101

I'm writing a resume for a position in computer security software development. Should I include the facts of slightly borderline nature I'm well proud of?

For instance, I've programmed and currently running one of the most elusive and notorious aimbots on a quite popular virtual combat simulation platform - about 10,000 lines of C++ and counting. I also played with a few websites of the "show your achievements" nature - never did any damage, just sort of tricked them with some minor scripting into ranking my (admittedly fictitious) achievements #1 worldwide.

I'm perfectly sure that nothing of this is sueable, but is it worth adding to my resume?

  • 87
    @user75918 however fine that may be, the line between "hacking for my own personal benefit and actively glorifying in my ability to cheat" and "finding and reporting exploits so that people can make software more robust/secure" is not remotely thin. – enderland Aug 22 '17 at 17:48
  • 2
    Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Aug 23 '17 at 23:35
  • 3
    @AndreaLazzarotto If you're applying for infosec, the last thing I want is someone who actively steals and cheat. A White hat? That's a golden found. But a black hat? No, please - go away. If you're proud of cheating, how I would trust you to not insert some backdoor in my software for you to later exploit if you're fired? – T. Sar Aug 25 '17 at 20:01
  • 3
    @AndreaLazzarotto Circumventing anti-cheating mechanisms is illegal per the terms of the DMCA in America and invariably violates the service's EULA/TOS. Simple as that. Ask Marcus Hutchins how his past unscrupulousness is working out for him in the infosec industry right now. Being the best heroin smuggler on the planet does not make one a rockstar candidate for a position in logistics management, or someone companies are going to want to be associated with at all. – Ivan Aug 26 '17 at 0:10
  • 2
    @Ivan, DMCA... Ah right, yeah. I forgot... Americans think everyone lives in the USA. So according to your reasoning, writing a bot to increase Farmville points is equal to drug smuggling. Wow. – Andrea Lazzarotto Aug 26 '17 at 10:49
83
+250

Not on your resume.

People seem to be worked up about this. Aim bot is not allowed on most if not all sites by the terms of services and by blocking them. Aim bot is not criminally illegal that I am aware of. Use can get you a life time ban.

If, during a technical interview, they ask if you have any penetration / avoidance experience you might tell them. You might want to be careful - it’s more of a no than a yes.

I understand and respect that a lot of people don't like the morality of it, but it is relevant experience - former hackers do sometimes get hired by security firms.

A poker bot can be illegal due to the laws enforced by the relevant gambling control board(s). The site may seize your funds based on the terms of service / use contract.

I am getting comments about the morality of aim bots. My answer is not about morality, and I chose to neither give my opinion, nor take part in that discussion. There are other answers that focus on morality. My answer is that most people would consider it immoral, but it is relevant experience.

  • 4
    I don't think you should drop a hint. It would need to be a very specific line and you think you need an edge to get the job. If you think you are good then don't take the risk. – paparazzo Aug 22 '17 at 19:19
  • 28
    Paparazzi, I think your first paragraph after Not on your resume. maybe need a little overwrite, I'm not English native speaker and isn't clear if you are against or in favor. – Juan Carlos Oropeza Aug 22 '17 at 20:01
  • 14
    "I get that a lot of people don't like the morality of it but it is relevant experience." I would hazard a guess that interviewers are also looking to check someone's morality as well as their experience. Very few people want to hire someone with no morals (I'm not saying OP has no morals etc..). – Steve Smith Aug 23 '17 at 13:44
  • 4
    All: comments are intended for the things that you see when you put your cursor in this box - asking for more information or suggesting improvements. Not arguing with each other. Paparazzi you can help by making edits rather than getting into back and forth with people and everyone else can help by focusing comments on the legitimate reasons for comments. – enderland Aug 23 '17 at 15:26
  • 4
    @JuanCarlosOropeza I am a native speaker, and I found it hard to read. I interpret it as "Not on your resume," with the implication that replacing "resume" with something else might change the truth of the sentence. – employee-X Aug 24 '17 at 7:30
323

I'm a gamer and somewhat skilled (white hat) hacker.

