What is the distinguishing point between a script kiddie and a hacker?

Question

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker (either black/white/grey), I imagine, is much more methodic and plans his route - they're running this system, with that IDS, and these security measures - so their attack is hopefully more pinpointed, less noisy, and more effective.

What I'm having trouble with is distinguishing between the two - a script kiddie might use metasploit, Cain & Abel, or Nessus, but a hacker or pentester would probably use them as well. What distinguishes these two? I know the script kiddie most likely won't know what's going on, but to what extent does the hacker need to know what's going on to not be considered a 'script kiddie'?

For example I like security and I am really interested in learning about it. I know about various tools such as metasploit, nessus, cain, hamster/ferret, wireshark, nmap, LOIC, etc. but I don't use them because I don't know how, or quite understand how exactly they work. I've been setting up a network of VMs to play with and do it responsibly. If that's considered being a script kiddie, what would be the defining line between a script kiddie and a hacker?

Answer 1

It really depends on your point of view.

From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain understanding of how things work internally, and could, at least potentially (if free time was free), rewrite these tools from scratch.

The script kiddie himself does not think of himself as a "script kiddie", of course. In his view, he is an "elite hacker", and the other people are script kiddies. The expression "script kiddie" is meant as a disparaging designation, to insist on the alleged youth of the individual and its associated inherent shame. To consider youth as shameful by nature, you have to be young. Old people don't think of youth as a disgusting fact to hide, but as a lost treasure. When somebody uses the expression "script kiddie" too often, you can often infer that this somebody is himself not very old, and a metaphorical scripty smell probably lingers around his person.

A more neutral, less emotionally charged classification would be about competence. Attackers are more or less competent at what they do. Just like anybody. The less competent attackers, which other script kiddies are prone to point out and mock as "script kiddies", will run their tools (collected on the Internet), and if the off-the-shelf tools don't succeed in the attack, they soon give up. More competent attackers will adapt their tools to the specific situation; they see the tools more as a generic framework for attacks than the actual instruments.

---

Given the above, to avoid being seen as a script kiddie, the trick is to distantiate yourself from the kiddie term, not from the script. Scripts, and, more generally, tools, are neutral. It is the maturity of your reactions, or lack thereof, which will mark you as a script kiddie or not. Despite what is usually believed on the subject, it has very little to do with technical skill; it is a matter of communication, of public relations. Be cool, don't whine, and you will never be a script kiddie.

Answer 2

I read somewhere, I forget where, they divided hackers into three levels of expertise.

The lowest level was Script kiddie. Script kiddies have very limited knowledge and almost no knowledge beyond the attack they are attempting. They may not completely understand the attack they are attempting. An example of this would be a person ARP poisoning a network with Cain, but the person does not know what ARP is or why the attack works. These people are likely to identify targets for the exploit they will try and if it does not work they will move on. Blind SQL Injections, for example, is a common real world example of a script kiddie. It is important to say that Blind SQL injections, or any attack a script kiddie might use, may be used by more advanced hackers. They are just a tool in the toolbox

I don't remember what the second level was called (lets go with Hacker)but this was a level of hacker that DID understand how and why attacks worked. They may write some security tools for themselves to use, and they may not know everything there is to know, but they are NOT a one-trick pony at this level.

The third level was called Elite Hacker. These people will understand all of the underlying mechanisms of their attacks, create new attacks, write some of their own security tools, and have a deep knowledge/experience when it comes to attacking computer systems. These people are more likely to be persistant and use 0day exploits.

It is quite simple. As you get more tricks, understand more about how the computer works and how to get what you want, you become a better hacker. How you deal with someone like a script kiddie is completely different than how you deal with an elite hacker. Frustrating a script kiddie may cause him to go to the next website on his hit-list, but an elite hacker may require more resources and more time. It is hard to lump people into groups, since all people are so different, but I think these three categories do a pretty good job

Answer 3

Wikipedia on Script kiddies (emphasis mine):

In hacker culture a script kiddie or skiddie, (also known as skid, script bunny, script kitty,) are unskilled individuals who use scripts or programs developed by others to attack computer systems and networks and deface websites. It is generally assumed that script kiddies are juveniles who lack the ability to write sophisticated hacking programs or exploits on their own, and that their objective is to try to impress their friends or gain credit in computer-enthusiast communities. The term is typically pejorative.

