Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

I Was Almost a Cybercriminal

Sergey Ichtchenko

CommunityTalks22 minBeginnerOpen on YouTube ↗

Where

Talks
Disobey 2024

Duration

22 min

Traces how a teen's app vulnerability report turned into a security career, and what steers young hackers away from crime.

Summary

The talk asks why some young people drift into cybercrime and how communities, parents and companies can steer them elsewhere. The speaker belongs to Test Sér, a Finnish community where young people practise hacking and programming as a legal hobby. Working with a national cybercrime prevention campaign, the group surveyed 36 members. Responses pointed to parents, video games and game modding as common entry points, and showed that members were far from the lonely-nerd stereotype. Reasons for misbehaviour clustered around the appeal of forbidden activity, showing off to peers, a belief in anonymity and victimless crime, and the lure of free perks.

The central story is the speaker's own. As a teenager, they found that a mobile app's compiled JavaScript could be edited to bypass its activation check, unlocking free in-app rewards. They reported the flaw by email, were thanked with a small reward, and the vendor fixed it. The talk contrasts that outcome with punishment, which the speaker argues could easily have pushed them toward crime.

Practical advice follows for each audience. Parents are encouraged to redirect a child's skills toward bug bounties, capture-the-flag events and their own example. Companies should accept reports graciously, reward finders, publish a security.txt contact file and run training programmes to ease the skills shortage. Young people are pointed to communities, online learning resources and mental health support. Survey respondents also said they wanted clearer guidance on legal boundaries and easier ways to report issues.

Related talks