If I got that on a resume(the aimbot), I'd burn it and use the ashes to fertilize the poison ivy growing near the office. If I were you, I'd list any white hat achievements, if any that you have. If you have none, then it's time for some, because destructive hacks (and yes, aimbots are destructive) do not get you anything but scorn in the professional world.

It's not "controversial" it's unprofessional, unethical, and indicative of low character, and borderline illegal. Put the positive items on, build a sniffer to root out bots, and patches to cover vulnerabilities. THAT shows talent. Anyone can break something, it takes a special kind of craft and intelligence to guard against it.

  • 2
    Comments are not for extended discussion; this conversation has been moved to chat. – Monica Cellio Aug 24 '17 at 22:10
  • 10
    Anyone can break something, it takes a special kind of craft and intelligence to guard against it. So true! I have to constantly update my moderation scripts to autoban spammers.Granted spamming isn't as complicated as an aimbot; and sure it's fun to break stuff, but if you're sinking that much time and energy, please try to use it for something good. – Bahrom Aug 25 '17 at 17:54
  • 2
    @Tim - because no jurisdiction, in any country, ever, has had anything that even remotely criminalises cheating in video games, let alone writing code that lets you do it. "Anyone can break something, it takes a special kind of craft and intelligence to guard against it." - tell Alan Turing and the people who broke read hacked the Nazi enigma codes. – Fraser Aug 25 '17 at 19:55
  • 4
    @Fraser Bypassing anti-cheat mechanisms is illegal under the terms of the DMCA in America. Riot Games and Blizzard have both successfully brought and won lawsuits against bot developers. – Ivan Aug 25 '17 at 23:16
  • 1
    So much yes in this answer :) – Jeff.Clark Aug 26 '17 at 17:09
51
+250

No, you shouldn't.

It's an impressive accomplishment, to be sure. Very few people in the world write successful aimbots. But it is not experience that's particularly relevant to many jobs - even in the games industry. It does show initiative and a self-starter mentality, but it also shows some disregard for the rules - if you're willing to violate the terms of a EULA (by a lot), how can I be sure you won't treat the employee handbook the same way? It brings up more questions about you than it answers, and they're not questions that are likely to make you look good.

I definitely wouldn't mark it against you immediately, there are great reasons for wanting to write aimbots - such as "because it was a really difficult and interesting problem that I didn't know how to solve". But you shouldn't necessarily rely on all your interviewers being that thoughtful - you can already see a few kneejerk answers which recoil at the very mention.

So - no. Because ultimately you will be risking more than you might gain from putting it on the resume.

  • 3
    Very few people in the world write successful aimbots not because they are hard to make, but because they are a cheat. I know several developers with the skillset needed to create something like that but with zero interest in making a tool for cheaters. – T. Sar Aug 24 '17 at 15:40
  • @T.Sar: I think emphasis should be on successful. – Zaibis Aug 25 '17 at 9:59
  • 3
    @T.Sar Everything is easy if you never try. If we are to take OP at face value, it means OP has tried and succeeded in complex problem space that these several developers you know haven't. That's not for nothing - it's "not hard" to say you have the skills to produce internet-scale webservices or write a new database, it is entirely another to actually be able to show that you succeeded. It is enough to say that it's not a problem that interests the developers you know (there are many problems like that, i'm sure), but that doesn't say anything about the difficulty of the problem. – Knetic Aug 25 '17 at 19:51
  • 3
    @Knetic When I was younger, I accompanied the development of several "Hacks" and "Exploits", ranging from Counter Strike to MMO Emulators. The people working on those always had two things on common - they didn't want to do the thing the right way (paying for a subscription/training), and grossly overestimated their skills. One of the main devs for a famous lineage 2 server emulator couldn't explain the difference between "protected and "private" in Java Classes. I have serious doubts about anyone that touts their skills as "amazing" on this field. – T. Sar Aug 25 '17 at 19:58
25

Unless you wish to work for a company that is borderline on legality then this is a very good way to never be hired. You want to be hire-able to a favorable outcome for the company. Getting someone who is good at doing borderline illegal activity is probably not the best move.

If you want to call out security skills related to the abilities this developed in you then do that, but don't publicize borderline illegal activity as a reason to be hired. Also, you want to be careful there too as if you do get prosecuted your likelihood of job security drastically goes down from there.

