Ethical Hacking

              

“A 15-year-old Canadian hacker launches a massive denial-of-service attack, bringing down the websites of Amazon, CNN, eBay, and Yahoo, causing millions of dollars in damages.”

That headline appeared on February 7, 2000, in reference to a distributed denial-of-service attack (DDoS) carried out by a teenage hacker who went by the handle Mafiaboy.

You’ve probably seen similar headlines in the media over the years.

Now imagine this:

A lone teenage hacker sits in their bedroom or their parents’ basement in the dark. In front of them sits a computer screen and a keyboard. They sit there diligently typing away while wearing a dark hoodie. The glow of the computer screen reflects off their face as they carry out their nefarious deeds, one keystroke at a time.

This is the stereotype that Hollywood has painted of the typical hacker.

But what if I told you that there are different types of hackers and that the Hollywood stereotype doesn’t always hold true?

Hackers are often described as falling into three broad categories based on their intentions and whether they have authorization to access a system: white hats, gray hats, and black hats.

The terminology comes from the old Western movies many of us grew up watching on television. The good guys traditionally wore white cowboy hats, while the bad guys and outlaws wore black. Gray hats occupy the area somewhere in between a vigilante of sorts.

White Hat Hackers

The White Hat Hacker stays on the right side of the law. They test or access computer systems that they either:

A. Own, or

B. Have explicit authorization or written permission to access and test.

White hats are also commonly known as ethical hackers.

Career paths associated with ethical hacking and cybersecurity include security researchers, penetration testers, cyber incident responders, and malware analysts.

Security Researchers and Bug Bounty Hunters

Security researchers often participate in something called a bug bounty program, sometimes referred to as bug bounty hunting.

Many major companies operate bug bounty programs. Basically, these programs allow authorized security researchers to look for security vulnerabilities in a company’s software, website, applications, or other systems.

When a researcher discovers a vulnerability, they report it to the company according to the rules of the program and provide information about the vulnerability and, when appropriate, how it can be reproduced or exploited.

If the company verifies the vulnerability, the researcher may receive a monetary reward based on factors such as the severity and impact of the vulnerability.

The theory behind bug bounty programs is simple: it’s better for a company to have an authorized security researcher discover a vulnerability and report it so the company can fix it than for a malicious hacker to discover it first and use it to cause real damage.

Penetration Testers

Next, we have the penetration tester(no, not that kind, get your mind out of the gutter.), often called a pentester.

Some companies hire penetration testers to test their software, networks, applications, and other systems by conducting controlled and authorized security tests. The goal is to find weaknesses before malicious hackers can exploit them.

A penetration test is essentially a controlled attack performed with permission.

The penetration tester attempts to identify vulnerabilities and demonstrate what an attacker might be able to accomplish if those vulnerabilities were exploited. The findings are then documented in a report so the organization can take steps to improve its security.

Again, the basic principle is the same:

It’s better for an authorized ethical hacker to discover and report a vulnerability so it can be fixed than for a black hat to discover it first and exploit it.

Cyber Incident Responders

Another important cybersecurity career path is cyber incident response.

A cyber incident responder investigates, contains, and helps resolve security breaches and cyberattacks within an organization’s network.

Think of the cyber incident responder as a CSI investigator in cyberspace.

When a data breach or cyberattack occurs, an incident responder may be responsible for several things, including:

• Triage and detection: Analyzing security alerts, system logs, and other evidence to determine whether an attack is occurring and how serious it is.

• Containment and eradication: Isolating affected systems, blocking malicious activity, and removing malware or other threats to prevent the attack from spreading.

• Recovery: Helping restore compromised systems and data safely and returning them to normal operation.

• Documentation and reporting: Recording indicators of compromise (IoCs), documenting what happened, and producing detailed after-action reports.

  
  

Incident responders are essentially the people who get called when something has gone seriously sideways and someone needs to figure out what happened, how it happened, how to stop it, and how to prevent it from happening again.

