Might break into computer systems to heighten awareness of security flaws, won’t announce vulnerabilities until company is ready or found to be unresponsive, hacks systems for own gain or for malicious reasons, releases exploit code that isn’t easily modified for hacking security, will only attack systems when authorized by the owner, keeps vulnerability information to trade with other black hats on closed lists.
| White hats | Grey hats | Black hats | |
| Ideology | works to secure computer systems without breaking into them | Cares more about controlling systems and accessing protected information than about securing computers | |
| Information handling | announces vulnerability publicly without informing software company, or on the same day that software company is notified | ||
| Use of code | will show software maker - but no one else – how to exploit vulnerability | Won’t publish publicly, instead keeps for own use. | |
| Hacking ethics | explores holes, then notifies owner of system that it’s vulnerable |
III. Comment on the following quotations:
1. “We choose the term “grey hat” to represent the independent researcher who didn’t have a vested interest in any particular company or product”
Chris Wysopal,
Director of research and development group for security firm @Stake
2. “We are reaching a crossroad where decisions have to be made… Are they going to continue to function as a security consultant or go to the dark side?”
Howard Schmidt,
Vice-chairman White House’s Critical infrastructure Protection Board
3. “If you’re grey, you are black”
Peter Lindstrom,
Director of security strategies, the Hurwitz Group
4. "No matter what color your hat, you need to realize that there is a greater dependency on networks today."
Howard Schmidt,
Vice-chairman White House’s Critical infrastructure Protection Board
5. "Companies say, 'We don't hire hackers.' But you go there and they have a room full of them"
md5,
A member of the GhettoHackers, a Seattle-area group of white hats
:-0 Perhaps white and black colors are just shades of grey…
%-) Only God knows…
IV. Outline a profile of a modern hacker. It might be a white hat, a black hat or a grey hat hacker. Mind the following aspects:
Background, education, job
Age, gender, marital status
Appearance
Features of character, manner of behavior
Personal contacts, friends
Professional skills, experience
Jigsaw Activities
Work in pairs. Student A read the information about the “414” hacker group. Student B read the information about the “Cult of the Dead Cow” hacker group. Ask each other the questions and complete the chart given below the text.
Hacker Groups
| The 414s is a group of hackers who broke into dozens of high-profile computer systems in the early 1980s. They took their name after the area code of their hometown of Milwaukee. The 414s were investigated and identified by the FBI in 1983. Six teenagers were in the limelight and were described by mass media as meeting the profile of computer hackers at the time: “Young, male, intelligent, highly motivated and energetic”. Many saw the 414s as harmless pranksters, but actually they caused a real concern,as many computer experts realized that others could duplicate their techniques and do real damage. They used inexpensive personal computers and simple hacking techniques, such as using common or default passwords and exploiting well-known, but unpatched, security holes. The 414s claimed they didn’t intend to cause any damage; their only motivation was the challenge of getting into places they weren’t supposed to, and remaining there undetected. Gerald Wondra from a Milwaukee suburb, 22 at the time, was the first visited by the FBI. He had done the damage to the Sloan-Kettering Cancer Center computers. Wondra said he was "curious, he was just having fun". The members of the 414s were not prosecuted and didn’t pay any fines. As a result of their activities, the public learned much about the dangers of computer hacking. On September 26, 1983 six bills concerning computer crime were introduced in the U.S. House of Representatives. | CULT OF THE DEAD COW ((___))[ x x ] \ / (' ') (U) Cult of the Dead Cow, also known as cDc, is a computer hacker and media organization founded in 1984 in Lubbock, Texas. The group was formed at the Farm Pac slaughterhouse by Grandmaster Ratte', Franken Gibe, and Sid Vicious. Its name is perhaps a reference to the debugging method of initializing unused memory with the hex value DE AD BE EF. The group maintains a weblog on its site, also titled "CULT OF THE DEAD COW." New media are released first through the blog, which also features thoughts and opinions of the group's members. Over the years cDc members have granted interviews to major newspapers, print magazines, online news sites, and international television news programs. In December 1990, cDc member Drunkfux gave birth to the modern hacker con. HoHoCon, usually held in Houston, Texas, was the first hacker conference which invited the participation of both journalists and law enforcement. October 1994 saw the creation of the cDc's Usenet newsgroup. It was thus the first hacking group to have its own Usenet newsgroup. In 1999, the cDc created Hacktivismo, an independent group under the cDc communications umbrella dedicated to the creation of anti-censorship technology in furtherance of human rights on the Internet. Also in February 2000, cDc member Mudge briefed President Bill Clinton on internet security. |
1. What is the name of the hacker group you have just read about?
2. When was the hacker group founded?
3. Where is it located?
4. Who are the founders/members of the hacker group?
5. How are the hacker group members characterized?
6. What was their activity?
7. What was the result of their activity?
8. What is the motivation of their deeds?
9. What is their current activity?
10. What is your attitude to the hacker group members and their activity?
| Hacker group name | Years of foundation | Location (country, city) | Founders /Members | Famous /Notorious Deeds | Present activity | Your attitude to the hacker group |
| cDc |
In the news…
When people read a newspaper they rarely want to read all the articles. Usually they check the headlines and choose the articles they find interesting. Look at the following newspaper headlines:
