaws before criminals do. In 2016, companies and agencies paid out $6.3 million for 52,000 discovered vulnerabilities, according to Bugcrowd, a bug bounty resource.
“Our bug bounty program is an essential pillar of our security strategy,” a spokesperson for Oath, a unit of Verizon to which Yahoo now belongs, said in an email.
It’s like paying a burglary expert to come to your house to tell you all the ways someone could break in. The bigger the vulnerability, the higher the reward.
While these programs are popular, of the more than 53,000 bug bounty hunters active since March, only 15 percent are considered full-timers like DeVoss, according to Bugcrowd.
Some of them strike it rich, like Mark Litchfield, a veteran who makes more than half a million dollars a year on bug bounties. Others have more humble ambitions, like India’s Jasminder Singh, who nabs bounties to fund his startup.
Here’s what it’s like to be a bug bounty hunter, from their own perspective.
As a teen, DeVoss defaced more than 160 government websites under his alias, DawgyG. DeVoss ran the World of Hell hacking group and thought he was untouchable.
Then, the World of Hell fell apart. Agents arrested each member between 2002 and 2003.
He was slow to learn his lesson. DeVoss had three different stints in prison for hacking over the next several years.
After finally straightening out and getting a respectable job as a software developer for a small startup, he saw an article about a bug bounty program for Facebook. He brushed it off at first — after all, a judge had told him his next conviction would bring the maximum penalty.
“It seemed too good to be true, that people were going to pay me to hack them and not call the FBI again,” DeVoss said.
Then in 2015, he went to Defcon, the massive annual hacker gathering in Las Vegas, where bug bounty hunters were telling him about how much money they were making. He decided to give it a shot, out of both boredom and envy.
DeVoss opted to return to the scene of his last crime: Yahoo. He had been hacking the site since 1997 and figured nearly two decades of experience would give him an advantage.
He was still nervous about hacking his old foe. DeVoss figured he’d do something simple, something that wouldn’t get him in trouble with federal agents again.
He found Yahoo’s gist — a collection of private codes — publicly available on Github, through a simple search, no hacking involved. He didn’t think it’d be worth anything, but it would be enough to test the waters on the bug bounty program.
They paid him $300 for it.
“I got $300 for finding something through a Google search,” DeVoss said.
From there, he was hooked. He’d spend most of his time at work hunting for bugs instead of his actual job and eventually just quit.
He’s been paying off his student loan debt and injunction fees from his past crimes with bug bounties. When you can make $9,000 in 15 minutes like DeVoss did in June for finding a single bug, it pays off.
His goal for 2017, the year he set out to be a full-time bug bounty hunter, was to make $100,000 a year. By July, he had earned more than $84,000 in bug bounties.
“I would have to be the CEO of a Fortune 500 company to make the same hourly wage that I make while working on bugs,” DeVoss said.
The high roller
“If you’re not first, you’re last.”
It’s not only a goofy quote from “Talladega Nights,” but the mantra that helped Mark Litchfield become the highest-earning bug bounty hunter, making $600,000 in 2016.
When you’re not the first to send in a bug, it can mean losing out on $10,000, Litchfield said. He remembers, because he’d hit the jackpot in 2015 after discovering a major bug in PayPal’s code that allowed for remote code execution, which gives an attacker potentially damaging control over a site.
The flaw earned the Las Vegas resident a quick $15,000. About two days later, another prospective bug bounty hunter found the same coding error, since PayPal hadn’t fixed it yet. His competition only got $5,000. By bug bounty hunter standards, even that’s generous.
“If you come in second, it’s a duplicate, and you’re not going to get paid,” Litchfield said. “It happens to all bug hunters, and it can be extremely frustrating.”
Litchfield decided to become a full-time bug bounty hunter in 2014 through HackerOne, another bug bounty service, after he was confident he could pay all his bills through hacking. Like DeVoss, Litchfield felt bored at work and figured he could make a lot more money by going all-in after bug bounties.
To Litchfield, every bug bounty program is a race. And over the last year, he’s won several of them. That’s because he’s hunting for major bugs, not small-time flaws that every other bounty hunter is picking up. If a bounty is less than $500, Litchfield doesn’t even bother touching it, he said. His targets can be worth as much as $50,000 a month.
Litchfield knows to find exploits for what companies think are important. When he joined Yahoo’s bug bounty program, he went after its advertisements and email — the company’s bread and butter.
Instead of running a scanner that can automatically detect bugs, Litchfield goes for the manual approach. He combs through important applications, searching for anything that would give him administrator-level privileges. He’ll dig through code, looking at how it’s built and ways it could be broken.
“It can be time-consuming,” he said. “But if it’s done right, you can find the issues you’re there for, and the payouts are normally very high.”
He’s constantly afraid that all his work will have ended up for nothing, a major disappointment that’s happened more than once. But he doesn’t let it get him down.
“I enjoy what I do. Sometimes things get a little bit frustrating, but I’ve chosen to do this, so I’ve just got to move on,” he said.
Not all bug bounty hunters are swimming in riches. For some, even a small payout can mean a lot.
At the average daily wage in India of $4.25 a day, it would take Jasminder Singh more than six years of nonstop labor to make what he did in four days from bug bounties.
Singh, an entrepreneur in India, never saw himself as a bug bounty hunter, much less a hacker. He’s a web developer, making apps and websites for any clients that would pay him. He only got into security because he needed to keep his own creations safe.
But sometimes business was slow. When he couldn’t count on his startup to pay the bills, Singh found a lucrative backup plan in bug bounties.
Google and YouTube have provided a steady flow of income for Singh, who uses all the earnings to build his company. If he’s ever in a bind for cash, he’ll turn to their two programs.
“If you want to make money quickly, and you’re good, bug bounties are definitely the way to go,” Singh said.
The first time he tried out Google’s bug bounty program was in December. Singh had been short on cash and learned about the tech giant’s Vulnerability Rewards Program. In 2013, Google had given out $3 million in rewards for hackers who found vulnerabilities with Android and Chrome, and Singh figured he could find bugs for some quick cash.
The first bug he discovered was an issue with YouTube — a critical flaw with cross-site scripting that could allow a hacker to take control of the site without permission from Google.
“Google is very concerned about guarding their access,” Singh said. “If you find a bug, it’s usually five grand, guaranteed.”
By Litchfield and DeVoss’s standards, that isn’t a lot. But for Singh, it’s enough to fund his own company.
Full-time bug bounty hunters are rare but steadily growing, Litchfield said. Talented hackers are figuring out that they can earn a lot of money for essentially breaking into a web service, while major companies figure it’s easier to pay bounty hunters to find their flaws than spend hours searching for it themselves.
As long as the cash keeps flowing in, hackers have found a legitimate way to earn a living and make a difference at the same time — if they’re willing to put in the work.
“There’s a lot of people that have small families and can make $150,000 as security analysts,” DeVoss said. “It’s not worth the risk for a lot of them to try to do it full time.”
CNET Magazine: Check out a sample of the stories in CNET’s newsstand edition.
Tech Enabled: CNET chronicles tech’s role in providing new kinds of accessibility.