Covid: White hat bounty hackers become millionaires

By Joe Tidy
Cyber reporter

Published

14 hours ago

image captionHackerOne hosts regular events bringing its hackers together

Hackers earned a record $40m (£28m) in 2020 for reporting software flaws via a leading bug bounty reporting service.

HackerOne said nine hackers made more than $1m each after it flagged their findings to affected organisations.

One Romanian man, who only started bug-hunting two years ago, saw his total earnings to date top $2m. The UK's top-earning hacker made $370,000 last year.

The platform suggested the pandemic had given the volunteers more time to pursue the endeavour.

A survey HackerOne commissioned indicated that 38% of participants had spent more time hacking since the Covid-19 outbreak began.

'Literally shaking'

Many of those involved work part-time and are based in dozens of different countries including the US, Argentina, China, India, Nigeria and Egypt.

image captionLecturer Katie Paxton-Fear is a bug bounty hunter in her spare time

The amount of money awarded depends on the severity of the flaw, and can range from less than $140 to much bigger sums.

HackerOne, which is based in California, charges a subscription fee to businesses for use of its platform.

British bug bounty hunter Katie Paxton-Fear, a lecturer at Manchester Metropolitan University, says she looks for bugs in her spare time.

Whilst the money is good, she says it is not a get-rich-quick activity.

"I've earned around £12,000 in 12 months," she told the BBC.

"I remember finding my first bug and literally shaking and realising: 'Wow I just saved people from a pretty big flaw.'

"I'm not just using my time to win a prize, I'm actively helping secure applications I use, so for me it's a challenge mixed with doing something good."

• The volunteer hackers protecting the US election
• Hospital, school and business security cams hacked
• EU bank authority hit by Microsoft email hack

Another similar platform called YesWeHack, which is based in France, said its 22,000 hackers had submitted double the number of bugs in 2020 than the previous year.

It does not release figures on money rewards made via its service.

"Given the new risks and the importance of cyber-security in the economic survival of companies, an increasing number of chief information security officers have turned to bug bounties," said chief executive Guillaume Vassault-Houlière.

Another, BugCrowd, said it saw a 50% increase in submissions on its platform in the last 12 months.

media captionWATCH: Teenage millionaire hacker Santiago Lopez was the first HackerOne hacker to make $1m

Bounty sceptic

Commercial bug bounty programmes have grown in popularity in the last five years, but some experts think there are flaws to the system if they are relied upon too heavily.

Security researcher Victor Gevers, who runs the GDI Foundation for responsible disclosure in the Netherlands, said he never accepted money for bugs he found.

"We don't participate in bug bounties because they are sometimes quite narrow in their scope and only give researchers permission to look for flaws in certain parts of their systems," he said.

"We want to be able to ethically search for vulnerabilities where we think they are, and maintain our independence.

"But for starting security researchers or students, then these commercial bug bounty platforms are great as they offer a lot of protection, resources and are a perfect place to start."

Prince Harry and Meghan: Where do they get their money?

Published

14 hours ago

IMAGE COPYRIGHTGETTY IMAGES

Prince Harry says his family cut him off financially after he and wife Meghan "stepped back" from being senior royals and moved to California.

So, where do they get their money from?

Do Prince Harry and Meghan get money from the Royal Family?

The Duke and Duchess of Sussex announced in January 2020 that they wanted to stop being working members of the Royal Family and would "work towards" being financially independent.

It was understood the couple would continue to receive money for a time from Harry's father under the new agreement, although it is unclear whether that would come from the Duchy of Cornwall - a vast portfolio of property and financial investments - his personal wealth, or a combination of the two.

Prince Charles's accounts suggest about £5.6m was spent funding the activities of both the couple and the Duke and Duchess of Cambridge in the year to March 2020.

But Prince Harry told Oprah Winfrey the Royal Family had "literally cut me off financially" after that point.

It's not clear whether he was referring to the money the couple previously received from Prince Charles's income from the Duchy of Cornwall, the taxpayer-funded sovereign grant, or both.

Details from Prince Charles's accounts for this period have not yet been released and Clarence House have declined to comment.

• 12 things we learned from Meghan's Oprah interview
• Harry and Meghan rattle monarchy's gilded cage

IMAGE COPYRIGHTGETTY IMAGES

Are the Duke and Duchess of Sussex wealthy?

Both the Duke and Duchess have considerable personal wealth.

Prince William and Prince Harry received the bulk of the £13m fortune left by their mother Princess Diana.

Speaking of their move to the US, he told Oprah that "I've got what my mum left me and without that we wouldn't have been able to do this".

Prince Harry is also thought to have been left millions of pounds by his great-grandmother, the Queen Mother, says BBC royal correspondent Nick Witchell.

During her acting career, the Duchess of Sussex earned a reported payment of $50,000 (£38,300) per episode for the legal drama Suits. She also ran a lifestyle blog, and designed her own fashion line for a Canadian brand.

What other income do they have?

As they are no longer "working royals," Harry and Meghan are free to make their own income.

The couple were not paid for the interview with Oprah, but since moving to the US they have made deals with streaming services Netflix and Spotify. There has been speculation that these deals are worth millions.

IMAGE COPYRIGHTGETTY IMAGES

image captionThe couple no longer undertake official royal duties

They have set up an organisation called Archewell, which has production arms alongside a non-profit foundation.

Who pays for their security?

When the couple lived in the UK they were given a security detail provided by the Metropolitan Police. It's not known how much this cost.

After the Canadian government announced it would stop providing security for the family, Harry and Meghan decided to move to the US.

There, American billionaire and media mogul Tyler Perry offered the couple a home to stay in and security during the early months of lockdown, the couple revealed.

Asked by Oprah how the couple would respond to accusations of being "money-grabbing", Prince Harry said the deals with Netflix and Spotify were "never part of the plan", but were necessary.

"From my perspective all I needed was enough money to be able to pay for security, to keep my family safe," he said.

Who funded the couple when they were working royals?

Before deciding to step back from their Royal duties, 95% of the couple's income came from Prince Charles's income from the Duchy of Cornwall.

Money from the Duchy - just over £5m in total in 2018-19 - covered the public duties of Prince Harry and Meghan, as well as the Duke and Duchess of Cambridge, and some of their private costs.

The taxpayer-funded Sovereign Grant made up the other 5% of their income.

IMAGE COPYRIGHTGETTY IMAGES

This grant is paid from the government to the Royal Family to cover expenses for official duties and looking after royal palaces. It is worth a total of £85.9m this financial year and is funded by profits from the Crown Estate - commercial properties owned by the Crown.

The Duke and Duchess announced in September that they had repaid the £2.4m cost of renovating their home, Frogmore Cottage in Windsor, a bill initially footed by the UK taxpayer.

What is the Crown Estate?

• An independent commercial property business and one of the largest property portfolios in the UK
• The majority of assets are in London, but the estate also owns property in Scotland, Wales and Northern Ireland
• Holdings include Windsor Great Park and Ascot racecourse, but most is residential and commercial property
• Managed by an independent organisation, with any profit paid to the Treasury for the benefit of all UK taxpayers
• Funds the Sovereign Grant which supports official royal duties and maintains the occupied royal palaces