Malware Analysts

The final cybersecurity career path I want to discuss is malware analysis.

Malware is a major problem in today’s world. Many security incidents and data breaches either begin with or involve malicious software.

Malware is software designed to perform malicious actions, such as damaging systems, disrupting operations, stealing information, or providing unauthorized access.

Examples of malware include viruses, worms, ransomware, spyware, and trojans.

This is where malware analysts come in.

A malware analyst specializes in examining malicious software to determine what it does, how it works, how it spreads, and how it can be detected or stopped.

Malware analysts may use techniques such as static analysis, dynamic analysis, debugging, and reverse engineering to understand malicious code.

Once security professionals understand how a piece of malware works, they can develop better defenses, detection methods, security controls, and patches or mitigations to help prevent similar attacks in the future.

Gray Hat Hackers

Now let’s talk about the Gray Hat Hacker.

A gray hat is somewhat similar to a white hat in that they may discover security vulnerabilities without necessarily intending to cause harm. They may even report those vulnerabilities to the affected company.

Here’s where they differ from a white hat:

They may not have permission to access or test the system in the first place.

That distinction is extremely important.

A gray hat might discover a vulnerability while testing a system out of curiosity or while exploring a target without authorization. Even if they have good intentions and do not damage anything, accessing a computer system without permission can still be illegal.

This is why the gray hat occupies such a complicated position.

For example, imagine a security researcher discovers a serious vulnerability in a company’s website without having permission to test it. The researcher informs the company and gives them an opportunity to fix the problem.

That may sound helpful—and it potentially is—but the researcher still accessed the system without authorization.

Another controversial situation occurs when a researcher reports a vulnerability and the company refuses to fix it or takes an extremely long time to address it.

The researcher may eventually decide to publicly disclose information about the vulnerability in an attempt to pressure the company into fixing it.

This is where the distinction between responsible disclosure and full disclosure becomes important.

Responsible disclosure generally means giving the affected organization an opportunity to investigate and fix a vulnerability before publicly releasing detailed information about it. Many bug bounty programs establish specific rules and timelines for this process.

Full disclosure generally means publicly releasing information about a vulnerability, potentially including enough technical information for others to reproduce or exploit it.

There are legitimate arguments on both sides of the disclosure debate.

Researchers may believe that public disclosure is necessary to protect users when a company refuses to address a serious vulnerability. Companies, on the other hand, may argue that public disclosure can put their customers at risk before adequate defenses are available.

Regardless of the argument, there is an important distinction between a gray hat and a black hat:

A gray hat may access a system without authorization, but they generally do not have the malicious intent associated with a black hat. Their intent is rather motivated by curiosity. 

That does not necessarily make their actions legal or harmless.

Black Hat Hackers

Finally, we have the Black Hat Hacker.

Black hats are malicious hackers who intentionally access systems without authorization, usually for personal gain, espionage, disruption, theft, or some other malicious purpose.

Whether through sophisticated attacks or reckless exploitation, black hats generally have little concern for the damage their actions may cause.

A black hat might develop or deploy malware such as ransomware, banking trojans, spyware, or worms—not to study and understand them, but to use them against victims.

Two major motivations behind cybercrime are financial gain and data theft.

Criminal hackers may steal personal information, financial information, intellectual property, passwords, or other valuable data. They may also use ransomware or other forms of extortion to demand money from individuals, businesses, and organizations.

There are many different techniques black hats use to accomplish these goals, and I’ll go into more detail about those techniques, as well as what you can do to protect yourself and your business, in future posts.

The Future of Ethical Hacking

With the rapid development of artificial intelligence (AI), the cybersecurity landscape will continue to become even more complex and nuanced.

Both defenders and attackers are already exploring ways to use AI to their advantage, and this is a subject I’ll explore in more detail in future posts.

But one thing probably won’t change:

The constant cat-and-mouse game between attackers and defenders.

