Ethical hacker

An ethical or “white hat” hacker is the term given to an expert in information technology security. Ethical, meaning they do not use their skills to access systems for personal gain (this is the term given to a “black hat” or non-ethical hacker), but instead use their knowledge and experience to test systems for exploits and vulnerabilities to protect these systems.

History of the Ethical Hacker

Ethical hacking began as early as the 1970’s when the US government attempted to hack it’s own system. Later, in the 1980’s ethical hacking moved into the telecommunications business where they had been targets of “cybervandals” trying to damage local telephone companies. In the 1990’s as banks became more available online, they too began to make use of ethical hacking to protect themselves. Following shortly behind the banks came e-commerce websites (think Amazaon) who also made use of ethical hacking to protect themselves.

What an ethical hacker looks for

A White Hat will use ethical hacking methods to answer three basic questions:

1. What can an intruder see on the target systems?
   • What data is available to a hacker should he\she gain access to the systems? This could be anything from pictures to business documents to information databases.
2. What can an intruder do with that information?
   • Can the intruder read the data, copy the data or even delete the data? Can they modify the data they gain access to in any way?
3. Does anyone at the target notice the intruder’s attempts or successes?
   • Are there any alerts should a hacker gain access to the target system? This is probably the most important question that a White Hat will answer because it indicates how long an attacker may attempt to gain access to a system before they succeed fully (and they will eventually given enough time).

Methods an ethical hacker will use to obtain their data

A ethical hacker will make use of both technological and non-technological methods to reach their goals.

Penetration Testing

Penetration testing is the simulation of an attack by a true “Black Hat” hacker. Penetration is the use of different methods, techniques and tools to test and evaluate the strength of an organization’s security and to detect if any vulnerabilities exist. Penetration testing unlike other forms which theorize a systems vulnerability will actively test an organization’s security system by using real “system hacking” techniques to try and break through. A penetration test will attempt to use the same methods that a hostile attacker will attempt to use to gain access through an organizations security. A penetration test will take one of two possible approaches.

• “Black Box” – like most things, black box relates to having no knowledge of the inner workings of what you are assessing\testing\viewing. In the case of penetration testing; black box means the testers have no working knowledge of the target other than the target’s name prior to the commencement of the penetration test. The testers must use different methods to obtain the information themselves that will allow them to access the target’s systems.
• “White-Box” – as with black box, the definition of white box in penetration testing follows the same lines as other areas of IT. White box means the testers know the inner workings of the target right down to the hardware being used. They know the infrastructure of the network and the security configurations allowing them to find vulnerabilities before they even attempt a penetration test.

Social Engineering

Where penetration testing uses technology to gain access to a system social engineering is noticeably lacking in technology. Social engineering is the act of manipulating a person to accomplish goals that may or may not be in the best interest of the target. Like penetration testing the goal is to gain information, gain access to a system(s), unlike penetration testing; social engineering has an added goal of attempting to have the target themselves perform a certain action.Social engineering can make use of the following approaches:

• Pretexting - Lying to the target in order to obtain privileged information. The pretext is the hacker’s motive.
• Diversion Theft - Used mostly with theft, but still considered a Social Engineering method. The purpose is to convince a legitimate delivery person who is bringing a delivery to an address, that the package is requested some where else.
• Phishing - The use of email or websites to gather personal information by pretending to be a trustworthy organization. For example, an ethical hacker may send an email, pretending to be a member of the organizations IT support team in order to have the user provide them with login credentials. They could go further by creating a custom website to pose as a password reset application for the company in order to get passwords and login information.
• IVR or phone phishing (aka. Vishing) - The use of a Interactive Voice Response (IVR) system to create an official sounding Bank IVR system to trick people into providing their personal information. An example is where a hacker will pose as a bank employee or they will even use another IVR message to advise the target they have to call into the bank to correct an issue. They provide a number (not the bank’s) for the target to call in on and when he\she does, they record their account information as it is entered into the phone. A hacker could even perform something similar in that they perform the same method, but instead attack a company employee in order to have them attempt to enter their password via the telephone.