HACKER is a strangely broad term these days. It used to be thought that a hacker was a bad actor – someone who was looking to break into computers and steal data, cause viruses, and manipulate data from afar. However the term hacker is becoming more and more encompassing of those who are on the “good” side. The terms white hat, black hat, and grey hat have become the de facto descriptors of what sort of a hacker someone is.
The terms have come into even more interest lately as hackers have hit world news once again. It turns out the government paid a “grey hat” hacker for a security hole that he had found (a “zero day” hole) in the iOS 9 software that allowed the government to break into the phone of the San Bernardino shooter. So what are these hats and what do they mean?
A black hat hacker is a hacker that most people think of when they hear the term. These hackers search for exploits for profit and destructive “fun”. They will find security holes and then create viruses or malware programs that will cause destruction or havoc on the victims computers. Sometimes the hackers stop there, merely causing problems for the sake of it or to prove some sort of point. Other times hackers will attempt to make a profit, either by stealing credit card or other personal data, or locking up files behind an encryption code and demanding a ransom in exchange for the “key” to get the files back as was the case with several hospitals earlier this year.
A white hat hacker is a hacker that will work to find bugs and holes in code and software but will give this information directly to the vendor or software manufacturer. They used to only get some free swag or a pat on the back, but these days companies often pay these white hat hackers for their finds. Some companies even have bug bounty programs or contests. These hackers ply their trades and use their knowledge for the greater good of the tech community.
Grey hat hackers are fast becoming more recognized. These hackers will find security holes and flaws but rather than sell the info to the companies or to criminals, they sell them to governments, intelligence agencies, and militaries. These are the hackers that helped the government crack into the phone of the San Bernardino shooter. They paid the still-anonymous hacker a hefty one time fee in exchange for the hole. It was considered a zero-day vulnerability because apparently the hacker was the first to find it and nobody knows now except him and the FBI. Apple still does not know what the hole is. These hackers are called “grey” because although they sell them to governments with the presumed intent that they will be used for the public good, the information is sometimes used to spy on dissidents or other governments, take down key areas of public utilties, or simply keep tabs on informants. It’s a complicated transaction.
All these different breeds of hackers certainly makes the world of tech a bit more interesting. It’s a little bit like good witches and bad witches in the Wizard of Oz. We can only hope that with the advent of bug bounty programs as well as security contracting companies that hire hackers in order to package up exploits and sell them to governments that more hackers will lean towards the white or grey end of the spectrum rather than the black.