So in short, they're a clueless nuisance which may still cause harm, be that on purpose or by accident.

Concerning the term "Hacker", there is a lot of ambiguity. My personal preference is the programmer subculture (again emphasis mine):

A hacker is someone who loves to program or who enjoys playful cleverness, or a combination of the two. The act of engaging in activities (such as programming or other media) in a spirit of playfulness and exploration is termed hacking. However the defining characteristic of a hacker is not the activities performed themselves (e.g. programming), but the manner in which it is done: Hacking entails some form of excellence, for example exploring the limits of what is possible, thereby doing something exciting and meaningful. Activities of playful cleverness can be said to have "hack value" and are termed hacks (examples include pranks at MIT intended to demonstrate technical aptitude and cleverness).

So that may also include someone who e.g. modded their smartphone into a garage door opener (at least for them it'd be exciting, I guess). What you are probably referring to, however, is more precisely called a Black hat hacker (and again, emphasis mine):

A "black hat" hacker is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" (Moore, 2005). Black hat hackers form the stereotypical, illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the public fears in a computer criminal". Black hat hackers break into secure networks to destroy data or make the network unusable for those who are authorized to use the network.

So that's someone who actively seeks to harm others for selfish purposes, and they are clever enough to actually understand what they are doing.

In summary:

• Script kiddies are like school bullies: Annoying but clueless
• Black hat hackers are the mobsters: Bullies gone professional
• Hackers in general: They just like wearing a pinstripe suit - that doesn't make them evil, but the public always thinks of their black sheep cousins...

Answer 4

You're talking about classifications that humans make, not some objective measurement of skill. When does someone become old? When is someone tall? Ask 50 people and you'll get a different answer for all of them.

Script kiddies are simply beginners in "hacking". Hackers are simply those with more experience. There is no single universally agreeable point where one transitions into another.

There is nothing wrong with being a "script kiddie" despite the negative connotations. Every beginner will always be one, because we're not born with a manual in our head. The difference is whether you wish to learn or not. Don't even bother thinking about these useless definitions while learning.

Answer 5

I'd personally say that the difference between a script kiddy and a de-facto hacker does not lie in the tools used at all - merely in the motivation and innovation pulled off by the person. To this end, an example from my IRC NetAdmin days: every few days, we'd get a botnet fired at the network. So what? Easy to defend against, more of a nuisance than anything, really... Yet those people would keep going with the same tool, every single time, despite the numerous defenses that were custom-coded to avoid this (there's still an unrealIRCd mod around from that specific network).

They'd always keep going, though, with the same tool that was now defunct. You'd see bots connecting, not being able to join anything, disconnecting. They would never figure out any other way (or didn't want to), or maybe just did this without even monitoring because "hurr durr durr I bet they're shaking!".

A script-kiddy is a one-trick pony who discovered this trick and thought "I'm the master of the Universe!", usually. They know one thing that someone handed to them and probably consider it the gospel. You're lucky if they discovered pentesting tools - usually, all they know is LOIC & Cain&Abel and maybe the ripper. They may know how to exploit the simplest forms of SQL injection flaws/vulns, and they think they're awesome for it.

A hacker, on the other hand, has all this knowledge + the ability to chain attacks together + the motivation to do so + the skill to actually understand what they are doing. Most of the time, they're not doing it to feel awesome - they're doing it to prove a point.

Answer 6

More for the sake of introducing a potentially new perspective than anything else, I might argue that the difference lies in the motivation of the "attackers." I'll use @Rell3oT 's 3-type system, because it seems fairly straightforward.

A "script kiddie" will run attacks for purposes of validation - from himself or from others. He wants to think he's "cool", so he'll generally wreak havoc in hopes that he'll garner some respect.

A "hacker" might be looking to make an easy buck, learn something, or just have a bit of fun. Either way, he has a specific objective in mind. With the exception of the people who want money, hackers are generally looking for a challenge, and may overstep their bounds doing so. The more materialistic hackers are really just knowledgeable script kiddies, but the way they structure their attacks changes with their objectives - as @Tobias says, they're really more like thugs now, rather than bullies.

A "professional hacker" (not sure if "elite" is the right word) is someone who understands how each of a systems work, and generally seeks to "play around" with either specific systems or how they interact to form a whole. This may or may not result in the publishing of an exploit (depending on the hacker's motivations). This section is a bit sparse, because I haven't met enough of these people to claim to really understand them.