Hacking: Helpful or Harmful?

7:19 PM ---
Every action on which human or a person do has its own category whether you consider it good or not. Hacking as our topic also contains different areas or levels. But from this point, from your own opinion, where can you consider hacking as an ethical or unethical? Do you consider hacking to be helpful or harmful?

Let us start analyzing these things first. On our previous articles, those hackers who are aligned in the group of white hat hackers are consider to be ethical since they are the information and cyber security specialists who are well-versed in system examination, penetration testing, and many other network analysis approaches that guarantee the safety and integrity of many a company's information system.

Another one which is the antonym of this is the black hat hacker. Under this group, they are also known as crackers or dark-side hackers. Crackers break things and they are computer security hackers that break into computers and networks or also create computer viruses. This definition was all came from our previous blog post. When you combined this white hat hacker to black hat hacker, possible, this will become a gray hat hacker on which in the hacking community, a grey hat refers to a proficient and tech-savvy hacker who is ambivalent enough to sometimes use his program manipulating skills to act illegally in either good or ill will. Their intentions for hacking don't usually delve into any of the traditional well intention or maliciously driven extremes; that is, they may or may not commit crimes from time to time during the course of their digital undertakings, so they're not exclusively indulging on any one type of activity like their security-improving or network-destroying counterparts would.

So if you will define hacking and analyze it if this will be consider as helpful or harmful, these hackers falls into different areas.

While doing and preparing this new blog post, I asked some of my social media friends if hacking for them can be consider as helpful or harmful and why. So I started to put a survey and share it to them and some of their answers are:

For this certain kind of reasons, still hacking is a form of an illegal action but if you have that ethical mind and consider the possible consequences that you may encounter that is the only way you can answer if hacking is helpful in the way how you used it or harmful in some other way around.
Posted by Unknown at 7:19 PM 3 comments

Dare: Will you be a Hacker?

10:35 AM ---
After discussing some of my post here about hacking, I have not given any ideas yet about how to hack and some tools to use when you are doing this kind of action. So before going to somewhere else that can lead to some destruction, no I don’t mean that thing. What I mean is that before going to any discussion, let me share you some of my adopted skills I also learned online, through video tutorials, web forums and other social media sites. I do not own any of this skills and I thank the web hacking community for sharing this ideas also to others who want to learn this kind of learning. I only use hacking as an ethical hacking and for good stuff. Yet sometimes for some reasons which are hard to explain.


If you are using Windows operating system or a Linux based OS, or even both if you want, you can see lot of applications online and some of them are in categorized. It can be for school purposes, system of your computer (i.e. antivirus, speed up your pc) and other application such as for games or just for own purpose to explore it and many more. One of my used applications when it comes to hacking is BackTrack Linux.



It is a Linux based OS but the only difference of it when it comes to other usual Linux OS is that, it has a built in hacking tools that you can use on different areas. BackTrack Linux on which you can check its full meaning online has different versions. As of now, the latest version is the release 3. You can download the application on its website. But the one I’m using right now is the release 1, the KDE type. Since the release 3, well I don’t know if it has a problem but I can’t configure my hacking tools correctly so I started to downgrade my version then all works fine after using the release 1. One of my favorite tools about it is the hacking of Wi-Fi whether it is a WEP or WPA format. 

If you only know the commands since you will deal always on the terminal once you used it, you can start decoding the Wi-Fi you want to access. Other tool of the BackTrack Linux is getting the credentials of other users.

Like yamas, one of the applications you can use right away if you download the .sh file and all the working tools beside you.  Its purpose is to get the credentials of the IP address you are attacking to. Just make sure the firewall on the persons pc is enable. Because once the secured antivirus like Kaspersky is installed on it, it can deny all the access trying to control to your pc. This will enable you to see what credentials the user type and see the username and password. Knowing this kind of activities and tools like wireshark are things we learn from our previous subject, Information Security. Our professor always thought us that we only use this hacking for school purposes only and will not go beyond other illegal activities.


