A longitudinal study of hacker behaviour

Abstract

Bug bounty programmes employ the skills and curiosity of independent security researchers (hackers) to support pre-and postdeployment security. Driven by the question How effective are bug bounty platforms at retaining the interest of hackers?, this paper aims to address two issues concerning hackers' behaviour. First, to resolve the information asymmetry between programme and platform operators, it is necessary to measure the number of active hackers on a platform. Second, to assist programme operators' understanding, we identify the archetypal behaviours of hackers across a platform. We found that 6,813 hackers (with public accounts) have successfully submitted at least one vulnerability report on Bugcrowd. Of these, approximately 45% (with an account age greater than 9 months) can be considered inactive. We conclude that a significant number of inactive and unproductive hackers may contribute, in part, to the difficulties faced by programme operators. In particular, difficulties in retaining the focus of hackers can lead to underwhelming returns from the resources invested. CCS CONCEPTS• Security and privacy → Vulnerability management; Software and application security; • General and reference → Empirical studies;

Coordinated Vulnerability Disclosure programme effectiveness: Issues and recommendations

“…A distrust of hackers by some organisations is also found by Tanczer (2020) . A lack of hacker motivation and a difficulty in maintaining participants is reported by Walshe and Simpson (2022) .…”

“…In exchange for the submission of a valid vulnerability report, hackers may be rewarded with monetary payouts, 'swag' (such as a company t-shirt), public recognition, or employment ( Hata et al, 2017 ). Although hackers may be motivated by the eye-catching rewards offered as payouts from many Bug Bounty Programmes (BBPs) ( Walshe and Simpson, 2022;Zhao et al, 2014 ), such as the $1,0 0 0,0 0 0 bounties offered by Apple ( Hern, 2019 ), some act out of altruism and report vulnerabilities to ensure the privacy, safety and security of the general public ( HackerOne, 2021 ).…”

“…Despite the widespread usage of CVD programmes and the increasing maturity of the security activity, there are still many barriers to adoption, including: large volumes of low quality reports ( Al-Banna et al, 2018 ), lack of hacker motivation ( Walshe and Simpson, 2022 ), high operating costs ( Walshe and Simpson, 2020 ), and a general distrust of hackers ( Follis and Fish, 2022 ). A qualitative study involving the operators of CVD programmes has the potential to both uncover the difficulties faced by operators during the pre-and post-launch phases and assess how effectively organisations are utilising their programmes.…”

“…These platforms act as centralised directories for programmes, allowing user-bases of hundreds-of-thousands of hackers to view pertinent information about an organisation's CVD policies and the extent to which hackers have participated in the past. As market participants, platforms help to resolve information asymmetries between programmes and hackers ( Wachs, 2022;Walshe and Simpson, 2022 ).…”