  • I'm enjoying all this "borderline illegal" business. Presumably here "borderline" is being used as a substitute for "not". Perhaps Kevin Mitnick should not be his background as a successful hacker when touting for work penetration testing? – bye Aug 27 '17 at 21:57
  • 1
    @DrEval Borderline is a way to say it may be prosecutable in some countries, but we are offering legal advice as this site is not made for that. Maybe there is a better way to say it, but the ethical/legal line is being ridden here which is the point. – mutt Aug 28 '17 at 0:40
  • Borderline illegal has nothing to do with morality, nor that it's illegal in some countries (Alcohol sales aren't borderline illegal just because some countries outlaw it, nor is there anything "borderline illegal" about legalised prostitution in countries such as Holland just because some people don't like it). I'd be surprised if any countries outlaw people writing code to help them cheat at games. Warnings should probably stick to pointing out potential differences of opinion as to the right/wrongness of such code rather than attempt to provide misguided and incorrect legal advice. – bye Aug 28 '17 at 22:37
  • Laws are made every day on perceived morality, so to say illegal has nothing to do with morality doesn't make sense. Killing would be "borderline illegal" if it was an accident as sometimes you may be innocent in self defense and sometimes it would still be manslaughter. The advice to "avoid" things that appear borderline by broadcasting yourself like "I'm a killer, but I was found in the right" paints one in a certain light. Thus it's scoped to "paint in a certain light" someone who is willing to "hack other people's code for play". It matters how it is mentioned regardless of legality. – mutt Aug 28 '17 at 22:49
  • Also, I'm not the only answer that has utilized the term "borderline illegal". – mutt Aug 28 '17 at 22:50
24

You should include this on your resume. I say this both as someone who wrote a similar bot when I was in college, and as someone who regularly does interviews. Regardless of how anyone feels about video games or cheating, there are countless positives here and you'd be foolish to ignore them. Focus on those positives.

When I interview people, particularly people without a lot of experience, I want to know that they can do more than just study for, and pass exams. I also want someone who enjoys technology, who will learn on their own, who can take on large tasks.

Your project can show me ALL OF THAT. And if you don't have a lot of experience, there might not be anything else you can point to.

I wouldn't recommend saying 'I wrote an aimbot' and I don't know the details of your project (though I'm sure there are some really interesting things you could say about it)...but let me use mine as an example:

MyAwesomeProgram
(2012-2014)

  • Developed and maintained a large commercial C# application that was responsible for the automation of repetitive tasks within the Windows OS via WIN32 API calls.
  • Utilized various machine learning and artificial intelligence techniques to achieve a high level of autonomy with minimal human interaction.
  • Released as an open-source project in 2013 where I continued to coordinate the efforts of others on the project.
  • Over 500 sales and free 150,000 downloads

Oh sure, it's just a 'bot' to cheat at a game. But, aside from that, it's also all of the things many companies are looking for. If I read something like this, you're demonstrating so many of the things I look for in an applicant and it gives me all sorts of probing questions that will let you demonstrate your level of knowledge.

Unless you have really impressive other things to fill out your resume, I would include it.

  • 29
    Be prepared to be asked what YourAwesomeProgram does in an interview. And then you are back to all of the problems previously mentioned. (Namely, do they want someone with the mindset of a cheater in their team.) – skymningen Aug 23 '17 at 6:19
  • 12
    Any interviewer worth their salt will ask you what this Awesome Program actually does. And they're then going to wonder why you went to such lengths to hide its nature. If they're not very tech-savvy they're going to assume this is much shadier than it is. You touch on an interesting point that for a new graduate this might be worth including but you should expand on that. Right now your answer is pretty long but lacking substance, you're not addressing the positives and negatives explicitly. – Lilienthal Aug 23 '17 at 9:58
  • 1
    You also want someone with sound judgement. If they find out the program was a hack for a video game, you're in trouble. Security professionals would have interest in trying to find vulnerabilities. They wouldn't, on the other hand, deem it appropriate to publicly release said vulnerability for malicious purposes. You've already admitted to having a large number of free downloads; if they find out what the downloads are for; it can look really bad. – JMac Aug 23 '17 at 10:58
  • 6
    @skymningen - 'It's an add-on for a popular game called XYZ, maybe you've heard of it? It helps automate repetitive parts of the game for the user. In the beginning I wanted to play the game, but I quickly found I enjoyed the technical aspects and challenges of the program more than playing. For example, I implemented a genetic algorithm to optimize the blah blah blah'. Lots of complex add-ons are not in violation of the TOS of a game anyway. – Rob P. Aug 23 '17 at 15:58
  • 2
    @RobP. But you're not backing up why it doesn't matter and given how your argument runs counter to most of the answers here you should probably do that. No one is saying that OP's achievements aren't great from a technical perspective but they are at best morally and ethically gray. Common sense would say those are things to avoid bringing up at in a work context. – Lilienthal Aug 24 '17 at 6:41
5

