You can categorize a hacker in countless ways, but the “hat”
system seems to have stood the test of time. I don’t know if that’s
because hackers like Western movies or we’re all just fascinated
with cowboy fashion, but it’s definitely something you’ll see over and
over again on your exam. The hacking community in general can be
categorized into three separate classifications: the good, the bad, and
the undecided. In the world of IT security, this designation is given as a hat
color and should be fairly easy for you to keep track of.
- White hats Considered the good guys, these are the ethical hackers, hired by a customer for the specific goal of testing and improving security or for other defensive purposes. White hats are well respected and don’t use their knowledge and skills without prior consent. White hats are also known as security analysts.
- Black hats Considered the bad guys, these are the crackers, illegally using their skills for either personal gain or malicious intent. They seek to steal (copy) or destroy data and to deny access to resources and systems. Black hats do not ask for permission or consent.
- Gray hats The hardest group to categorize, these hackers are neither good nor bad. Generally speaking, there are two subsets of gray hats—those who are simply curious about hacking tools and techniques and those who feel like it’s their duty, with or without customer permission, to demonstrate security flaws in systems. In either case, hacking without a customer’s explicit permission and direction is usually a crime.
While we’re on the subject, another subset of this community
uses its skills and talents to put forward a cause or a political agenda.
These people hack servers, deface websites, create viruses, and generally
wreak all sorts of havoc in cyberspace under the assumption that their actions
will force some societal change or shed light on something they feel to be
a political injustice. It’s not some new anomaly in human nature—people
have been protesting things since the dawn of time—it has just moved from
picket signs and marches to bits and bytes. In general, regardless of the
intentions, acts of “hactivism” are usually illegal in nature.
Another class of hacker borders on the insane. Some hackers
are so driven, so intent on completing their task, they are willing to
risk everything to pull it off. Whereas we, as ethical hackers, won’t
touch anything until we’re given express consent to do so, these hackers are
much like hactivists and feel that their reason for hacking outweighs any
potential punishment.
Even willing to risk jail time for their activities, so-
called suicide hackers are the truly scary monsters in the closet. These guys
work in a scorched-earth mentality and do not care about their own safety or
freedom, not to mention anyone else’s.
