Ethical Hacking

              

“A 15-year-old Canadian hacker launches a massive denial-of-service attack, bringing down the websites of Amazon, CNN, eBay, and Yahoo, causing millions of dollars in damages.”

That headline appeared on February 7, 2000, in reference to a distributed denial-of-service attack (DDoS) carried out by a teenage hacker who went by the handle Mafiaboy.

You’ve probably seen similar headlines in the media over the years.

Now imagine this:

A lone teenage hacker sits in their bedroom or their parents’ basement in the dark. In front of them sits a computer screen and a keyboard. They sit there diligently typing away while wearing a dark hoodie. The glow of the computer screen reflects off their face as they carry out their nefarious deeds, one keystroke at a time.

This is the stereotype that Hollywood has painted of the typical hacker.

But what if I told you that there are different types of hackers and that the Hollywood stereotype doesn’t always hold true?

Hackers are often described as falling into three broad categories based on their intentions and whether they have authorization to access a system: white hats, gray hats, and black hats.

The terminology comes from the old Western movies many of us grew up watching on television. The good guys traditionally wore white cowboy hats, while the bad guys and outlaws wore black. Gray hats occupy the area somewhere in between a vigilante of sorts.

White Hat Hackers

The White Hat Hacker stays on the right side of the law. They test or access computer systems that they either:

A. Own, or

B. Have explicit authorization or written permission to access and test.

White hats are also commonly known as ethical hackers.

Career paths associated with ethical hacking and cybersecurity include security researchers, penetration testers, cyber incident responders, and malware analysts.

Security Researchers and Bug Bounty Hunters

Security researchers often participate in something called a bug bounty program, sometimes referred to as bug bounty hunting.

Many major companies operate bug bounty programs. Basically, these programs allow authorized security researchers to look for security vulnerabilities in a company’s software, website, applications, or other systems.

When a researcher discovers a vulnerability, they report it to the company according to the rules of the program and provide information about the vulnerability and, when appropriate, how it can be reproduced or exploited.

If the company verifies the vulnerability, the researcher may receive a monetary reward based on factors such as the severity and impact of the vulnerability.

The theory behind bug bounty programs is simple: it’s better for a company to have an authorized security researcher discover a vulnerability and report it so the company can fix it than for a malicious hacker to discover it first and use it to cause real damage.

Penetration Testers

Next, we have the penetration tester(no, not that kind, get your mind out of the gutter.), often called a pentester.

Some companies hire penetration testers to test their software, networks, applications, and other systems by conducting controlled and authorized security tests. The goal is to find weaknesses before malicious hackers can exploit them.

A penetration test is essentially a controlled attack performed with permission.

The penetration tester attempts to identify vulnerabilities and demonstrate what an attacker might be able to accomplish if those vulnerabilities were exploited. The findings are then documented in a report so the organization can take steps to improve its security.

Again, the basic principle is the same:

It’s better for an authorized ethical hacker to discover and report a vulnerability so it can be fixed than for a black hat to discover it first and exploit it.

Cyber Incident Responders

Another important cybersecurity career path is cyber incident response.

A cyber incident responder investigates, contains, and helps resolve security breaches and cyberattacks within an organization’s network.

Think of the cyber incident responder as a CSI investigator in cyberspace.

When a data breach or cyberattack occurs, an incident responder may be responsible for several things, including:

• Triage and detection: Analyzing security alerts, system logs, and other evidence to determine whether an attack is occurring and how serious it is.

• Containment and eradication: Isolating affected systems, blocking malicious activity, and removing malware or other threats to prevent the attack from spreading.

• Recovery: Helping restore compromised systems and data safely and returning them to normal operation.

• Documentation and reporting: Recording indicators of compromise (IoCs), documenting what happened, and producing detailed after-action reports.

  
  

Incident responders are essentially the people who get called when something has gone seriously sideways and someone needs to figure out what happened, how it happened, how to stop it, and how to prevent it from happening again.

Malware Analysts

The final cybersecurity career path I want to discuss is malware analysis.

Malware is a major problem in today’s world. Many security incidents and data breaches either begin with or involve malicious software.

