Bug bounty hunter Aditi Singh: How ethical hacking earned her ₹70 lakh, & counting

(January 18, 2022) “One skill you want to master in this day and age, if you want to have an extraordinary life, is the ability to learn rapidly.”

Business coach Tony Robbins inadvertently encapsulated the life of Aditi Singh, a self-taught bug bounty hunter with this quote. What started in 2017 as mere curiosity about cyber security has now led to such a high level of expertise that the Delhi-based ethical hacker received $30,000 (₹22 lakh) in 2021 to detect a flaw in Microsoft’s cloud system. She also earned ₹70 lakh in 2021, just saying. “With no prior knowledge of computer and coding programmes or languages, I was a mere novice exploring possibilities. After spending weeks reading and researching, I grew fascinated and knew I wanted to become a bug bounty hunter,” Aditi shares with Global Indian.

In her zeal to hone her skills, the college dropout devoured YouTube tutorials and content on blogs to gain every ounce of information that she could lay her hands on. “My learnings have made me realise that you don’t need a degree if you are continuously working on improving your skills –  these skills that have made me a bug bounty hunter earning lakhs,” smiles Aditi, who has found bugs in over 60 companies including Paytm, Ethereum, HP, and Mozilla.

The bounty is the bug, for Aditi!

The 21-year-old girl was in the news in 2021 for receiving a handsome bounty from Microsoft for spotting a bug in the cloud system. “I spotted an RCE (remote code execution) bug and informed the tech giant which took two months to check at their end if anybody had downloaded its insecure version. Only after confirming, they realised the security fault in their system,” says the bug hunter, who reveals that the developers should first download a node package manager instead of writing the code as this often leads to an RCE bug.

Born and raised in Delhi by an Anganwadi teacher mother and a clerk father, Singh comes from a humble background. However, it was her love for video games that kept her hooked on to the computer since childhood. “I remember spending so much time on the computer playing video games. Beyond that, I had no interest in it initially,” she says. However, things took a turn for this Notre Dame school student after she moved to Kota to prepare for her medical entrance exams. “I joined the Allen Institute in Kota to prepare. Though I was not inclined to become a doctor, I still wanted to give it a shot. However, destiny had a different plan as I soon started getting interested in computers and ethical hacking,” reveals Aditi.

Coming across an article on the internet, her curiosity was piqued. “The next few months, I lapped up every ounce of information I could find. If the dynamics of it intrigued me, I was equally excited about the kind of money that one makes,” adds the bug bounty hunter.

Her first real triumph came after she hacked into her neighbour’s wifi in Kota. “Months of reading and watching YouTube videos helped me do it, and it piqued my interest in bug bounty hunting,” says the self-taught ethical hacker.

Finding the path she was to charter, Aditi gave up on her parents’ dream of making her a doctor, instead enrolled in a bachelor’s degree in computer application at Indira Gandhi National Open University. Interestingly, she ethically “hacked” her way into her maiden job at MapMyIndia during her first year of graduation. “While going through several platforms, I found some vulnerabilities on MapMyIndia. I reached out to them and reported a bug,” says Aditi. They offered her a job as cybersecurity analyst even without her degree! She worked with them for around three years – with an eagle eye on cloud security, network security, and android security.

Needless today, she dropped out of college, and started working full-time. “I realised that I didn’t need a degree to get a job. I am a living example as I learnt coding and programming languages like Javascript from YouTube and Google,” says the cybersecurity expert.

The cyber world to cipher

While Aditi kept her day job, she continued learning about ethical hacking and bug bounty hunting. Who are bug bounty hunters? “They are mostly certified cybersecurity professionals who crawl the web, and scan systems for bugs or security flaws through which hackers can sneak in, and we alert companies. They are rewarded with cash if they are successful in finding a security hole,” reveals Aditi.

Spotting such bugs isn’t a cakewalk and ethical hackers need to be on top of their game to be eligible for payouts, she avers. “While many companies host bounty programmes asking bug hunters to report any flaws, some aren’t registered with bounty hunting platforms, and one has to individually look them up. But it’s important to inform them before you look for flaws. That’s the thumb rule I follow,” says the veritable bug spotter.

Bounty bug hunting continues

It was in 2020 that Aditi earned her first big bounty of $1,100 after she reported an OTP bypass bug in TikTok’s forgot password section. “It was a few months before TikTok was banned in India. I could change anybody’s password on the application, and this was a flaw that they couldn’t overlook. I earned around ₹82,000 for it,” smiles Aditi.

Her next big bounty hunting came in March 2021 when she found a bug in Facebook’s cloud system wherein, she could hack into employees or developers’ systems. She earned a whopping $7,500 ( ₹5.5 lakh) for the bug. “I later found another bug and got $3,000 for it,” she adds.

But it was with Microsoft that she hit the jackpot after she detected an RCE in the Azure cloud platform in 2021, and became an internet sensation for earning $30,000 (₹22 lakh) for reporting the security issue. “The news went viral. It was like a validation that all these years of hard work was finally paying off,” says Aditi, who quit her job in 2021 to become a full-time bug bounty hunter.

The girl, who has found bugs in 60 companies so far, has also received letters of appreciation from Harvard University, Columbia University, and the University of California among others. “I found bugs in the websites of these universities. Since they don’t pay you like other companies, they send you a letter of appreciation,” adds Aditi.

On what she does with the bounty, the youngster smiles, “I go on trips to the mountains. Apart from this, I buy gadgets or subscribe to hacking tools,” adds Aditi, who uses the money to enhance her skills and talent apart from giving a lump sum to her parents. “I give it to them to invest. They are proud that I am doing great,” adds Singh.

A voracious reader, Aditi loves to curl up with a book when not hunting bugs. “I also love to play video games and travel,” says Singh, who has a younger brother and an older sister. “Our parents have been our biggest support system. They have always encouraged and supported us in our endeavours,” says the girl, who has her eyes on crypto companies next. “Crypto is the future and now I am learning tools that could help me get to the next level. It’s all about evolution and upgrading,” she says.

As an ethical hacker, however, she offers a word of caution, “Learn and then earn. Gain knowledge about ethical hacking first, rather than focussing on money. Keep trying and don’t get demotivated if you don’t make money initially.” And be ethical, inform the company!

Follow Aditi Singh on Linkedin