Black hats will continue to look for ways to exploit computer systems—and, just as importantly, people’s trust.

White hats will continue to defend those systems, investigate attacks, educate users, discover vulnerabilities, and responsibly disclose security weaknesses so companies and organizations can close those security holes.

The technology will change.

The tools will change.

The techniques will change.

But the fundamental battle will remain the same:

Attackers will always look for weaknesses. Defenders will always look for ways to stop them.

And that is what makes cybersecurity so damn fascinating...

Harry,You're A Wizard

(Or why I learned to code and why you should too)

"Harry — yer a wizard." (Hagrid, Harry Potter & The Sorcerer's Stone)

"The computer programmer is a creator of universes for which he alone is responsible. Universes of virtually unlimited complexity can be created in the form of computer programs." (Joseph Weizenbaum)

I've always had a fascination with computers starting at an early age, as I've mentioned in a previous post. While it all started off with a childhood fascination with computer games, it evolved into a fascination with figuring out how computers worked, and how I could make them do whatever I wanted them to do. One fun fact about me is that I've always been an avid reader. I remember staying up many late nights reading fantasy novels (still one of my favorite genres, btw) when I was a kid. I always enjoyed novels with wizards, dragons, and other magic users. The wizard — the powerful magic user that could bend reality with their spells — was never the most physically powerful character, but what they lacked in physical strength they made up for in raw intellect and power. They had an avid curiosity for how the universe worked, and the ability to control powerful and seemingly invisible forces that many people did not understand. To me, programming or coding growing up was like magic, and it kind of still is.

My first experience with computer programming was way back in elementary school using a programming language called LOGO. At the time I didn't realize that I was actually writing a real program on a computer. Basically, LOGO allowed someone to input commands. The program would then process each of those commands and move a small turtle around the screen accordingly, leaving a line in its wake. You could use this "turtle" (I use the quotes because the turtle was basically a small triangle) to make simple art on the screen. This is how an algorithm works at a basic level. An algorithm is essentially a "recipe" that makes up a computer program — it tells the computer what to do using a set of instructions. At the time it was fun and novel, but something that I wrote off. It wasn't a computer game, and games were king to me at that time. Only later would I realize just how powerful and useful being able to move that tiny little turtle around a screen would become.

In my late teens, I decided to take a certification course (sounds fancy, doesn't it?) for a now mostly defunct object-oriented and event-driven programming language called Visual Basic. (I'll talk more about different programming types, such as object-oriented, in a future post.) Visual Basic is just what it sounds like — visual and basic. However, when I took the certification course in the early-to-mid '90s, it was a somewhat popular programming language, especially for GUIs (Graphical User Interfaces) for Windows. I remember only using it for that one course, then just tinkering around with it a bit afterward. I would read a few books on Visual Basic, but in the end I never really found a personal use for it. It was a language I liked to describe as one that made things look pretty. It was like paint on a car — it sure makes the car look good, but it doesn't add anything to the performance, nor is it required to make the car run. Visual Basic does a little bit more than that, but you get the gist of it.

Jump to a few years later. I discovered a programming language that was included with early versions of the Windows operating system — QBasic. It was first introduced in Windows 95 and retired after Windows 2000. This would be when I first started taking coding more seriously. My first project while learning QBasic was for the chess tournaments that we ran at my high school. The goal was to write a program that would display a tournament bracket that could be easily filled out and updated by the tournament coordinator as needed, with the ability to print and save results for later perusal. Seems easy, right? Oh, how wrong I was.

You see, in college, when you take an introduction to programming course, they teach you how to design a program. You first need to break the problem down into smaller pieces, then plan the program — write the "recipe" for what you want it to do — on paper or in a word processor before you even think about opening an editor and writing any code. This is called pseudocode. This is where I went wrong with the chess bracket program. For the longest time I would jump in with both feet and just start writing code on the fly — skip the design phase entirely. This would bite me over and over again until I finally forced myself to design my programs first before typing a single line of code, which paid off greatly in the long run. As for that chess project? It was left unfinished. I did, however, leave it with a much deeper understanding of QBasic.