While using this application, I can still access my Windows 8 Pro OS. The reason about this is that, I only use Oracle Virtual Box when I want to use my BackTrack Linux. Just download the BackTrack Linux OS, install it in your VBox, run it, make sure you have all the working tools, the internet access and a Wi-Fi connection then done. Watch and search different kind of utilities you want to use in BackTrack, explore it and you can be a hacker. Not that pro hacker but at least you know what other hacking tools hacker used to hack. 

After sharing this, how can you consider yourself now? Do you want to start this activity right away and be hacker one day? As what BackTrack Linux said that “the quieter you become, the more you are able to hear.”
Posted by Unknown at 10:35 AM 0 comments

Ethical hacking on which Hacktivist usually does

9:25 AM ---

Hello. I’m here again to post new article about hacking. But after we go on our discussion, how are you? Have you considered hacking as an ethical or unethical? Or you are also part of those hacking activities? And where do you consider yourself to be (White, Black or Grey Hat Hacker)?


 Hacking on the point of view of this hacktivist is something to be as a grey hat hacker. As I went on searching for some interesting topics regarding this there were three websites that can explain also this kind of topic.

Ethical Hacking which was define by the Group GT2-S1 in their blog site named Cybercrime, under their topic Ethical Issues, this kind of hacking “that comes into play with cybercrime, “Ethical hackers,” or “white hat hackers” are those who try to compromise computer systems for the sake of informing the content owner so they can fix the problem. Some security professionals do this for a living, so there is no ethical issue, since the target company is aware of and is paying for this service.” Moreover with this, “sometimes the motivations of hackers play into how hacking is viewed in the ethical realm. When hackers attack something for some type of gain, monetary or otherwise, that would come at the cost of the targeted system, they are often looked down upon – there is not really an ethical ground to stand on in this case. But when hackers break into systems for fun, or to better their own skills and learn more about security, there is an ethical gray area. Motivation definitely affects how hackers and their actions are viewed by others, but does motivation play a part in the ethics of the action?”


Hacktivism, still on the article I found online, “is exactly what it sounds like: hacking + activism, using computers and the Internet to promote a political or social cause. Obviously, some types of hacktivism are illegal, like breaking into proprietary systems or stealing information. Some types of hacktivism are legal, like website parodies. One of the most common types of hacktivism is a denial of service attack. This attack involves sending large amount of traffic to a certain website until it reaches its limit and crashes. More recently, DoS attacks have been done in a distributed manner, so that traffic comes from hundreds or thousands of nodes around the world. This makes the source of attacks much harder to trace. DoS attacks are illegal under US law, but very hard to enforce.”  While reading this, the author believed that Hacktivism is in an ethical grey area. But there are some questions still unknown which are, “Today, the Internet is the primary medium for our communication, and grassroots movements are using it as such. Is it ethically acceptable for social causes to use hacktivist techniques to further their opinion? Where should the line be set? How do we balance free speech rights and still protect corporations and individuals from too much hacktivist harm?”

