2018白帽黑客报告（英文版）-3mb

2018 Hacker Report Summary

Core Content

The 2018 Hacker Report by HackerOne provides an in-depth look at the global hacker community, emphasizing their role in enhancing internet security through ethical hacking. It highlights the growth, motivations, and impact of hackers, while also discussing the economic and educational aspects of the bug bounty ecosystem.

Main Points

• Hackers as the Immune System of the Internet: Hackers are portrayed as essential to the security of the digital world, contributing to the discovery and remediation of vulnerabilities.
• Community and Collaboration: The report underscores the importance of the hacker community, with a strong emphasis on knowledge sharing, teamwork, and charitable contributions.
• Global Reach and Diversity: Hackers are spread across the globe, with India and the United States being the top two countries. The community is diverse, with a majority being young and self-taught.
• Economic Impact: Bug bounties have become a significant source of income for many hackers. Some earn over 16 times the median salary of a software engineer in their home country.
• Motivation Beyond Money: While financial reward is still a key motivator, the desire to learn, be challenged, and have fun is more prevalent. Hackers also contribute to the greater good by donating bounties to charities.
• Tools and Techniques: Burp Suite is the most commonly used tool, with many hackers also building their own. XSS and SQL injection are the most preferred attack vectors.
• Growth and Trends: The community has grown significantly, with over 166,000 registered hackers. The report also highlights the increasing trend of hacking for educational purposes and the role of universities in training hackers.

Key Information

Hacker Community Overview

• Total Registered Hackers: 166,000+
• Total Valid Vulnerabilities Submitted: 72,000+
• Total Bounties Paid: $23.5M+
• Community Growth: A 10-fold increase in registered users in 2 years.

Top Countries

• India: 43% of the community
• United States: 20%
• Russia: 6%
• Pakistan: 4%
• United Kingdom: 4%

Hacker Demographics

• Age Distribution: Over 90% of hackers are under 35, with 45.3% between 18 and 24, and 37.3% between 25 and 35.
• Profession: 44% are IT professionals, 25% are students, and 13% hack full-time or 40+ hours per week.
• Education: 58% are self-taught, and 67% learned from online resources, blogs, or the community.

Hacker Motivations

• Top Motivations:
  • Learning tips and techniques (most important)
  • To be challenged
  • To have fun
  • Career advancement
  • Protecting and defending the internet
• Money: Still a top motivator but has fallen from first to fourth place compared to 2016.

Bounty Earnings

• Top Earning Countries:
  • India: 16x the median salary of a software engineer
  • Argentina: 15.6x
  • Egypt: 8.1x
  • Hong Kong: 7.6x
  • Philippines: 5.4x
• Income Sources: 25% of hackers rely on bounties for at least 50% of their income, and 13.7% rely on them for 90-100% of their income.

Tools and Techniques

• Top Tools:
  • Burp Suite (30%)
  • Custom tools (15%)
  • Web proxies and scanners (12.6%)
  • Network vulnerability scanners (11.8%)
  • Fuzzers (9.9%)
  • Debuggers (9.7%)
  • Weblinspect (5.4%)
  • Fiddler (5.3%)
• Preferred Attack Vectors:
  • XSS (28%)
  • SQL injection (23.1%)
  • Fuzzing (5.5%)
  • Brute force (4.5%)

Bounty Usage

• Personal Spending: Hackers use bounty money for various purposes, including buying cars, houses, and supporting charitable causes.
• Charitable Contributions: Over 24% of hackers donate bounty money to charities such as the EFF, Red Cross, and local shelters.

Community Engagement

• Collaboration and Events: Hackers often work alone but value learning from others. HackerOne hosts global live-hacking events to foster collaboration and community bonding.
• Knowledge Sharing: Hackers share knowledge through blogs, GitHub repositories, and forums, contributing to the growth and development of the community.

Company Engagement

• Vulnerability Disclosure Policy: Only 6% of companies in the Forbes Global 2000 have a published policy, leading to a lack of disclosure channels for 25% of hackers.
• Government Collaboration: The U.S. Department of Defense has engaged with hackers, resolving over 3,000 vulnerabilities without cash bounties.

Conclusion

The report highlights the critical role of hackers in making the internet safer and the growing influence of the bug bounty community. It showcases the diverse motivations, tools, and techniques used by hackers, as well as the importance of community collaboration and education in the field. Despite challenges, the community continues to thrive and make significant contributions to digital security.