In college (my first attempt at getting a bachelor's in computer science) I learned a programming language known as C++. Almost anyone who has written a program in C++ will tell you that learning it as one of your first languages is like getting thrown in the deep end of the pool. Looking back, I'm glad I learned C++ early on — it made picking up other languages much easier. With C++ you encounter some pretty difficult concepts, such as pointers, memory allocation, and scope. While not as difficult as assembly language, it still took a lot of time reading, highlighting, and bookmarking pages of thick tomes — not unlike a wizard poring over an arcane magical tome. I have yet to fully master C++, but I know enough to get by. The next language I would invest a substantial amount of time in was Python, during my second stint in college. Python should have been the first language I was introduced to — it is easy to learn, versatile, and these days is the go-to language for most introductory programming courses at the college level. It's probably the first language I would suggest to anyone curious about getting into programming. (I'll explain the difference between a scripting language and a compiled language in a later post.)

Here's the thing about computers and software. Most people who use a computer use one that runs one of three operating systems, or OS. If you're working with a PC, it's Windows or Linux. If you own a Mac, it's macOS. Software is the brains of the computer — it tells the computer what to do and turns it into a useful tool. That OS on your computer? That's an elaborate piece of software called system software. Without an OS, a computer is basically an overpriced paperweight with flashing lights.

Everyone knows — or should — that the world is run by computers. Everything from your car to streetlights to your smart washing machine falls under what is known as the Internet of Things, or "IoT," and all of these things have one thing in common: they all run on code.

As you may have noticed from the hobbies I mentioned in my first post, Jiu Jitsu, Chess, and Ethical Hacking — which involves programming — are all complex systems. I seek mastery over complex systems as a way of regaining a sense of control. Programming in this day and age is a very versatile and powerful skill to have.

The world is digitally connected, and programming gives you a lens through which to understand it that not a lot of people have. Knowing that you can alter the world around you and create tools that can greatly impact how things run is empowering. To a non-technical individual, it all seems like magic.

Having the ability to read and write code means you can build your own tools when existing software isn't sufficient for what you need. It also means you can examine a program's source code and sometimes modify it directly, so you don't have to start from scratch. After all — if you want something done right, then you do it yourself.

Programming requires both creativity and scientific thinking. Some call it art; some call it science. In my humble opinion, it's a combination of both — it's where science meets art. As Joseph Weizenbaum once said, the programmer is a creator of universes. It often feels that way. Whether you draw inspiration from Harry Potter or the pages of a fantasy novel, the analogy holds: a skilled programmer, like a powerful wizard, can bend the world around them through knowledge, curiosity, and craft.

THAT'S why I chose to learn to code.

Predator Not Prey

“Live like a predator, not like prey.” — Justin Marinelli, The Bucknellian, 2012

Back in 2016, I felt stuck in life. I had just gotten out of a relationship, and I didn’t know what I wanted to do after yet another unfinished attempt at completing a college degree. I felt like I had fallen into complacency. I started searching for some motivation or a mindset that I could adopt to get myself moving again. That’s when I stumbled upon an interesting blog post entitled “Being a Predator Is Better Than Living Like Prey.” In the post, the author shares that the best advice he’s ever received is: “Live like a predator, not like prey.”

The author then goes on to draw comparisons between the animal kingdom and life in college—more specifically, how natural predators survive and even thrive in the wild, and how, by adopting the same mindset and behaviors, you as a student can do the same in a college environment.

Not only does this mirror life in college, but it also mirrors life in general. Most people have dreams and goals. Dreams and goals fuel an individual’s sense of purpose. That being said, people usually choose one of two mindsets when navigating life, and they form behaviors that align with that mindset. The two mindsets I’m referring to are what I call the predator mindset and the prey mindset. Let’s take a look at both along with their accompanying behaviors.

