Can I major in computer science/engineering?

Computer Hacking (security): I have found a major vulnerabilty in a major website. How can i turn this into making my profit or atleast my employment?

• I am a final year engineering student about to graduate. Recently I have found a major vulnerability in a major website which if exploited can lead to significant loss to the government. How can i legally turn this into making my profit or at least my employment (I am looking for placement into a nice company)? If i email to any mid level employee into the company, chances are that they will notice and patch the vulnerability without a hint to the higher authorities and i will get a mere thank you. I want to know that is there a LEGAL way that i can possibly show the company the vulnerability and ask for my compensation?

• Answer:

  I'm not sure if the vulnerability is a government site or a commercial site so I'm going to be a bit generic in my answer. First of all many major websites have vulnerability reward programs that will pay you for vulnerabilities. You may be able to get a cash reward by reporting your find to the website operators. For example of such a program see Google's Vulnerability Reward Program at http://www.google.com/about/appsecurity/reward-program/. Some organisations that run vulnerability reward programs also publicly credit reporters for their efforts which can be useful to your career (see http://www.google.com/about/appsecurity/hall-of-fame/) or even invite you to interview for their security team. If they don't have a formal program they might have an informal program and be willing to reward you or publicly credit you for disclosing the vulnerability. Make sure you do not require compensation before you disclose your information, this could be seen as extortion and might get you in trouble. Another way to potentially profit from a vulnerability discovery is to contact a security broker like the Zero Day Initiative (http://www.zerodayinitiative.com/) that will pay money for security vulnerabilities. These companies are usually less focused on web security and more focused on native code applications. The http://blog.nibblesec.org/2011/10/no-more-free-bugs-initiatives.html has a list of resources for how you can get paid for security vulnerabilities. Finally if none of these options appeal to you there's always the public disclosure route (whether you take the "Full Disclosure" or "Responsible Disclosure) this will ensure that there's a public record of your find which you can point people to on your resume, blog, etc. EDIT (after reading the question again, I'll more directly answer here): It's generally not possible to disclose a bug and ensure that you get paid. Holding out for compensation before disclosure is legally risky and likely to build bad will with the affected organisation. Generally, in the absence of an organised vulnerability reward program the best approach is to ask around, see if you can find a senior security person to contact directly. Reach out to them and share all the details with them and mention to them that you'd like to be compensated. They may compensate you or they may not, there's not a lot you can do. Otherwise you'll either need to find someone else who will pay you for the vulnerability (in an ethical and legal way) or be happy with a thank you and maybe a little public recognition.