Rise of India’s bug bounty hunter

Until recently the words ldquobounty hunterrdquo evoked imagery of lanky stubbled men with widebrimmed hats and boots stalking the lanes of the Wild West sixshooters in hip holsters These gunslingers would make their living by hunting down criminals with rewards on their heads bringing them in dead more often than aliveToday bounty hunters still exist but in the dark caverns of the Internet The newage hunter is armed with skills as he sniffs out weak links in websites and apps and reports them to the manufacturers Officially termed ldquovulnerabilitiesrdquo in cybersecurity lingo the common word for them is bugs and these men bugbounty huntersAlmost every major tech firm employs a Responsible Vulnerability Disclosure Programme where ethical hackers through relentless testing and research unearth weaknesses in their system Taking the same principle forward companies now have bug bounty programmes where a bounty is paid to the ethical hacker depending on the gravity of the bugs unearthedNikhil Rane 24 Khar residentNikhil RaneEarlier this week Nikhil Rane made a splash after he was featured in the India Book of Records for reporting no less than 198 bugs over a period of two years Rane is currently pursuing a Masters degree in Cybersecurity at the University of Bradford United Kingdom he has been a bug bounty hunter since 2021 when he uncovered his first vulnerabilityldquoI acquired a Bachelor in Information Technology degree from Sathaye College Vile Parle but didnrsquot have a high score I was wondering what to do next when my father suggested I look at cybersecurity I started training at a private institute run by his friend in Mumbai where I acquainted myself with the basics While upscaling myself I got familiar with bug bounties and my interest grewrdquo Rane tells midday over a call from the UKIn December 2021 Rane uncovered a bug in the website of a Netherlandsbased firm The bug enabled a hacker to intercept and manipulate the One Time Password OTP system used to create accounts so that anyone could create an account using an email ID without proper authentication It was the first bounty he earned At Bradford a professor realised Ranersquos passion for bug hunting and published a blog about him on the university website It travelled far and some 30 news media outlets featured himRane has scores of bounties under his belt Not all bug discoveries are rewarded with money though In some cases you get ldquoswagsrdquomdash Tshirts or medals that acknowledge the effort In other cases you get featured in the Hall Of Fame section of the concerned website like Google Apple or MicrosoftIf there is one thing Rane rues it is the approach of Indian companies towards vulnerability disclosure ldquoForeign companies respond to you even if they are rejecting your findings Most Indian companies donrsquot bother to reply to an email Theyrsquod rather secure their business than secure their datardquoOnkar Borude 21 Ahmednagar residentOnkar BorudeAt first Borude comes across as an unassuming young man with a rural Marathi accent But on the keyboard he is a warrior holding his own amidst a sea of expertsldquoMy journey began four years ago when I made a friend online who introduced me to the concept of ethical hacking Through that I became familiar with cybersecurity and bug bounty hunting and the idea of helping organisations be more secure by reporting their vulnerabilities appealed to me immediatelyrdquo says BorudeFor the next one year he watched hundreds of videos attended seminars and webinars and read blogs teaching himself the skills required for bug bounty hunting A year later in 2020 he reported his first bug to Offensive Security a New Yorkbased company working in information security He found that the link to their social media accounts at the bottom of their home page was faulty and the bug allowed anyone to create a social media account in the companyrsquos name After that there was no looking backToday Borude has over 250 bugs under his beltmdashover and above the 100 that he has reported to Indian government websites has earned over R60000 in bounties and boasts of numerous Hall of Fame appearances and swagsldquoI feel Indian companies look at certificates over skills They are more responsive towards those with certificates in cybersecurity not to those who have skills but may not be able to afford a course Besides there is severe lack of awareness when it comes to cybersecurity It is not talked about enough I learned about it when I had already enrolled for my graduation in Engineeringrdquo he saysSourajeet Majumder 20 Bengaluru residentSourajeet MajumderOriginally from West Bengal Sourajeet Majumder now lives in Bengaluru He made a major breakthrough earlier this year when he was able to get to the root of a vulnerability in the WB governmentrsquos Aadhar Enabled Payment System AEPS a mode of payment that works though Aadharlinked kiosks Amid rising cases of money theft through manipulating the AEPS Majumder found that he could using a publicly available online tool break into the data vaults of a state government website and steal citizensrsquo biometrics Using these cybercriminals could steal their money through AEPS He reported his findings to the government and the vulnerability was patched within two daysldquoHacking as a term has a stereotype attached to it It evokes images of men in hoodies typing away furiously and creating magic with their keystrokes Ironically it was this stereotype that got me interested Soon I discovered the difference between malicious hackers and ethical ones and the bug bounty programmes which really caught my attentionrdquo says MajumderHe learned everything he knows about hacking from online forums where ethical hackers share their knowledge and latest findings for others to refer to and reported his first bug to a government website in 2019 Today he has 50 bug bounties under his belt from Apple Google Bosch Tumblr and Dominorsquos and his feat with the AEPS system this year made him a name to be reckoned withldquoI have seen startups that have brilliant vulnerability disclosure mechanisms And Irsquove also encountered top companies that donrsquot even have an email ID one can report a bug to Sometimes when researchers report bugs to companies they are threatened with legal action for testing the website without permission while the severity of the bug is ignoredrdquoManthan Mahale 18 Thane residentManthan MahaleIf there was an example of a teenager turning into an expert ethical hacker while living out of his parentsrsquo basement it has to be Manthan Mahale He taught himself everything he knows about ethical hacking through YouTube videos and other publicly available resources when he was all of 16 ldquoIt began as an attempt to find unsecured WiFi routers so that I could connect to the Internet for freerdquo laughs Mahale ldquoBut the field is fascinating the more I read or watched videos the deeper I got sucked inrdquoThrough online discussion forums and social media he wormed his way into hacker communities and began learning from experts in the groups His moment of reckoning came in 2021 when he found a vulnerability in a German company site that lets you create online questionnaires like the ones used in market research surveysldquoYou need to create an account in order to create a form and through this account you can store and access your data in the companyrsquos server Using a commonly available automated tool I was able to discover a bug that let me access anybody elsersquos data with a little bit of manipulationrdquo says Mahale who is pursuing a Bachelor of Engineering degree from the Indira Gandhi College in GhansoliThe spunky teen has reported 600 bugs to various big names including McDonaldrsquos and Google He has earned cash rewards for two bugs from Google has been featured in the tech giantrsquos Hall of Fame and was included in their Google Top Hunters list last year But he says he is just getting startedldquoBug bounty hunting is just one part of the vast internet There are more serious forms of cybersecurity research that I have set my sights on With blockchain technology becoming the latest thing there is serious scope for vulnerability researchers and I am still educating myselfrdquo