Grey hat

A grey hat, in the hacking community, refers to a skilled hacker who sometimes acts illegally, though in good will, and limits their disclosure of vulnerabilities on a need-to-know basis. They are a hybrid between white and black hat hackers. They usually do not hack for personal gain or have malicious intentions, but are prepared to commit crimes during the course of their technological exploits in order to achieve better security.

History

The term Grey Hat was coined by a hacker group called L0pht in 1998. They group references it in an interview with the NY Times. The earliest known use of the term Grey Hat, in the context of computer security literature, may be traced back to 2001. Cliff used the phrase to describe hackers who support the ethical reporting of vulnerabilities directly to the software vendor.. He contrasted this with the full disclosure practices that were prevalent in the white hat community at the time; and the principals of the black hat, whereby no one should be made aware of security holes.

In 2002, however, the Anti-Sec community published use of the term to refer to people who proverbially worked in the security industry by day, but sought to engage in black hat activities by night.. The irony was that for black hats, this interpretation was seen as a derogatory term; whereas amongst white hats it was a term that lended a sense of popular notoriety.

Following the rise and eventual decline of the Full Disclosure vs Anti-Sec 'golden era' - and the subsequent growth of Ethical Hacking philosophy - the term 'grey hat' began to take on all sorts of diverse meanings.

In 2004, Harris (et al) published a book on grey hat methodologies. This built upon the idea that black hats have malicious intentions and do not disclose their secrets; whereas white hats always engaged in public full disclosure, freely publicising security flaws in the hope that they will be fixed. The authors espoused that grey hats fall somewhere between, in that they derive income from notifying the vendor of what needs to be fixed after they have penetrated a system.

In 2006 Moore used the term to describe freelance hackers who browse the internet in search of security holes, and then seek to charge the host a fee for fixing the issue.

In 2008, the EFF defined grey hats as an ethical security researchers who use illegal methods to improve security..

Consensus

Drawing upon common denominators, a grey hat is a hacker that:

• Engages in security research with the intention to secure rather than destroy; and
• Does not support full disclosure of vulnerabilities; and
• Usually reports the vulnerability to the product vendor; and
• Is challenged by questions of ethics and law in the line of their work.

Grey hats are easily distinguished from black hats in many ways (esp. intent), but can only be distinguished from white hats on the topic of full disclosure.

Examples

In April 2000, {} and Hardbeat gained unauthorized access to apache.org. They chose to alert Apache crew of the problems rather than try to damage the apache.org servers.

In June 2010, a group of computer experts known as Goatse Security exposed a flaw in AT&T security which allowed the e-mail addresses of iPad users to be revealed. The group revealed the security flaw to the media after AT&T had been notified. Since then, the FBI has opened an investigation into the incident and raided the house of weev, the group's most prominent member.

See also

• Hacker ethic
• Hacktivism

External links

• The thin gray line
• The Register: Bahnhof Bust