Going to the second article I found, from the Network Security Resource, based on their article, “The debate on the information protection industry”, Ethical Hackers and Politics on this content was considered as a “third type of hacking for the greater good diverges significantly from this framework, hacktivists generally seek to pursue a political goal through blatant attacks on computer systems. The attacks are often not very sophisticated - hacktivism by and large differs from the other hacker forms discussed above in that the political goal completely overshadows concerns for demonstrations of technical ability and networking finesse. Many ethical hackers are opposed to standard hacktivist techniques, which include replacing home pages with political content and pseudo-denial of service attacks that make web sites inaccessible for a period of time.” Stephen Wray, in Electronic Civil Disobedience and the World Wide Web of Hacktivism: A Mapping of Extra parliamentarian Direct Action Net Politics discusses a subgenre of hacktivism, electronic civil disobedience. These hacktivists generally acknowledge that some of what they are doing (changing the content of targeted web pages, for example) is and should be illegal. Hacktivists are not trying to call attention to networking issues. They want to use the network to call attention to broader political issues. They borrow "the tactics of trespass and blockade from . . . earlier social movements" to generate greater public awareness of an issue. Electronic Civil Disobedience, following this heritage, generally is undertaken in the open, without pseudonyms and without efforts to avoid arrest. Ironically, hacktivists may be in complete agreement with that establishment about the legitimacy of the ownership of information and the need to secure that information on networks. Like civil disobedient before them, they don't (necessarily) claim that the laws they are breaking are wrong, or even that their actions are not disruptive - they simply claim that sacrifices can and should be made to higher goals. More recently, hacktivist activity is taking place in the name of superpower rivalry between China and the United States. Conclusion that the author written about this was, “Even for those who do not count themselves among the ranks of the ethical hackers, it is important to be aware that security often does come at the expense of openness, convenience and efficiency. University systems are acutely aware of this (as are hackers), and in keeping with general commitments to openness and the free exchange of ideas, have much less secure systems. Information technology security is often the challenge of balancing the demands of users with the need for data confidentiality and integrity.”

Lastly, from Mr. Vic Hargrave on his article, Hacker, Hacktivist, or Cybercriminal? “Hacktivism does not fit neatly into either white hat or black hat categories.  Unlike either their white hat or black hat counterparts, hacktivists are motivated by politics not profit.  They find themselves at ideological odds with many organizations and feel justified in their computer attacks against them.  However, depending on whether or not you agree with a given hacktivist group’s point of view, you could see hacktivists as either white hats or black hats. In October, 2011, Anonymous took down 40 child pornography websites and publicly revealed the names of over 1500 people who frequented those sites. But the group also attacked computers belonging to the Bay Area Rapid Transit (BART) and leaked personal information of over 2000 BART users on the Internet. This was done in retaliation for BART officials shutting off cell phone service to prevent people from communicating to coordinate a protest against a police shooting on a BART train.  Whether or not Anonymous agrees with BART’s actions is not really the important thing. The group took action against BART without due process and leaked personal information of BART users who were unlucky enough to get caught in the crossfire of this feud.”


To a certain extent, hacktivists blur the distinction between white hat and black hat hackers. They often get involved in illegal activities but, as we’ve seen with Anonymous, for causes that can in some cases can be considered just. Hacktivists in another category of hacker can be known as grey hat. The term grey hat was coined by the hacker group L0pht back in 1998. It was originally used to describe hackers who report the vulnerabilities they find to the organizations whose computers security they breach. Later in 2002, the Anti-Sec community used the term to describe people that work in the security community during the day and work as black hat hackers on off hours. Since 2002 grey hat has taken on diverse meanings.  The Electronic Frontier Foundation, a non-profit digital rights advocacy group, defined grey hats as ethical hackers who inadvertently or intentionally violate the law to research and improve security.  It is this definition that can be best applies to hacktivists, except that they are not so much interested in improving security as they are in advancing their political causes.
Posted by Unknown at 9:25 AM 2 comments

Hacking Law: Rules obtaining to Cybercrime Law of the Philippines

8:08 AM ---
I was discussing at that time on our information and security class when my professor asked me to continue my report next meeting since I am the one who has the most number of pages in the assigned reports and I was run out of time. At that moment, he told me to search about the cybercrime law and e –commerce law in the Philippines. While searching for it, I also reviewed what are those chapters discussed about that laws and there I taught that it not just about the negative reaction of other web citizens are applied because the law, for example the cybercrime law, just want to prevent any harmful data and child pornography. E-commerce or known as the Electronic Commerce Act of 2000 (Republic Act No. 8792) on the other hand, explained the views and point of providing recognition for the use of electronic commercial and non-commercial transactions and documents, penalties for unlawful use thereof and for other purposes.