Malware is software designed to perform malicious actions, such as damaging systems, disrupting operations, stealing information, or providing unauthorized access.

Examples of malware include viruses, worms, ransomware, spyware, and trojans.

This is where malware analysts come in.

A malware analyst specializes in examining malicious software to determine what it does, how it works, how it spreads, and how it can be detected or stopped.

Malware analysts may use techniques such as static analysis, dynamic analysis, debugging, and reverse engineering to understand malicious code.

Once security professionals understand how a piece of malware works, they can develop better defenses, detection methods, security controls, and patches or mitigations to help prevent similar attacks in the future.

Gray Hat Hackers

Now let’s talk about the Gray Hat Hacker.

A gray hat is somewhat similar to a white hat in that they may discover security vulnerabilities without necessarily intending to cause harm. They may even report those vulnerabilities to the affected company.

Here’s where they differ from a white hat:

They may not have permission to access or test the system in the first place.

That distinction is extremely important.

A gray hat might discover a vulnerability while testing a system out of curiosity or while exploring a target without authorization. Even if they have good intentions and do not damage anything, accessing a computer system without permission can still be illegal.

This is why the gray hat occupies such a complicated position.

For example, imagine a security researcher discovers a serious vulnerability in a company’s website without having permission to test it. The researcher informs the company and gives them an opportunity to fix the problem.

That may sound helpful—and it potentially is—but the researcher still accessed the system without authorization.

Another controversial situation occurs when a researcher reports a vulnerability and the company refuses to fix it or takes an extremely long time to address it.

The researcher may eventually decide to publicly disclose information about the vulnerability in an attempt to pressure the company into fixing it.

This is where the distinction between responsible disclosure and full disclosure becomes important.

Responsible disclosure generally means giving the affected organization an opportunity to investigate and fix a vulnerability before publicly releasing detailed information about it. Many bug bounty programs establish specific rules and timelines for this process.

Full disclosure generally means publicly releasing information about a vulnerability, potentially including enough technical information for others to reproduce or exploit it.

There are legitimate arguments on both sides of the disclosure debate.

Researchers may believe that public disclosure is necessary to protect users when a company refuses to address a serious vulnerability. Companies, on the other hand, may argue that public disclosure can put their customers at risk before adequate defenses are available.

Regardless of the argument, there is an important distinction between a gray hat and a black hat:

A gray hat may access a system without authorization, but they generally do not have the malicious intent associated with a black hat. Their intent is rather motivated by curiosity. 

That does not necessarily make their actions legal or harmless.

Black Hat Hackers

Finally, we have the Black Hat Hacker.

Black hats are malicious hackers who intentionally access systems without authorization, usually for personal gain, espionage, disruption, theft, or some other malicious purpose.

Whether through sophisticated attacks or reckless exploitation, black hats generally have little concern for the damage their actions may cause.

A black hat might develop or deploy malware such as ransomware, banking trojans, spyware, or worms—not to study and understand them, but to use them against victims.

Two major motivations behind cybercrime are financial gain and data theft.

Criminal hackers may steal personal information, financial information, intellectual property, passwords, or other valuable data. They may also use ransomware or other forms of extortion to demand money from individuals, businesses, and organizations.

There are many different techniques black hats use to accomplish these goals, and I’ll go into more detail about those techniques, as well as what you can do to protect yourself and your business, in future posts.

The Future of Ethical Hacking

With the rapid development of artificial intelligence (AI), the cybersecurity landscape will continue to become even more complex and nuanced.

Both defenders and attackers are already exploring ways to use AI to their advantage, and this is a subject I’ll explore in more detail in future posts.

But one thing probably won’t change:

The constant cat-and-mouse game between attackers and defenders.

Black hats will continue to look for ways to exploit computer systems—and, just as importantly, people’s trust.

White hats will continue to defend those systems, investigate attacks, educate users, discover vulnerabilities, and responsibly disclose security weaknesses so companies and organizations can close those security holes.

The technology will change.

The tools will change.

The techniques will change.

But the fundamental battle will remain the same:

Attackers will always look for weaknesses. Defenders will always look for ways to stop them.

And that is what makes cybersecurity so damn fascinating...