The first mindset is that of someone with a predator mindset. Now, when I say predator, I’m not talking about an antisocial psychopath or anything of the sort. (Sit back down, Jeffrey Dahmer—I’m not talking about you.) I’m talking about the natural predators you find in the animal kingdom. Lions, sharks, and eagles are prime examples. (You thought I was going to say “Lions, tigers, and bears! Oh my!” didn’t you?)

There’s no getting around the fact that we, as humans, have a finite amount of time on this planet. If we want to fulfill our goals and wishes, we have to adopt a different mindset than the often more comfortable prey mindset. We need to become proactive instead of reactive.

Now imagine that you’re a predator in the wild—let’s say a panther. You have no choice but to be proactive. You have to take risks. Not taking risks means you may miss out on your next meal or miss mating opportunities. Add to that the fact that your next meal may be bigger, faster, or even smarter than you. This means that you, the predator, need to push yourself every single day to become a better version of yourself. You have to become stronger, faster, and smarter. It’s not a matter of vanity—it’s a matter of survival.

In the wild, some predators hunt in packs, such as wolves, while others hunt solo, like tigers. Humans, at their core, are social beings. A person with the predator mindset understands this but is more selective. They choose a smaller, tighter group of loyal friends with a similar mindset over a large group of mediocre friends with questionable loyalties. After all, you are the sum of those you surround yourself with—choose wisely. This small circle pushes each other to be better. Those with the predator mindset also aren’t afraid to go their own direction and forge their own path when the need arises, and the “pack” understands this.

What is the “prey” of someone with the predator mindset, you may ask? Their goals. Their opportunities. They don’t let opportunities pass them by; they hunt it.The predator knows that they are a predator—they don’t need external validation because they trust themselves.

What is something a predator doesn’t have? A victim mentality. A predator doesn’t waste time asking, “Why me?” They keep their emotions in check. This doesn’t mean someone with a predator mindset doesn’t have emotions; it means they’ve learned to control them—because if you don’t, your emotions will control you. Predators also learn from their mistakes. If they fail? They learn and move forward. They don’t blame others. If a predator doesn’t learn from its mistakes, it dies…

Speaking of victim mentality, let’s talk about the prey mindset. Someone with a prey mindset has developed a mentality they’ve grown accustomed to—the victim mentality. They constantly ask themselves, “Why me?” This is in direct contrast to someone with a predator mindset, who asks, “Why not me?” People with a prey mindset rarely take ownership of their mistakes; it’s always someone else’s fault. They are reactive, not proactive.

Remember how I mentioned earlier that individuals with a predator mindset keep their emotions in check? Those with the prey mindset let their emotions take the steering wheel.

They also tend to believe in the illusion that there is strength in numbers—much like herd animals in the wild. Unfortunately, that often means little to no loyalty among the herd and shallow relationships. (Really… it’s like they’re playing Pokémon: Friends Edition—gotta catch them all!) When pressure hits though, the herd scatters, and the prey gets left behind.

Sticking with the herd is the more comfortable option, but it also means never forging your own path. If you try to break away, the herd will attempt to drag you back into mediocrity. Remember, just like with the predator mindset, you are the sum of those you surround yourself with.

So now you have a choice to make.

Do you want to start living your best life by being proactive—going after your goals and dreams and becoming a better version of yourself every day? Or do you want to remain reactive, comfortable in mediocrity, while life passes you by?

Decide what you want in life and pursue it every day like the predator you are. Maybe that goal is a relationship—ask your crush out. What’s the worst they can do, say no? If that happens, move on. There is someone else out there for you.

Once you start living like a predator, your life will begin to fall into alignment—not because of luck, but because you’re creating opportunities instead of merely reacting to what life throws at you.

Remember you have a choice:  Predator or Prey.  I, for one, choose to: “Live like a predator, not like prey.”