It is nice to know the law and carefully understand what are written there to avoid any penalties. Having those rules, what I am going to discuss here is pertaining only to rules of Cybercrime Law but if you want to know also what are written in RA No. 8792, you can follow the link I shared above.

Cybercrime law (Republic Act No. 10175) contains 8 Chapters. This law is an act of defining cybercrime, providing for the prevention, investigation, suppression and the imposition of penalties therefor and for other purposes. The law is already open publicly through the website of Official Gazette, one of the governments of the Philippines websites. It was already approved last September 12, 2012 by the President of the Philippines, Benigno S. Aquino III. Before this law was still implementing, there are lot of negative comments and even online social media sites criticize this law. Many were disagree about this because they said the freedom of speech will be violated since many cannot go on a rally for their protest so what they can do is to post or comment their negative reactions online, through forum or other social media sites. Another thing that pertaining within this law is the downloading of illegal software and other documents that can destruct the business of music industry and doing plagiarism. Other netizens cannot go and buy legal products since some of its prices are expensive so they just go download it on the web (torrent, add-ins application and other downloading process online).

While searching for other online sources of Cybercrime law of the Philippines, I found a good synopsis of the law as appreciated by Janette Toral:  

Types of Cybercrime
Penalty
1. Illegal access
Unauthorized access (without right) to a computer system or application.
Prison mayor (imprisonment of six years and 1 day up to 12 years) or  a fine of at least Two hundred thousand pesos (P200,000) up to a maximum amount commensurate to the damage incurred or BOTH.————————If committed against critical infrastructure: Reclusion temporal (imprisonment for twelve years and one day up to twenty years)or
a fine of at least Five hundred thousand pesos (P500,000) up to a maximum amount commensurate to the damage incurred
or BOTH
2. Illegal interception
Unauthorized interception of any non-public transmission of computer data to, from, or within a computer system.
 - same as above
3. Data Interference
Unauthorized alteration, damaging, deletion or deterioration of computer data, electronic document, or electronic data message, and including the introduction or transmission of viruses. Authorized action can also be covered by this provision if the action of the person went beyond agreed scope resulting to damages stated in this provision.
- same as above
4. System Interference
Unauthorized hindering or interference with the functioning of a computer or computer network by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing computer data or program, electronic document, or electronic data messages, and including the introduction or transmission of viruses. Authorized action can also be covered by this provision if the action of the person went beyond agreed scope resulting to damages stated in this provision.
- same as above
5. Misuse of devices
The unauthorized use, possession, production, sale, procurement, importation, distribution, or otherwise making available, of devices, computer program designed or adapted for the purpose of committing any of the offenses stated in Republic Act 10175.Unauthorized use of computer password, access code, or similar data by which the whole or any part of a computer system is capable of being accessed with intent that it be used for the purpose of committing any of the offenses under Republic Act 10175.
- same as above except fine should be no more than Five hundred thousand pesos (P500, 000).
6. Cyber-squatting
Acquisition of domain name over the Internet in bad faith to profit, mislead, destroy reputation, and deprive others from the registering the same. This includes those existing trademark at the time of registration; names of persons other than the registrant; and acquired with intellectual property interests in it. Those who get domain names of prominent brands and individuals which in turn are used to damage their reputation – can be sued under this provision. Note that freedom of expression and infringement on trademarks or names of person are usually treated separately. A party can exercise freedom of expression without necessarily violating the trademarks of a brand or names of persons.
- same as above
7. Computer-related Forgery
Unauthorized input, alteration, or deletion of computer data resulting to inauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic, regardless whether or not the data is directly readable and intelligible; or The act of knowingly using computer data which is the product of computer-related forgery as defined here, for the purpose of perpetuating a fraudulent or dishonest design.
Prison mayor (imprisonment of six years and 1 day up to 12 years) or a fine of at least Two hundred thousand pesos (P200, 000) up to a maximum amount commensurate to the damage incurred or BOTH.
8. Computer-related Fraud
Unauthorized input, alteration, or deletion of computer data or program or interference in the functioning of a computer system, causing damage thereby with fraudulent intent.
- same as above Provided, That if no damage has yet been caused, the penalty imposed shall be one (1) degree lower.
9. Computer-related Identity Theft
Unauthorized acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, whether natural or juridical.
- same as above
