What the Hack?!

The Oxford Dictionary defines ‘hack’ as: “Cut with rough or heavy blows in an irregular or random fashion”.

A second meaning follows: “Gain unauthorized access to data in a system or computer.”

It is this second meaning, that has caused controversy among many: ‘Hack’ used to have a positive feel; working on a tech problem in a different, more creative way than what’s outlined in an instruction manual. Even non-tech problems: Lifehack for example.

Similarly, a ‘hacker’ used to mean a person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. ‘Rooting’ Android devices, ‘Jailbreaking’ iOS to overcome their limits.

The word ‘cracker’ was suggested for the malicious members of the computer underground. However, instead of a division between the two, the following categories and terms emerged, each one subtley different to the next.

So I wrote this blog to provide some insight into these differences, rather than lumping everyone into the (possibly evil sounding) “hacker” group.

  • White hat: A white hat hacker breaks security for non-malicious reasons; to test security systems, perform penetration tests, or vulnerability assessments, for themselves or for clients.
  • Black hat: In contrast with the white, a black hat hacker breaks computer security for maliciousness or personal gain.
  • Grey hat: A grey hat hacker is between a black hat and a white hat hacker. A grey hat hacker may hack a system to notify its admins about the security vulnerability, then might offer to fix it for a fee. Grey hat hackers sometimes publish their findings to the whole world, instead of the admins. Even though they may not be hacking for personal gain, unauthorised access to a system can be considered illegal, not to mention unethical — well it’s a… grey area.
  • Blue hat: Blue hat refers to security consultants who are invited to test a system for exploits before its launch.
  • Elite hacker: Elite (1337 in Leet, see below) is used to describe the most skilled hackers.
  • Leet: A system of modified spellings where characters are replaced by similar looking glyphs. Also known as eleet or leetspeak.
  • Script kiddie: A script kiddie is an unskilled hacker who breaks into computers by using automated tools or scripts created by others, usually with little or no understanding of the underlying concept.
  • Neophyte: Someone who is new to hacking (also known as newbie or noob / n00b).
  • Hacktivist: A hacker who utilises technology to publicise a social, ideological, political or religious message.

Crystal clear right? Good! Because this is the first in a series of blogs I’ll be sharing where I’ll be referring back to these terms and definitions.

Until the next time, stay secure!

PUBLISHED BY

tunc

2 Apr. 2019

SHARE ARTICLE:

Categories

Recent Posts

VIEW ALL
News

Introducing DNS Guardian: Stop impersonation and spam caused by domain takeovers 

Rahul Powar

tl;dr: We’re thrilled to announce DNS Guardian — a new feature in Red Sift OnDMARC that can swiftly identify and stop domain takeovers that lead to malicious mail. Back in February, we shared updates with the community about SubdoMailing – an attack discovered by Guardio Labs. The attack was a form of subdomain takeover,…

Read more
Cybersecurity

Resilience Rising | Episode 3 with Kevin White

Red Sift

In this episode of Resilience Rising, Sean Costigan, Managing Director of Resilience Strategy at Red Sift, and Kevin White, Senior Operation Consultant with Enhanced Information Solutions, explore the critical intersection of wastewater management and cybersecurity.  The two highlight the health and operational impacts of cyber threats on water utilities, emphasizing the vulnerabilities due to…

Read more
Certificates

Your guide to PCI DSS 4.0 Cryptographic Requirements

Rebecca Warren

The Payment Card Industry Data Security Standard (PCI DSS) is a globally recognized framework designed to protect cardholder data during processing, storage, and transmission by merchants and service providers. PCI DSS outlines a set of stringent security controls that organizations handling payment card information must implement to mitigate the risk of data breaches and…

Read more
Certificates

How to build an inventory of certificates for PCI DSS 4.0 Requirement…

Rebecca Warren

We talk to organizations daily that are preparing for PCI DSS 4.0 requirements. March 31, 2025 marks the end of the transition period, and on this date, businesses must be fully compliant with PCI DSS v4.0.1.  One of the ways PCI 4.0.1 varies from PCI 3.2 is an updated Requirement 4, which covers encrypting…

Read more
DMARC

Getting started with the OnDMARC API

Nadim Lahoud

The OnDMARC API is great for performing bulk or repetitive tasks that need to be performed quickly, often and without error – and you don’t need to be a developer or even know how to code to use it. Here, I will walk you through how to perform the common task of updating the…

Read more