8

We often hear the term black-hat or white-hat hacking, but it seems like these days with many companies implementing tougher policies on information security and many companies focusing on penetration testing as a service, I am wondering if there is a code of ethics that is either documented or an unspoken rule among the people engaged in these types of activities.

I have heard that you can be a certified ethical hacker, but I wonder where this certification comes from and who can accredit someone for being an ethical hacker?

closed as off-topic by Dmitry Grigoryev, LvB, AviD Apr 18 '16 at 12:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Dmitry Grigoryev, LvB, AviD
If this question can be reworded to fit the rules in the help center, please edit the question.

23

This is a bit of a load question with a few different parts, but I think it is answerable overall.

Is there a Hacker Ethos

Yes and no. The main problem is the wide diversity of hacker groups that differ by targets and thus ethical code. Just to name a few: white hats usually follow the "do no harm"-type of ethics and try to close security-leaks. Regarding red- and black-hats things become quite a lot more complex, a short summary will show that: Of course (what a surprise) there's the "there's money in it? I'm in."-type of hacker, which doesn't care about ethics. On the other hand, there are as well politically active groups - e.g. Anonymous declared war on IS (opinion on results differs) - that of course follow a kind of ethical code. Or the classical cracker that's trying to break copy protection and follows the communistic principle of "everything should be available to everyone". Some groups add loyalty to the group to their ethical code. In short: some follow a ethical code, some don't. The diversity of ethical codes is gigantic, so expanding further on this topic doesn't make much sense.

Disclosure

When disclosing a discovered vulnerability to a company, there are three main disclosure policies that the community has.

  • Full disclosure: Release the details of the vulnerability along with a PoC. Some prefer this method because companies are not always friendly to being told they have data-exposing security holes and throw lawyers at people rather than fixing the vulnerability. Some companies pretend the problem isn't there or fix the problem without properly crediting the person who did the work.
  • Responsible disclosure: Work with the company to identify the root cause, own validation of the fix, and then release the information after a patch has been written. Rain Forest Puppy is one of the original people who released an accepted policy on when to consider responsible disclosure a lost cause and release the details. It's a hard balance to strike.
  • Fully silent: This means having NDAs and lawyers, and sometimes court orders, gag the person from saying anything at all.

The balance is hard. If I find a security vulnerability, I want the company to fix it. But there are companies who are on a personal blacklist, that I have dealt with before and are extremely disrespectful to researchers. Those companies will get a full disclosure. What about the ethos? Researchers are balancing getting a fix out before the criminals exploit it, and letting it go unfixed and the criminals finding it and exploiting it. It's a judgement call, and one that isn't easy.

Selling vulnerabilities and exploits

There is a lot of discussion in the community and outside of the community on the ethics of selling exploits. My intention is not to start a war, but to provide as independent viewpoint as I can provide without letting my personal opinions influence anybody.

When we talk about ethics, there are two main viewpoints:

  • Sell, and get money for your hard work: If I spend hours and hours and hours of work finding a vulnerability, I want to get paid for my hard work. It's something the vendor should fix, and an independent can broker that communication for me, influencing the responsible disclosure without me having to worry with lawyers.

  • Don't sell, because I don't know who may get the exploit. Increasingly, nation states are attacking each other, influencing trade, nation secrets, and more. I don't want my exploit falling in to the hands of a nation state.

Okay, really, is there an ethos?

Personally, I think no. There's the Hacker Manifesto which you can find on the internet and read. It's a good read. But at the end of the day, my security skills and how I use them are a reflection of who I am and not the other way around. I don't put people at risk intentionally. There are unspoken rules, and I've mentioned some of them above with the disclosure policies. The biggest one in the community, and you will get called out for it because the community is awesome like that, is don't be a jerk. If you are a jerk, you'll get tossed out. We don't like people who are jerks. If that's your takeaway, then I've communicated what I wanted to.

Certified hackers?

Who can do that? Well, in the community, there are several recognized bodies that teach and provide certificates for various subjects in the community. Up to now, I've been speaking about offensive security as that's my background. But there's also incident response, for example. Here's some recognized bodies in the industry:

*I have the OSCP.

These are recognized bodies for a few reasons, but one thing they all have in common is if you do anything contrary to the ethics they set forth, they'll strip your certification.

Who says they can do this?

Nobody, really. I can create a company, offer a certificate and training, and that's it. But pretty soon the industry will know if you are a paper mill, or actually offering substance. The three I mentioned above are recognized because they offer substance, albeit in different areas and in different skill levels.

Recommended Reading

This is a broad question, so I attempted to offer an answer that is not skewed by own experiences. But there's plenty of reading out there. I've given a few links, so search away. You'll see that there are very valid but almost contrary viewpoints on the ethics of hackers. My suggestion at the end though is don't be a jerk. Nobody likes a jerk.

  • 4
    Nice answer over all. But the point about "criminals" isn't that simple. There's of course the "there's money in it; I'm in"-type, but cracking software e.g. to remove copy protection is illegal as well, but this sort of hacker follow the communistic principle of "anything should be available to anyone" (usually). There are hackers that (try to) take influence on political situations in an illegal way. Same as above, there's some sort of ethics behind it. The main-problem is the wide diversity of underground communities with different ethical codes. – Paul Apr 17 '16 at 23:58
  • I agree. I shied away from it because it's a whole different level of complexity that I didn't think I could cover accurately within a reasonable space. But please feel free to edit. :) – h4ckNinja Apr 18 '16 at 0:00
  • Well, let's say what peer-review does with the edit... Hope it's usefull – Paul Apr 18 '16 at 0:19
  • I like it. :) I don't have enough reputation yet to approve it, but I did see one typo that I fixed. Other than that, it has my stamp of approval. Thanks for adding. – h4ckNinja Apr 18 '16 at 0:21
  • +1 An excellent answer to what I thought would be a very difficult question! – Michael Lai Apr 18 '16 at 1:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.