10. Cybersex
Willful engagement, maintenance, control, or operation, directly or indirectly, of any lascivious exhibition of sexual organs or sexual activity, with the aid of a computer system, for favor or consideration. There is a discussion on this matter if it involves “couples” or “people in relationship” who engage in cybersex. For as long it is not done for favor or consideration, I don’t think it will be covered. However, if one party (in a couple or relationship) sues claiming to be forced to do cybersex, then it can be covered.
Prison mayor (imprisonment of six years and 1 day up to 12 years) or a fine of at least Two hundred thousand pesos (P200, 000) but not exceeding One million pesos (P1, 000,000) or BOTH.
11. Child Pornography
Unlawful or prohibited acts defined and punishable by Republic or the Anti-Child Pornography Act of 2009, committed through a computer system.
Penalty to be imposed shall be one (1) degree higher than that provided for in Republic Act 9775, if committed through a computer system.
12. Unsolicited Commercial Communications (SPAMMING)
The transmission of commercial communication with the use of computer system which seek to advertise sell, or offer for sale products and services are prohibited unless:
(a) There is prior affirmative consent from the recipient; or(b) The primary intent of the communication is for service and / or administrative announcements from the sender to its existing users, subscribers or customers; or(c) The following conditions are present:(aa) The commercial electronic communication contains a simple, valid, and reliable way for the recipient to reject receipt of further commercial electronic messages (opt-out) from the same source;(bb) The commercial electronic communication does not purposely disguise the source of the electronic message; and
(cc) The commercial electronic communication does not purposely include misleading information in any part of the message in order to induce the recipients to read the message.
Imprisonment of arresto mayor  (1 month and one day to 6 months)
or a fine of at least Fifty thousand pesos (P50,000) but not exceeding Two hundred fifty thousand pesos (P250,000) or both.
13. Libel
Unlawful or prohibited acts of libel as defined in Article 355 of the Revised Penal Code, as amended committed through a computer system or any other similar means which may be devised in the future. Revised Penal Code Art. 355 states Libel means by writings or similar means. — A libel committed by means of writing, printing, lithography, engraving, radio, phonograph, painting, theatrical exhibition, cinematographic exhibition, or any similar means, shall be punished by prison correctional in its minimum and medium periods or a fine ranging from 200 to 6,000 pesos, or both, in addition to the civil action which may be brought by the offended party. The Cybercrime Prevention Act strengthened libel in terms of penalty provisions. The electronic counterpart of libel has been recognized since the year 2000 when the E-Commerce Law was passed. The E-Commerce Law empowered all existing laws to recognize its electronic counterpart whether commercial or not in nature.
Penalty to be imposed shall be one (1) degree higher than that provided for by the Revised Penal Code, as amended and special laws, as the case may be.
14. Aiding or Abetting in the commission of cybercrime Any person who willfully abets or aids in the commission of any of the offenses enumerated in this Act shall be held liable.
Imprisonment of one (1) degree lower than that of the prescribed penalty for the offense or a fine of at least One hundred thousand pesos (P100,000) but not exceeding Five hundred thousand pesos (P500,000)or both.
15.  Attempt in the commission of cybercrime Any person who willfully attempts to commit any of the offenses enumerated in this Act shall be held liable.
 - same as above
16. All crimes defined and penalized by the Revised Penal Code, as amended and special laws, if committed by, through and with the use of information and communications technologies shall be covered by the relevant provisions of this Act.
Penalty to be imposed shall be one (1) degree higher than that provided for by the Revised Penal Code, as amended and special laws, as the case may be.
Although not exactly a cybercrime, I am including this here as penalties are also imposed by the law.
17. Corporate Liability. (Section 9)
When any of the punishable acts herein defined are knowingly committed on behalf of or for the benefit of a juridical person, by a natural person acting either individually or as part of an organ of the juridical person, who has a leading position within, based on:(a) a power of representation of the juridical person provided the act committed falls within the scope of such authority;(b) an authority to take decisions on behalf of the juridical person. Provided, That the act committed falls within the scope of such authority; or(c) an authority to exercise control within the juridical person, It also includes commission of any of the punishable acts made possible due to the lack of supervision or control.
For sanctioned actions, Juridical person shall be held liable for a fine equivalent to at least double the fines imposable in Section 7 up to a maximum of Ten million pesos (P10,000,000).For neglect such as misuse of computer resources that resulted to cybercrime committed in organization physical or virtual premises or resources, juridical person shall be held liable for a fine equivalent to at least double the fines imposable in Section 7 up to a maximum of Five million pesos (P5,000,000).Criminal liability may still apply to the natural person.

