[jiggypuff44]

These companies usually pay a couple hundred to thousand bucks for bugs ranked high to critical

Meanwhile, when the russian comrades go in and infiltrate their systems and steal data, they end up paying millions.

[AdamSandler]

then there's this

https://hackerone.com/reports/1622449

[jiggypuff44]

then there's this

https://hackerone.com/reports/1622449

Lmao. What a legend. Shit OpSec though.

Following the money trail, we received confirmation that the threat actor's bounty was linked to an account that financially benefited a then-HackerOne employee. Analysis of the threat actor’s network traffic provided supplemental evidence connecting the threat actor's primary and sockpuppet accounts.

[happenstance]

Its fun being a legal hacker, you guys should try it and stay out of jail

Less fun finding vulns that would cost the company millions if exploited only to be paid pennies for doing the "right thing" and reporting it. Certainly less fun when you report legally and the company still tries to go after you anyways. If legal avenues paid proportionately to the damage of the bug found I'm sure we'd have far less blackhats.

[joshstove]

theyarecool