Bug Hunters’ Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem
August 2023·
,,,,,
Omer Akgul
Taha Eghtesad
Amit Elazari
Omprakash Gnawali
Jens Grossklags
Michelle L. Mazurek
Daniel Votipka
Aron Laszka
Distinguished Paper Award
Abstract
Although researchers have characterized the bug-bounty ecosystem from the point of view of platforms and programs, minimal effort has been made to understand the perspectives of the main workers: bug hunters. To improve bug bounties, it is important to understand hunters’ motivating factors, challenges, and overall benefits. We address this research gap with three studies: identifying key factors through a free listing survey ($n$=56), rating each factor’s importance with a larger-scale factor-rating survey ($n$=159), and conducting semi-structured interviews to uncover details ($n$=24). Of 54 factors that bug hunters listed, we find that rewards and learning opportunities are the most important benefits. Further, we find scope to be the top differentiator between programs. Surprisingly, we find earning reputation to be one of the least important motivators for hunters. Of the challenges we identify, communication problems, such as unresponsiveness and disputes, are the most substantial. We present recommendations to make the bug-bounty ecosystem accommodating to more bug hunters and ultimately increase participation in an underutilized market.
Type
Venue
32nd USENIX Security Symposium (USENIX Security 2023), 2275–2291
Awards
Distinguished Paper Award
USENIX Security 2023 · 2023
less than 5% of accepted papers received this award
Authors
Ph.D. 2026
Taha Eghtesad joined the Applied Artificial Intelligence Lab as a Ph.D. student in Fall 2018 and received his Ph.D.
in 2026 under the supervision of Dr. Aron Laszka. He received a B.S. degree in Computer Engineering, with a minor in
Software Engineering, from Shahid Beheshti University, Tehran, Iran. His research lies at the intersection of
machine learning, game theory, cyber-physical systems, and systems security. In particular, his Ph.D. research
focused on using artificial intelligence and machine learning to make cyber-physical systems more secure.
Associate Professor
Aron Laszka is an Associate Professor in the College of Information Sciences and Technology at the Pennsylvania State University. Previously, he was an Assistant Professor at the University of Houston, a Research Assistant Professor at Vanderbilt University, and a Postdoctoral Scholar at the University of California, Berkeley.
His research interests revolve around artificial intelligence and cyber-physical systems, focusing on machine learning for decision making and optimization, with applications in smart and connected communities, critical infrastructure, and cybersecurity.
His research is funded by the National Science Foundation, the Department of Energy, the Department of Transportation, and other agencies.