For the news summary on which written by the Associated Press last October 9, 2012, the article was News Summary: Philippine cybercrime law suspended. It was discussed that while “ON HOLD: The Philippine Supreme Court has suspended implementation of the country's anti-cybercrime law while it decides whether certain provisions violate civil liberties. ABOUT THE LAW: The law, signed last month, aims to combat Internet crimes such as hacking, identity theft, spamming, cybersex and online child pornography. THE CONCERNS: Journalists and rights groups oppose the law because it makes online libel a crime and because it blocks access to websites deemed to violate the law. They fear such provisions will be used by politicians to silence critics, and say the law also violates freedom of expression and due process.” Since this law was already implemented, hacktivist and other social net citizens continues to post and comment whatever they seen on the government , other resources  and new updates from movies to music can still be downloaded illegally online and it seems like there are no updates on what the government will do about those things happening on the cyber web.
 
Posted by Unknown at 8:08 AM 0 comments

Hackers and what they are into

5:21 AM ---
I have been searching for some of my topics to be discussed here again.  I found out that since were in hacking you might think of course I will also post new topics about who are some of this hackers or I will list those top 10 hackers but yeah that is what I am going to post here but not as a list since lot of information can be found now on the internet. There may be a list of it on those online sources and some post were created as slideshow but what I am going to do now is of course share to you who are those mostly appeared on the list.

Hackers as what I shared on my previous post can be classified if they are white hat hacker, black hat or grey hat hackers. Only few white hat hackers and grey hat hackers can be seen on those online sources since mostly appeared are those considered as notorious hackers. I found some good sources online about this people who are involved in this area and let us arrange them according to their ages:
According to this site siliconindia news about their article World's Top 10 Hackers Ever, 
Kevin David Mitnick started with his minor cybercrimes when he was 12 years old. He hacked the Los Angeles bus transfer system to get free rides the biggest hacking was the breaking into the DEC system to view the VMS source code (open virtual memory system which lead to the clean-up cost of around $160,000. He broke into the computer of top technology and telecommunications like Nokia, Motorola, Fujitsu Siemens and sun Microsystems. He termed his activity as social engineering to legalize his acts. He also gained the full administration privileges to IBM minicomputers at the computer learning institute in Los Angeles for a bet.
 
Jonathan James, 16 –year –old black hat hacker in the United States. He gained to implementing a series of successful intrusion into various systems. He was well talented in hacking government systems such as NASA and the department of defense. But he is no more. Because on May 18, 2008, aged 25, he committed suicide using a gun. James in his suicide note expressed that he would be made a scapegoat and blamed for cybercrimes he did not commit: “I have no faith in the ‘justice’ system. Perhaps my actions today, and this letter, will send a stronger message to the public. Both way, I have lost control over this situation, and this is my only way to regain control,” as given in List verse.
 
Michael Calce started to exploited websites primarily for pride and establishing dominance for himself and his cyber group. He is a high school student from west island, Quebec who launched service attacks in the year 2000 against the top commercial websites including Yahoo!, amazon.com, Dell, E-trade, E-Bay and CNN.

