hackerone-2018年全球白帽黑客收入调查报告（IT）（英文）-2018.10-40页-3mb

2018 Hacker Report Summary

Core Content

The 2018 Hacker Report highlights the growing influence and importance of the global ethical hacking community in enhancing internet security. It outlines the characteristics, motivations, and contributions of hackers, emphasizing their role as the "immune system of the internet" by identifying and reporting security vulnerabilities. The report also discusses the economic impact of bug bounty programs, the geographic distribution of hackers, and the tools and techniques they use to find vulnerabilities.

Main Points

• Hackers as the Immune System of the Internet: Hackers are essential in identifying and fixing security flaws, contributing to a safer digital landscape.
• Community Growth and Impact: The HackerOne community has grown significantly, with over 166,000 registered hackers and 72,000 valid vulnerabilities submitted. The community is known for its collaborative and charitable nature.
• Geographic Diversity: Hackers are spread across the globe, with India and the United States being the top two countries. The report notes that hackers from India earn up to 16 times the median salary of a software engineer in their home country.
• Economic Impact: Bug bounties can be life-changing, with some hackers earning more than they would in traditional software engineering roles. The report provides a multiplier comparison across countries.
• Motivations for Hacking: While money is a significant motivator, the desire to learn, be challenged, and have fun is even more important. Hackers also seek to contribute to the greater good and improve security.
• Tools and Techniques: Burp Suite is the most popular tool among hackers, followed by web proxies, network vulnerability scanners, and fuzzers. Cross-site scripting (XSS) is the most preferred attack vector.
• Community and Collaboration: Hackers often work independently but value knowledge sharing and collaboration. Events like live-hacking bring the community together and foster relationships between hackers and security teams.
• Charitable Contributions: Over 24% of hackers have donated bounty money to charity, showing a strong sense of community and social responsibility.

Key Information

Hacker Community Statistics

• Total Registered Hackers: 166,000
• Total Valid Vulnerabilities Submitted: 72,000
• Total Bounties Paid: $23.5M+
• Percentage of Hackers Under 35: 90%
• Percentage of Self-Taught Hackers: 58%
• Percentage of Hackers Who Work Full-Time in IT or Tech: 46.7%
• Percentage of Hackers Who Hack Full-Time: 13.7%

Economic Insights

• Top Earning Hackers in India: Earn 16 times the median salary of a software engineer.
• Average Multiplier for Bug Bounty Earnings: 2.7 times the median salary of a software engineer.
• Annual Bounty Income: Some hackers rely on bounties for 50% or more of their income, with a few earning over $350,000 annually.

Motivations

• Top Motivation: Learning and improving skills.
• Second Place: Being challenged and having fun.
• Third Place: Financial incentive (down from first in 2016).
• Other Motivations: Career advancement, protecting and defending systems, and doing good in the world.

Attack Vectors

• Most Preferred: Cross-site scripting (XSS) at 28%.
• Next: SQL injection at 23.1%, followed by fuzzing and brute force.

Tools Used

• Burp Suite: 30% of hackers use it.
• Custom Tools: Over 15% build their own.
• Other Tools: Web proxies and scanners (12.6%), network vulnerability scanners (11.8%), fuzzers (9.9%), debuggers (9.7%), and Weblinspect (5.4%).

Community Engagement

• Collaboration: 31.3% read other hackers' blogs and results to learn.
• Team Work: 9% regularly work with other hackers, and 7.1% participate in team-based bug reporting.
• Live-Hacking Events: Hosted in multiple locations, including San Francisco, Amsterdam, Las Vegas, and New York City, to bring hackers and security teams together.

Charitable Contributions

• Donations to Charity: Over 24% of hackers donate bounty money to organizations like the EFF and local shelters.
• Company Matching Programs: Companies like Qualcomm, Google, and Facebook match bounties donated to charity.

Conclusion

The 2018 Hacker Report underscores the vital role of ethical hackers in securing the digital world. It highlights the community's growth, diversity, and commitment to learning, collaboration, and giving back. Despite the challenges, such as the lack of published vulnerability disclosure policies by many companies, the hacker community continues to thrive and make significant contributions to internet safety. The report serves as a comprehensive overview of the mindset, activities, and impact of the global bug bounty community.