Although there are cases of hackers being hired by security companies or governement agencies (the latter being by definition very few communicated), I think this only applies to the ones who are actually considered among the best in their field, when they're not geniuses.

I doubt that cheating a game (how does that even remotely relate to security?) or tricking a website by using "minor scripting" would get you recognized as such, and surely won't get you any job. There are so many positive ways to use your skills, if you want to tell about something in your resume, maybe you should pick one of these and write 10000 lines of code for it.

The simple fact you're asking the question and use the word "controversial", which is an euphemism for the least, shows I think you already know the answer.

  • 8
    I doubt that cheating a game (how does that even remotely relate to security?): In order to create the aimbot, and remain undetected, requires being able to exploit vulnerabilities in the software in some way. – Fodder Aug 22 '17 at 22:29
  • 1
    @Fodder Script kiddies can exploit weaknesses given the tools that others write, so it's not that difficult. To write code to exploit that is not that difficult, either, given that there are so many known exploits to look for. You just have to know where to look to get the information to write the tool. – SliderBlackrose Aug 23 '17 at 14:19
3

Do it!

But... do it right. And, like everything else in your resume, only do it if it will be beneficial.

It all depends on how you pitch it. For instance, don't say, "I wrote an aimbot". (Unless you expect the hiring staff to not comprehend an aimbot, or at least the controversial aspect of that.) Look at how much negative responses showed up on this Stack Exchange question. You want to avoid that.

Instead: You could claim that you wrote a program that assists people with a handicap (e.g., being human and inferior to machines) so that they could use a mouse more effectively. People using this popular program have been more successful... etc. etc.

Okay, so I confess: I was just having a bit of fun with that last paragraph. Really, don't actually say that on your resume. The problem with that paragraph is that it seems too misleading (suggesting being helpful with disabilities). Being detected as an intentional misleader will not help your cause. However, speaking seriously again, there are ways to pitch things by using ethical, moral, honest descriptions that will help your cause.

As a person who had done some hiring and assisted with some more hiring, I find that a lot of resumes fail to describe activity in a useful way. I'm talking about spin, here. I'm not talking about dishonesty. Heaven forbid (literally).

As an example, I'm involved with IT. A lot of young people want to get into the field, with little background in the computer field. I'd like to see someone who demonstrates an understanding of business goals, including the goals of my business.

Examples:

  • If you worked at a fast food restaurant, I don't want to see: "Made hamburgers faster than everyone else." I'm not in the hamburger business. What do I care?
    • I want to see: "Reduced required time for product assembly, resulting in product being hand-delivered more quickly and customer satisfaction going up."
  • If you worked at a car wash, I don't want to see: "Rinsed cars with fewer errors per week than co-workers."
    • I want to see: Cleaned equipment with superior levels of adhering to company standards

I'm not trying to promote using unfamiliar vocabulary to impress people, nor am I suggesting that you try try to twist facts in a way that is only slightly misleading. If you see what I wrote, it is an absolutely honest way of describing what happened. However, it describes things in a way that demonstrates that when my boss tells me to make hamburgers, I don't just get so focused on my experience that I describe things from my perspective. Instead, I acknowledge the company's perspective by describing things in a way that might sound a bit more useful to the company I want to work for.

Does the company I want to work for have customers? Do they care about quality? Do they care about working efficiently (faster, or with fewer resources)? Describe how your activity helped to achieve some good goals that will be commonly appreciated.