The deceptive duo in the year 2002, this two young computer prodigies namely Benjamin Stark, 20 and Robert Lyttle, 18 broke into government networks, including the U.S. navy, NASA, FAA and Department of Defense (DoD).


Raphael Gray, 19 years old when he hacked the computer systems around the world in over six weeks, and made mockery of the security the world felt safe in. His mission was to make a multi- million pound credit card. He published about 6,500 credit cards as an example of weak security in the consumer websites.
 
Adrian Lamo who is on his teenage years, was born in Boston, He was a homeless hacker since he used internet café, libraries and coffee shop as his location for hacking. He gained to breaking into a series of high profile computer software and networks like the New York Times, yahoo and Microsoft.

While I am still searching and reading articles from other online sources, I also want to share what I found on Tech Crackers Website, based on their article Top 10 Hackers in the World,
George Hotz, also a teenage hacker, is an American hacker known for unlocking the iPhones .He is the first person to hack the Sony play station 3. This is the most hacking attention in his future.
 
Vladimir Levin, a Russian citizen .This hacker done his hacking through the Citibank. While working from his apartment in St. Petersburg the talented hacker transferred $10 million from the account of Citibank clients to his own account.
 
More notorious hackers and most notorious on what I shared here can still be found online but what I only listed here are those who hacked different kind of system and government agencies which are on their teenage years. Imagined how computers can really attack on humans mind. Once you learned the technique, style and skills in coding, accessing different database and servers and social engineering while you are young, you can also do this kind of acts but of course doing this kind of action can lead into several punishments. From Hegel quotations from his Philosophy of Right (1921) he said, “Action has a multitude of consequences. Thus the will has the right to repudiate the imputation of all consequences except the first, since it alone was purposed.” And so by Tony Robbins quotation, he said, “In essence, if we want to direct our lives, we must take control of our consistent actions. It's not what we do once in a while that shapes our lives, but what we do consistently.”
Posted by Unknown at 5:21 AM 2 comments

White Hat + Black Hat = Grey Hat

5:39 AM ---


Were done discussing the White and Black Hat Hacker, now we are going to hybrid those two that will fall under the Grey Hat Hacker (or Gray Hat Hacker). Grey Hat Hacker based on SecPoint website: What is a Grey Hat?, “In the hacking community, a grey hat refers to a proficient and tech-savvy hacker who is ambivalent enough to sometimes use his program manipulating skills to act illegally in either good or ill will.” “Their intentions for hacking don't usually delve into any of the traditional well-intentioned or maliciously driven extremes; that is, they may or may not commit crimes from time to time during the course of their digital undertakings, so they're not exclusively indulging on any one type of activity like their security-improving or network-destroying counterparts would.” From this, Grey Hat Hackers are in between the two and it is in grey hat hacker hands what he or she will prefer to be. But can you imagine what can grey hat hacker really do? And why they chose to be in between those two? (White and Black Hat Hacker).

Another lines from SecPoint website: What is a Grey Hat?, “One of the reasons why a grey hat would categorize himself as "grey" is to distance himself from the two opposing hacker spectrum white and black, constructive or malicious. For instance, even though a grey hat could gain unauthorized access to a network (an illegal crime in most jurisdictions), he could, at the same time, provide a patch for the exposed vulnerability that allowed him access in the first place without compromising the system he invaded. Also, grey hats may or may not disclose vulnerabilities to the administrators or the general public, or they could even sell them to either white hats or black hats if they so choose.” Here, grey hat hackers are still cracker on which they also exploits a security weakness in a computer system or product in order to bring the weakness to the attention of the owners but what they do is that they act without malicious intent and their goal is to improve system and network security. However, by publicizing a vulnerability, the gray hat may give other crackers the opportunity to exploit it. Unlike white hat hacker who alerts system owners and vendors of a vulnerability without actually exploiting it in public. (Based on SearchSecurity: gray hat or grey hat).

