Shortly after Christmas, 2011, Ruby Nealon sold the Nintendo Wii games console his mother had bought him so he could fund a British Open University course.
He was 11 and it was the start of his unconventional education as a computer prodigy, which led him to drop out of school and start a full-time degree at 14. Two years later, in 2016, in the second year of his computer science degree, he made international news for hacking into a gaming platform.
![The guy hunting for hackers might be just 10 years old.](/web/20170424071905im_/http://www.theage.com.au/content/dam/images/g/v/7/7/a/i/image.related.articleLeadwide.620x349.gvic85.png/1492646780898.jpg)
The incident caught the attention of the cyber security world and he was soon approached by the chief executive of a US company called HackerOne, which specialises in breaking into the computer systems of major companies, including Uber, Facebook, Google, Dyson, Microsoft and MasterCard.
It does this through "bug bounty" programs, where companies invite hackers to attack them to find critical problems in their software in return for a reward.
"The problems can vary from small to large issues: the key thing is that, regardless of the impact they would have, they're caught before they can be used maliciously," said Jack Whitton, a security researcher at Facebook and former bounty hunter.
Nealon is one of 100,000 hackers in HackerOne's network of self-employed security experts, the youngest of whom is 10 years old. They are paid monetary rewards from a few hundred to tens of thousands of dollars, depending on the severity of their findings.
Within months of joining HackerOne, Nealon had been paid $50,000. One of his biggest payouts was $13,000 from Airbnb, which he earned in a day for finding multiple bugs that could have let a cyber criminal take over someone else's account, charge their bookings to other businesses, and set up an account as an underage person.
"This is just in my spare time," he said. "I don't consider bug bounties work. Most of the hacking I do is a bit of a game. I see the money as an added bonus."
Marten Mickos, chief executive of HackerOne, said: "The hackers we work with are young, skilled, and for them the internet is reality." He added that they could think creatively and spot problems traditional security professionals might miss.
"Even the Department of Defence and the Pentagon [both HackerOne customers], some of the strongest organisations with the most powerful weapons, cannot see their own flaws," he said.
"You'll always need the objective, outside view, because most people are blind to their own typos."
HackerOne, founded in 2012, is growing rapidly. It has increased its customers from 300 last year to 800. While the company does not publish its earnings, it takes a 17 per cent cut from each bounty and has facilitated about $15 million in rewards to date, about half of which were awarded in 2016.
This month it opened an international office in London.
The Silicon Valley company's move to Britain follows that of one of its main competitors, Synack, a company founded by former National Security Agency employees that connects its customers with a select group of hackers.
"About a year ago, people were wary of the term 'hacker', because there was such a negative connotation associated with it," said Jay Kaplan, chief executive at Synack. "It's moving fast to leverage bug bounty programs and trust hackers."
Although British businesses have been slower to adopt the service than their US counterparts, HackerOne says there is a wealth of untapped talent.
"There's something out of sync in the UK," said Alex Rice, co-founder and chief technology officer of HackerOne. "On the one hand you have an amazing breadth of top hackers here, but organisations haven't kept pace with the talent. There's a bit of a missed opportunity with that much raw talent not being fulfilled in organisations."
A perception shift should ultimately benefit consumers, business, governments and the hackers, he said.
"We're basically trying to clean up the internet and save people's data," said Sean Roesner, another HackerOne bounty hunter.
"It's a crazy world out there and I've seen some serious vulnerabilities that I couldn't believe existed. You wonder what else is out there – but not everyone has a bug bounty so you can't test them."
Roesner recently discovered a set of problems in a number of firms' computers that could have let cyber criminals steal the personal information of hundreds of millions of people. "I could have taken up to 282m people's details including their emails, date of birth, names, some phone numbers and passwords. Because I got to it first and the companies fixed the problems, I saved people's data."
The Sunday Telegraph