The digital gold rush of bounty hunters 2.0

Hackers, now courted by French companies, can access pay levels of up to 400,000 euros per year.

Deal with pirates? For a long time, the monarchs exploited the buccaneers to weaken the enemy rulers. Today, it is with a completely different type of hackers that companies fraternise: more and more companies are calling on hackers to detect the flaws in their computer system. Bounty hunters 2.0 are then paid according to the weaknesses detected. This funny concept, which is called bug bounty , is carried by platforms linking "white hackers" and companies.

The first appeared in the United States in 2012. Soon, most players in the new information and communication technologies (NICT) were seduced, even the most skeptical. Apple, who was slow to get started, has bitten his fingers: in 2016, faced with the refusal of cooperation of the US giant, the FBI buys a security breach to access the locked iPhone of the author of a terrorist attack. Today, Apple practices the bug bounty, like most of the big names in Silicon Valley.

In France, the concept is emulated. Manuel Dorne, better known as Korben, launched the European Bounty Factory bug bounty platform at the end of 2015. The bounty bug, he explains, "complements other cybersecurity approaches , " namely automatic scans identifying basic errors, and cybersecurity audits performed by a limited number of people, typically one or two, who work a few weeks on a given perimeter and report back.

"The company corrects any flaws until the next audit, after six months or a year. Except that in the meantime, there is probably already a new version of the site or application, " says the blogger specializing in computing. With the bug bounty, the company no longer relies on one or two security researchers .