On this part, Grey hat hacker are considered also as one of the ethical hackers in the hackers’ community. They are the one who mostly formed group of hacktivist on which from forums, to organizations, this group also lead into Hacktivist world on which they have their own set of rules and hack into some systems as a form of protest. One of those famous known group on which can also be considered part of this are the Anonymous. We can see lot of them do protest on the government websites. They also have this kind of quotations, The Mentor quotes: “We explore and you call us criminals.  We seek after knowledge and you call us criminals...Yes, I am a criminal.  My crime is that of curiosity...My crime is that of outsmarting you, something that you will never forgive me for (Mentor, para. 9).” This is an informal attempt to record some kind of record of motivation can be found in the short essay titled "The Conscience of a Hacker" written on January 8th, 1986 and published in the online hacker magazine Phrack, more famously known as "The Hacker Manifesto". The essay became a cornerstone of hacker culture and is probably still the most well-known essay on hacking in existence.

Hacktivism which is still under this grey hat hacker is the development and use of technology to foster human rights and the open exchange of information, or more simply 'hacking for political purposes'. Brought into the mainstream by the hacker group Cult of the Dead Cow (cDc) in the mid-1990s and widely defined as a form of grey-hat hacking due to its sometimes quasi-legal nature, the term 'hacktivism' is often abused misused similar to its cousin 'hacking'; this leads to a dirtying of the public perception of the word. However, the genesis of 'hacktivism' was a benign one. We can see lot of anonymous now a days on the internet since technology runs fast. Communicating and expressing one’s self or as a group which is against the political state of the country can be done now through online. And by using the hacking tools and skills they have, they show it in public. Mostly of the domains they used were from the government websites since their request will be heard directly from all those government sectors. Around the globe, there are lot of Anonymous groups and they do this things not just for their own privileges but also for other people in worldwide web community.

http://news.cnet.com/8301-27080_3-20051482-245.html

Sony sites offline after Anonymous attack threats


Moreover with this Anonymous, “Beginning in 2008, Anonymous started promoting collaborative global hacktivism by performing combined protests to promote freedom of Internet speech. Anonymous group activities are managed by unidentified yet self-attributed Anonymous members. Internet forums and image boards are key sources for Anonymous recruitment, as well as wikis and other Internet Relay Chat (IRC) networks. Anonymous uses such mediums to communicate and organize protests.” We cannot really dictate anonymous as a black hat hacker or even white hat hacker because he or she may use his or her skills for legal or illegal acts, but not for personal gains. Grey hackers use their skills in order to prove themselves that they can accomplish a determined feat, but never do it in order to make money out of it. While I’m searching for some reading about this grey hat hackers, I found a website on which they are into grey hat but for security purposes and group of grey hat hacker community. It is the Greyhat Security. The site show their legal purpose and uses of their website and the two main purposes of it were Education and Teach advanced techniques to legal Penetration Testers. You can view and read it here: Legal for further research about that website.

Lastly, Grey or Gray Hat Hacking also have a book about ethical hacking. Based on reviews about this book (Gray Hat Hacking: The Ethical Hacker’s Handbook), “It is an ethical hacker’s handbook which combines a highly pedagogical approach with advanced knowledge of security vulnerability, discovery, and exploitation. The process of discovering and exploiting security vulnerabilities is a multiphase one: first, a series of laws must be considered and addressed, to avoid legal prosecution. Next, a network must be scanned, and potentially vulnerable machines detected. The final phase is exploitation, where vulnerable applications are injected with user-controlled data, and the underlying machine is “owned.” These phases are common to both black hats and professional penetration testers, hired for assessment and testing purposes. The authors describe all of these phases in great detail.” Being ethical in what we do is really important because it is where other people and society measures on how you respect yourself as an individual.
Posted by Unknown at 5:39 AM 3 comments
Subscribe to: Posts (Atom)