If you can, describe your efforts in a way that applies to the company you want to work for. If that doesn't seem possible (because the company you want to work for is a very different type of company), at least show that you can explain things in a way that sounds appealing to a manager. At least then I will know that you can understand a manager's perspective, and you'll be head and shoulders above others who don't seem to understand what a manager would want to see.

For instance, I've programmed and currently running one of the most elusive and notorious aimbots on a quite popular virtual combat simulation platform - about 10,000 lines of C++ and counting

"I successfully created and released a working program that enhances the experience of other popular software. My project includes thousands of lines of computer code, and continues to work well despite evolving challenges that result from how the software is used on various networks."

I also played with a few websites of the "show your achievements" nature - never did any damage, just sort of tricked them with some minor scripting into ranking my (admittedly fictitious) achievements #1 worldwide.

No, don't say that. What you did may be a crime. Even if it wasn't, it sounds like something that many people will think was criminal. Don't say that.

"I identified the limits of what can be supported by some online databases, and through my own private exploration I became familiar with some identified real-world vulnerabilities on actual publicly deployed websites."

As a general rule, you should be prepared to discuss anything on your resume during your interview. Manipulating public competition, in the ways you describe, is not generally viewed as admirable. Before considering your resume to be finalized, put some thought into what can be safe to discuss, and what might not be. If something isn't beneficial to you to discuss, determine a sensible reason why you might want to limit such a discussion. ("Because of concerns of potential misuse, I'm limiting some details from widespread public disclosure. However, if I do get hired, I will be able to verify every statement I provided.")

  • Very good points overall. Surprised with so few votes. – Neolisk Aug 25 '17 at 14:32
  • " Cleaned equipment with superior levels of adhering to company standards" ??? – NPSF3000 Aug 25 '17 at 19:46
  • 1
    "a working program that enhances the experience of other popular software" That sounds super-evasive (why, e.g., would somebody say "other popular software" rather than naming the software unless they were trying to hide something?) and is sure to invite follow-up questions about what exactly is going on. – David Richerby Aug 27 '17 at 12:30
1

Maybe in a portfolio. But not in the resume.

If your code is open source you could publish it on GitHub and provide your GitHub username in the resume.

-4

Of course! You should not just throw away your valuable C++ experience like that!

What you have been doing is called: "writing accessibility software, assisting impaired people in using real-time online services". This is both legal and perfectly morally acceptable (unless you have used it yourself, or personally encouraged non-impaired people to violate game's TOS).

Don't delve too deeply in exact details, there is no reason to explain your employers, that this particular software have been mainly used by bunch of as@$#es to cheat in a video game. Do not link to source code and especially do not mention the name of aimbot software. In such cases it is customary to refer to vague "non-disclosure agreement" and otherwise weasel your way out of telling exact details. Just let them know, that you have written modestly sized software in C++, and let your skills be a sufficient testament to the truth of such claims.

  • 3
    "This is both legal and perfectly morally acceptable" Depends on what he did. Selling hacks may infact break laws as well as just morality. Even "accessibility software, assisting impaired people in using real-time online services" would make me ask more questions. You could have helped the "monetarily impaired" access "real-time online services" by stealing banking information. Using extremely obscure wording makes it look like you have something to hide. If they catch a wiff, they might just chase after it. – JMac Aug 24 '17 at 18:57
  • @JMac I am giving question's author a benefit of doubt, and assume, that he would not consider boasting about selling his software or otherwise profiting from described activities (which is very dodgy in most jurisdictions). As for concealing exact details, — simply being quiet about his past pet projects, won't do him any better: if paranoid employers manage to dig this out, they can always use anything as excuse to get back at him. Better to benefit in short term and get a chance to build good impression about himself. In long term "cheating in videogames" is laughably inconsequential. – user1643723 Aug 24 '17 at 23:50
  • 5
    Calling an aimbot "accessibility software for the impaired" is, let's say, disingenuous. – Russell Borogove Aug 26 '17 at 16:22
  • Calling an aimbot morally acceptable is a rather creative use of that term. Aimbots are enough to make most gamers see red. – Retired Codger Sep 28 '17 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.