Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker (either black/white/grey), I imagine, is much more methodic and plans his route - they're running this system, with that IDS, and these security measures - so their attack is hopefully more pinpointed, less noisy, and more effective.

What I'm having trouble with is distinguishing between the two - a script kiddie might use metasploit, Cain & Abel, or Nessus, but a hacker or pentester would probably use them as well. What distinguishes these two? I know the script kiddie most likely won't know what's going on, but to what extent does the hacker need to know what's going on to not be considered a 'script kiddie'?

For example I like security and I am really interested in learning about it. I know about various tools such as metasploit, nessus, cain, hamster/ferret, wireshark, nmap, LOIC, etc. but I don't use them because I don't know how, or quite understand how exactly they work. I've been setting up a network of VMs to play with and do it responsibly. If that's considered being a script kiddie, what would be the defining line between a script kiddie and a hacker?

P.S. I had no idea what tags to use for this, feel free to edit anything.

share|improve this question
    
One has a pretty good idea of what they are doing. The other does not. –  SteveS Apr 15 '13 at 23:13
3  
Why does it matter? Would their title make you treat them differently? For example, when building a threat model or risk profile, it is helpful to classify the threat agent according to the level of required skill. Calling a low-skilled, untargeted attacker as a "script kiddie" (or "skiddie") is a nice shorthand that gets the point across, but it doesnt really matter if we call them that, or decide that "Shetland Ponies" are the new euphamism. Laws don't apply differently to Ponies, nor would you implement countermeasures only for Ponies (or non-Ponies). Seems NC to me, so what does it matter? –  AviD Apr 16 '13 at 7:08
    
A lot of organizations fingerprint threats by a lot of different metrics. If all of the attacks you see from one of those threats is straight out of tutorials you can find online, this is useful information to have. From a security standpoint, it doesn't change anything, but from a triage and "What do I need to do right this second" it makes a lot of difference. –  Rell3oT Apr 16 '13 at 14:33
    
[RANT TYPE=LOSTBATTLE] This is a misuse of the term "hacker" anyway.[/RANT] –  keshlam Mar 5 at 0:16
    
@keshlam Yeah, I'm aware it's supposed to be called a cracker, but the common term today is hacker. –  ekaj Mar 5 at 4:53
show 1 more comment

5 Answers

up vote 10 down vote accepted

It really depends on your point of view.

From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain understanding of how things work internally, and could, at least potentially (if free time was free), rewrite these tools from scratch.

The script kiddie himself does not think of himself as a "script kiddie", of course. In his view, he is an "elite hacker", and the other people are script kiddies. The expression "script kiddie" is meant as a disparaging designation, to insist on the alleged youth of the individual and its associated inherent shame. To consider youth as shameful by nature, you have to be young. Old people don't think of youth as a disgusting fact to hide, but as a lost treasure. When somebody uses the expression "script kiddie" too often, you can often infer that this somebody is himself not very old, and a metaphorical scripty smell probably lingers around his person.

A more neutral, less emotionally charged classification would be about competence. Attackers are more or less competent at what they do. Just like anybody. The less competent attackers, which other script kiddies are prone to point out and mock as "script kiddies", will run their tools (collected on the Internet), and if the off-the-shelf tools don't succeed in the attack, they soon give up. More competent attackers will adapt their tools to the specific situation; they see the tools more as a generic framework for attacks than the actual instruments.


Given the above, to avoid being seen as a script kiddie, the trick is to distantiate yourself from the kiddie term, not from the script. Scripts, and, more generally, tools, are neutral. It is the maturity of your reactions, or lack thereof, which will mark you as a script kiddie or not. Despite what is usually believed on the subject, it has very little to do with technical skill; it is a matter of communication, of public relations. Be cool, don't whine, and you will never be a script kiddie.

share|improve this answer
1  
I've heard some people describe themselves as currently being just scriptkiddies actually. They used some tools, but knew that they didn't understand it and knew the term for it. It's not merely a disparaging designation. –  Luc Apr 16 '13 at 8:03
add comment

I read somewhere, I forget where, they divided hackers into three levels of expertise.

The lowest level was Script kiddie. Script kiddies have very limited knowledge and almost no knowledge beyond the attack they are attempting. They may not completely understand the attack they are attempting. An example of this would be a person ARP poisoning a network with Cain, but the person does not know what ARP is or why the attack works. These people are likely to identify targets for the exploit they will try and if it does not work they will move on. Blind SQL Injections, for example, is a common real world example of a script kiddie. It is important to say that Blind SQL injections, or any attack a script kiddie might use, may be used by more advanced hackers. They are just a tool in the toolbox

I don't remember what the second level was called (lets go with Hacker)but this was a level of hacker that DID understand how and why attacks worked. They may write some security tools for themselves to use, and they may not know everything there is to know, but they are NOT a one-trick pony at this level.

The third level was called Elite Hacker. These people will understand all of the underlying mechanisms of their attacks, create new attacks, write some of their own security tools, and have a deep knowledge/experience when it comes to attacking computer systems. These people are more likely to be persistant and use 0day exploits.

