Software and Security Engineering: Analysis of Hacker Classifications and Security Ethics

Learning Outcomes for Software and Security Engineering

• By the end of this lesson, students should be able to demonstrate a comprehensive understanding of various security attack vectors.

• The course focus includes Cybersecurity Engineering, Security Analysis, and the specific roles and ethical frameworks that govern the field.

Introduction to Hacking and the 'Hat' Classification System

• Definition of a Hacker: An individual possessing the technical skills required to breach cybersecurity defenses.

• The Hat System Origins: The nomenclature of categorizing hackers by color-coded 'hats' is derived from traditional cowboy film culture, where 'good' characters wore white hats and 'bad' characters wore black hats.

• Major Classifications: The cyberspace community recognizes three primary categories:

  • White Hats

  • Grey Hats

  • Black Hats

• Core Motivation of the First Generation: The primary goal was discovery rather than theft or destruction. These hackers sought to 'see what is possible' within a system.

• Ethical Divergence: A defining characteristic of the early black hat community was the possession of 'non-traditional' personal ethical standards. These individuals often did not view their activities as inherently wrong, even when significant damage occurred; they frequently shifted blame for the damage to the author of the system's vulnerability rather than themselves.

Historical Labels and Categories of Hackers

• Phreak: A dated term for an individual who cracks telephone systems. Many consider 'phreaking' to be the direct ancestor of modern hacking. Phreaks exploited the fact that the phone company sent signals (such as indicating a long-distance charge was collected) using specific audio frequencies. A classic example is the use of the Captain Crunch whistle, found in a popular cereal, which produced the exact frequency needed to manipulate the system.

• Cracker: An individual who pursues black hat activities for the challenge. Early crackers targeted school computers, government networks, and banks to prove it 'could be done.' Their exploits were documented in journals such as 2600 or Phrack. The term 'Cracker' is often preferred over 'Hacker' by professionals to distinguish malicious intent from those with good intentions.

• Cyberpunk: A contemporary blend of hacker, cracker, and phreak characteristics. This subculture is often associated with counter-culture movements and rebellion against mainstream lifestyles and authority. A notable figure is Loyd Blankenship, author of the 'Hacker's Manifesto.'

• Thrill Seeker: Individuals who hack out of curiosity to test their limits. Their actions are generally not intentional or premeditated.

• Demigod: Highly experienced crackers who develop tools and document techniques for others to use. Motivations vary from communal growth to personal advancement of the 'cause.' They typically operate under assumed names.

• Script Kiddie: Individuals with high desire but low technical skill. They rely on well-developed tools created by demigods. Despite their lack of skill, because the tools are powerful, script kiddies can cause significant systemic damage.

• Technological Hacker: Individuals who exploit defects to advance technology. They view themselves as the 'immune system' of the Internet, identifying and eliminating inferior or unworthy software and systems.

White Hat Hackers: The Ethical Defenders

• Analogy: Described as being like Marvel's Captain America, white hats prioritize standing up for what is right and protecting organizations and civilians.

• Mission: They find and report system vulnerabilities before malicious actors can exploit them.

• Professional Roles: These individuals typically hold positions such as:

  • Cybersecurity Engineer

  • Penetration Tester (Pen Tester)

  • Security Analyst

  • CISO (Chief Information Security Officer)

• Defined Activities:

  • Ethical Hacking: Improving security by using hacking skills for constructive purposes.

  • Security Research: Serving as independent contractors to tighten organizational security.

  • Internal Security Testing: Some are employed to constantly attack their own company's systems to expose weaknesses.

  • Penetration Testing: Simulating infiltrations to test defense strength and identifying encryption backdoors meant to bypass network protections.

• Specific Operational Tasks:

  • $1.$ Scanning networks for weaknesses.

  • $2.$ Configuring Intrusion Detection Systems ($IDSs$).

  • $3.$ Reporting vulnerabilities for remediation.

  • $4.$ Programming honeypots (traps designed to catch or analyze attackers).

  • $5.$ Monitoring network activity for suspicious behavior.

• Famous White Hat Examples:

  • Jeff Moss: Founder of the DEF CON conference.

  • Richard Stallman: Founder of the GNU project.

  • Tim Berners-Lee: Creator of the World Wide Web.

  • Linus Torvalds: Creator of the Linux kernel.

  • Tsutomu Shimomura: The individual credited with capturing Kevin Mitnick.

Grey Hat Hackers: The Moral Middle Ground

• Analogy: Described as being similar to Batman (DC's Dark Knight), they aim for the 'right' thing but use unconventional or illegal methods to achieve it.

• Operational Methodology: They skirt the boundary between ethical and unethical by breaking laws without permission. Their goal may be showing off, honing skills, or highlighting weaknesses to the owner.

• Relationship to Others: They act as a balance between white and black hats. Unlike white hats, they do not seek permission before hacking, but unlike black hats, they generally avoid purely illegal activities for personal gain.

