Some Indians earn big money by identifying software bugs

Indians are cracking the bug bounty code, at global firms, raking in huge moolah.

 Some Indians earn big money by identifying software bugs

---

• The story: Large software firms make huge products. These require millions of lines of coding. Not all of that remains perfect, and may create serious vulnerabilities in the platform, making it prone to hacking.
• Ethical hackers: Smart software engineers - ethical hackers - are reaping huge rewards for finding such glitches that may make firms vulnerable. At times, they get rewarded, at times not.
• Some who earned big: The Times of India reported that Mayur Fartade, a final-year engineering college student, earned Rs 22 lakh ($30,000) on June 15, 2021. Narendra Bhati, a security professional in Pune, earned over Rs 80 lakh in 6-7 months, and Akhil George, a 23-year-old engineering graduate, earned Rs 66 lakh ($90,000) in 2020. Bhavuk Jain, an engineer from Ghaziabad, won Rs 75 lakh ($100,000) in a single day.

1. Fartade, Bhati, George and Jain are examples of how computer science engineers can earn lakhs finding bugs in software.
2. Fartade's entry into bug bounty started with a small bug on a government site. It wasn’t until 2020, when the pandemic hit, that Fartade dedicated his time to learning about hacking, reading up on blog posts by cybersecurity researchers.
3. There are many who have joined the bug bounty hunt since the pandemic, lured in by equal parts curiosity and of course, bounty.

• "Bug bounty": Software bug hunters get rewarded for finding glitches in computer systems, which otherwise can be exploited by black hats, or hackers, for gain. A case in point is ransomware attacks.

1. In 1983, one of the first firms to offer rewards for finding bugs was Hunter & Ready, which invited engineers to test its Operating Systems.
2. The advt was - “Show us a bug in our VRTX, real-time operating system, and we will return the favor - With a bug of your own to show off in your driveway.” The bug to show off here was the Volkswagen Beetle.
3. The term "bug bounty" was coined by Jarrett Ridlinghafer, a technical support engineer at Netscape Communications Corporation, in 1995.

• Biggest one: One of the most successful bug bounties that continue till today was launched by Mozilla in 2004, nine years after Netscape. On August 2, 2004 Mozilla foundation announced: “Under the new scheme, any user who reports a critical security vulnerability in end-user Mozilla software will receive a US$500 reward.” It said that from 2017-19 it has made a payout of $965,750 to researchers across 348 bugs, making the average payout $2,775.
• More: The trend continued with tech giants Google (2010), Facebook (2011), Apple (2016) and Microsoft (2013) launching their own bug bounty programmes over the years. In all these programmes Indians have come to become one of the largest beneficiaries, ranking among the top bounty hunters across the tech platforms.
• Indians lead: Facebook said that the company awarded $1.98 million to researchers in 50 countries in 2020. India was in the top three along with Tunisia and the US. Two Indians, Suresh Chelladurai and Dhanesh Kizhakkinan, were among the top five in Microsoft’s most valued security researchers of 2021. Apple paid one of its highest bounties of $100,000 in 2020 to Bhavuk Jain, an engineer from Ghaziabad and a bug bounty hunter. Jain has been bounty hunting full-time for the past three years, before being employed as a cybersecurity researcher in July 2021.
• Pandemic impact: When the pandemic hit, while tech companies continued bounty programmes, smaller companies shut them down. With businesses returning to the new normal, where cybersecurity is a key challenge, more companies are launching bug bounty programmes globally. According to the 2020 HackerOne report, Indian hackers earned 10 percent of the total bounty on offer, after the US at 19 percent. In addition, Indians accounted for about 18 percent of the total bug reports submitted last year, followed by the US at 11 percent.

1. A few years ago, startups such as Zomato, Flipkart, Ola, Urban Company and Makemytrip launched bug bounty programmes. However, the incentives the companies offer aren’t high, making it less lucrative for bounty hunters.
2. Ola's minimum payout is Rs 1,000. Further, on its site, Ola has stated: “We may reward only with awesome goodies depending on the severity of the vulnerability.” Makemytrip states that the minimum payout is Rs 5,000.

• EXAM QUESTIONS: (1) Explain the concept of "bug bounty". How does it help the company? What risks does it carry? (2) What are the various ways day zero vulnerabilities may enter a system? What risks do they magnify later? Explain.
  

#Science #Bugs #Software #BigBounty #Internet #Vulnerability

 

Join PT courses | PT Youtube | PT App | Contribute |  Testimonials