It is quite simple. As you get more tricks, understand more about how the computer works and how to get what you want, you become a better hacker. How you deal with someone like a script kiddie is completely different than how you deal with an elite hacker. Frustrating a script kiddie may cause him to go to the next website on his hit-list, but an elite hacker may require more resources and more time. It is hard to lump people into groups, since all people are so different, but I think these three categories do a pretty good job

share|improve this answer
    
This mirrors what my own attempt would have been. There's a distinction between people who can replay existing attacks, write implementations of existing attacks, and invent new attacks. –  Stephen Touset Apr 15 '13 at 23:44
    
I think you may be referring to my answer on Quora: qr.ae/I17KX (I'm not the most-proud of this, since I don't think the distinction is particularly valid) –  bonsaiviking Mar 4 at 20:33
    
No I wasn't. As far as I can tell, I posted this before you posted that on quora. –  Rell3oT Mar 4 at 23:25
add comment

You're talking about classifications that humans make, not some objective measurement of skill. When does someone become old? When is someone tall? Ask 50 people and you'll get a different answer for all of them.

Script kiddies are simply beginners in "hacking". Hackers are simply those with more experience. There is no single universally agreeable point where one transitions into another.

There is nothing wrong with being a "script kiddie" despite the negative connotations. Every beginner will always be one, because we're not born with a manual in our head. The difference is whether you wish to learn or not. Don't even bother thinking about these useless definitions while learning.

share|improve this answer
    
I think that even though the terms used to describe them may be subjective and argumentative, the distinction between the two is still relevant beyond their definition. For example, I may want to know what level of knowledge to expect from a just detected attack attempt, and act accordingly. If I see an inexperienced script kiddie trying out common attacks, I might amuse myself for a while before acting on it. OTOH if I detected an experienced hacker patiently collecting my banners, and have problems detecting his other activities on my server, I will be closing the pipes on him ASAP. –  TildalWave Apr 15 '13 at 23:37
    
While true - the question relates to the terms used to describe them, and specifically when does one transition into another. Your point of a more skilled attacker being more dangerous is self evident, it doesn't have any impact on whether they should be called a script kiddie or hacker. –  Peleus Apr 15 '13 at 23:46
    
Agreed, and I was not disputing your answer. They're all hackers anyway, well -- or they're trying to be. One is a less experienced, less skilled subgroup of the other with same or similar intentions, so finding a clear line between the two will always prove difficult. Besides, when I detect any of the two anywhere near flags I defend, I tend to give them a lot less favorable nicknames anyway :)) Cheers! Oh, found this. Yey for Wiki! –  TildalWave Apr 15 '13 at 23:52
add comment

I'd personally say that the difference between a script kiddy and a de-facto hacker does not lie in the tools used at all - merely in the motivation and innovation pulled off by the person. To this end, an example from my IRC NetAdmin days: every few days, we'd get a botnet fired at the network. So what? Easy to defend against, more of a nuisance than anything, really... Yet those people would keep going with the same tool, every single time, despite the numerous defenses that were custom-coded to avoid this (there's still an unrealIRCd mod around from that specific network).

They'd always keep going, though, with the same tool that was now defunct. You'd see bots connecting, not being able to join anything, disconnecting. They would never figure out any other way (or didn't want to), or maybe just did this without even monitoring because "hurr durr durr I bet they're shaking!".

A script-kiddy is a one-trick pony who discovered this trick and thought "I'm the master of the Universe!", usually. They know one thing that someone handed to them and probably consider it the gospel. You're lucky if they discovered pentesting tools - usually, all they know is LOIC & Cain&Abel and maybe the ripper. They may know how to exploit the simplest forms of SQL injection flaws/vulns, and they think they're awesome for it.

A hacker, on the other hand, has all this knowledge + the ability to chain attacks together + the motivation to do so + the skill to actually understand what they are doing. Most of the time, they're not doing it to feel awesome - they're doing it to prove a point.

share|improve this answer
add comment

Wikipedia on Script kiddies (emphasis mine):

In hacker culture a script kiddie or skiddie, (also known as skid, script bunny, script kitty,) are unskilled individuals who use scripts or programs developed by others to attack computer systems and networks and deface websites. It is generally assumed that script kiddies are juveniles who lack the ability to write sophisticated hacking programs or exploits on their own, and that their objective is to try to impress their friends or gain credit in computer-enthusiast communities. The term is typically pejorative.

So in short, they're a clueless nuisance which may still cause harm, be that on purpose or by accident.

Concerning the term "Hacker", there is a lot of ambiguity. My personal preference is the programmer subculture (again emphasis mine):

A hacker is someone who loves to program or who enjoys playful cleverness, or a combination of the two. The act of engaging in activities (such as programming or other media) in a spirit of playfulness and exploration is termed hacking. However the defining characteristic of a hacker is not the activities performed themselves (e.g. programming), but the manner in which it is done: Hacking entails some form of excellence, for example exploring the limits of what is possible, thereby doing something exciting and meaningful. Activities of playful cleverness can be said to have "hack value" and are termed hacks (examples include pranks at MIT intended to demonstrate technical aptitude and cleverness).

So that may also include someone who e.g. modded their smartphone into a garage door opener (at least for them it'd be exciting, I guess). What you are probably referring to, however, is more precisely called a Black hat hacker (and again, emphasis mine):

A "black hat" hacker is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" (Moore, 2005). Black hat hackers form the stereotypical, illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the public fears in a computer criminal". Black hat hackers break into secure networks to destroy data or make the network unusable for those who are authorized to use the network.

So that's someone who actively seeks to harm others for selfish purposes, and they are clever enough to actually understand what they are doing.

In summary:

  • Script kiddies are like school bullies: Annoying but clueless
  • Black hat hackers are the mobsters: Bullies gone professional
  • Hackers in general: They just like wearing a pinstripe suit - that doesn't make them evil, but the public always thinks of their black sheep cousins...
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.