• Controversy and Risk: The lack of a clear moral compass can lead to grey hats being prosecuted or jailed. Some are viewed as heroes of the people while being enemies of governments and large corporations.

• Historical Tactics: Historically, a grey hat might hack a system and then suggest that the administrator hire them or a friend for a fee to fix the issue. This practice is declining as businesses are increasingly willing to prosecute.

• Bug Bounty Programs: Some organizations implement these to encourage grey hats to report findings for a reward rather than exploiting them.

• Interaction Risk: A key difference from white hats is that if a grey hat's findings are ignored, they are not bound by contracts. They may choose to exploit the flaw themselves or post the details online for others.

• (In)famous Examples:

  • Anonymous: The world-famous hacktivist group.

  • HD Moore: Creator of the Metasploit framework.

  • Adrian Lamo: Known as the 'homeless hacker.'

  • Khalil Shreateh: Noted for hacking Mark Zuckerberg's Facebook account.

Black Hat Hackers: Malicious Criminals

• Analogy: Described as being like The Joker, performing illegal activities for financial gain, personal challenge, or amusement.

• Legal Definition: Individuals who attempt to break system security without legal permission. Without permission, the act is criminal; with permission, the hacker is referred to as a 'sneaker.'

• Tactics and Impacts:

  • They actively seek vulnerable computers over the internet to exploit.

  • They distribute malware (ransomware, viruses).

  • They hold computers 'hostage' or steal sensitive data like passwords, credit card numbers, and intellectual property.

  • While some are used in government intelligence, most work solo or within organized crime groups for economic gain.

• Specific Attack Methods:

  • Installing backdoors for persistent access.

  • Performing privilege escalation.

  • Downloading intellectual data.

  • Launching ransomware and phishing campaigns.

• Notable Black Hat Examples:

  • Kevin Mitnick: Once the most wanted cybercriminal in U.S. history; later founded a cybersecurity company.

  • Julian Assange (Mendax): Creator of WikiLeaks.

  • Hamza Bendelladj (Bx1): Owner of the ZeuS Banking Malware.

  • Kevin Poulsen (Dark Dante): Later created SecureDrop.

  • Robert Tappan Morris: Creator of the Morris Worm; later became an MIT professor.

Global Challenges and Case Studies

• The WannaCry Ransomware Example: Released in May $2017$, this attack infected approximately $400,000$ computers across $150$ countries within the first two weeks.

• Response and Financial Impact: Security experts released decryption tools within days. Fast response limited extortion payments to approximately $\$120,000$, which was slightly more than $1\%$ of the potential haul.

• Jurisdictional Complexity: The global nature of hacking makes it difficult to stop. For example, the Microsoft phone scam led to arrests of $4$ people in the UK, but the calls originated in India.

• Law Enforcement Obstacles: Hackers leave minimal evidence, use the devices of unsuspecting victims, and operate across multiple jurisdictions. Node-based operations allow groups to function and maintain uptime $24/7$.

• Recommended Proactive Protection:

  • Maintain active firewalls.

  • Run reputable antivirus and antispyware software.

  • Install operating system updates immediately.

  • Avoid downloading from unknown sources.

  • Disconnect from the internet when not in use to reduce exposure.

Ethics in Hacking: The (ISC)² Code

• Ethical Framework: White hats operate under a code of ethics, specifically the universal standards defined by (ISC)² (last updated $2017$).

• The Four Canons of the (ISC)² Code:

  • Protect: Responsibility to protect society, the common good, and infrastructure. This includes teaching safe usage to others.

  • Act Honorably: Duty to tell the truth at all times and keep employers/clients fully informed of activities.

  • Provide Service: Providing diligent, competent, and fair service; offering prudent advice.

  • Advance the Profession: Maintaining the trust and privileges of the profession, avoiding conflicts of interest, and only providing service in areas of personal competence.

The Theory of Attacker's Advantage

• The concept of 'Attacker's Advantage' (as defined by Howard & LeBlanc, 2003) explains why defense is inherently more difficult than offense. It consists of four distinct parts:

• 1. Choice of Point: The defender must protect every single potential entry point ($100\%$ coverage required). The attacker only needs to find and exploit the single weakest or most convenient point.

• 2. Known vs. Unknown: Defenders generally only defend against established attack vectors. Attackers can probe for 'novel' or unknown vulnerabilities. It is statistically unlikely that discoveries of novel vectors will occur for the defender and attacker simultaneously.

• 3. Vigilance vs. Will: The defender must maintain constant, unwavering vigilance ($24/7$). The attacker can choose the exact moment to strike, often when defenses are perceived to be down.

• 4. Rules of Engagement: Defenders are constrained by legal frameworks, professional ethics, and public scrutiny. Attackers have no such constraints and are free to use any 'dirty' tactics or means necessary to reach their goal.