This is a bit of a load question with a few different parts, but I think it is answerable overall.
Is there a Hacker Ethos
Yes and no. The main problem is the wide diversity of hacker groups that differ by targets and thus ethical code. Just to name a few: white hats usually follow the "do no harm"-type of ethics and try to close security-leaks. Regarding red- and black-hats things become quite a lot more complex, a short summary will show that: Of course (what a surprise) there's the "there's money in it? I'm in."-type of hacker, which doesn't care about ethics. On the other hand, there are as well politically active groups - e.g. Anonymous declared war on IS (opinion on results differs) - that of course follow a kind of ethical code. Or the classical cracker that's trying to break copy protection and follows the communistic principle of "everything should be available to everyone". Some groups add loyalty to the group to their ethical code. In short: some follow a ethical code, some don't. The diversity of ethical codes is gigantic, so expanding further on this topic doesn't make much sense.
Disclosure
When disclosing a discovered vulnerability to a company, there are three main disclosure policies that the community has.
- Full disclosure: Release the details of the vulnerability along with a PoC. Some prefer this method because companies are not always friendly to being told they have data-exposing security holes and throw lawyers at people rather than fixing the vulnerability. Some companies pretend the problem isn't there or fix the problem without properly crediting the person who did the work.
- Responsible disclosure: Work with the company to identify the root cause, own validation of the fix, and then release the information after a patch has been written. Rain Forest Puppy is one of the original people who released an accepted policy on when to consider responsible disclosure a lost cause and release the details. It's a hard balance to strike.
- Fully silent: This means having NDAs and lawyers, and sometimes court orders, gag the person from saying anything at all.
The balance is hard. If I find a security vulnerability, I want the company to fix it. But there are companies who are on a personal blacklist, that I have dealt with before and are extremely disrespectful to researchers. Those companies will get a full disclosure. What about the ethos? Researchers are balancing getting a fix out before the criminals exploit it, and letting it go unfixed and the criminals finding it and exploiting it. It's a judgement call, and one that isn't easy.
Selling vulnerabilities and exploits
There is a lot of discussion in the community and outside of the community on the ethics of selling exploits. My intention is not to start a war, but to provide as independent viewpoint as I can provide without letting my personal opinions influence anybody.
When we talk about ethics, there are two main viewpoints:
Sell, and get money for your hard work: If I spend hours and hours and hours of work finding a vulnerability, I want to get paid for my hard work. It's something the vendor should fix, and an independent can broker that communication for me, influencing the responsible disclosure without me having to worry with lawyers.
Don't sell, because I don't know who may get the exploit. Increasingly, nation states are attacking each other, influencing trade, nation secrets, and more. I don't want my exploit falling in to the hands of a nation state.
Okay, really, is there an ethos?
Personally, I think no. There's the Hacker Manifesto which you can find on the internet and read. It's a good read. But at the end of the day, my security skills and how I use them are a reflection of who I am and not the other way around. I don't put people at risk intentionally. There are unspoken rules, and I've mentioned some of them above with the disclosure policies. The biggest one in the community, and you will get called out for it because the community is awesome like that, is don't be a jerk. If you are a jerk, you'll get tossed out. We don't like people who are jerks. If that's your takeaway, then I've communicated what I wanted to.
Certified hackers?
Who can do that? Well, in the community, there are several recognized bodies that teach and provide certificates for various subjects in the community. Up to now, I've been speaking about offensive security as that's my background. But there's also incident response, for example. Here's some recognized bodies in the industry:
*I have the OSCP.
These are recognized bodies for a few reasons, but one thing they all have in common is if you do anything contrary to the ethics they set forth, they'll strip your certification.
Who says they can do this?
Nobody, really. I can create a company, offer a certificate and training, and that's it. But pretty soon the industry will know if you are a paper mill, or actually offering substance. The three I mentioned above are recognized because they offer substance, albeit in different areas and in different skill levels.
Recommended Reading
This is a broad question, so I attempted to offer an answer that is not skewed by own experiences. But there's plenty of reading out there. I've given a few links, so search away. You'll see that there are very valid but almost contrary viewpoints on the ethics of hackers. My suggestion at the end though is don't be a jerk. Nobody likes a jerk.
