Grey Hat


Goatse Security

A grey hat in the hacking community refers to a skilled hacker whose activities fall somewhere between white hat (lawful) and black hat (unlawful) hackers on a variety of spectra.

They usually do not hack for personal gain or have malicious intentions, but may be prepared to technically commit crimes during the course of their technological exploits in order to achieve better security. Whereas white hat hackers will tend to advise companies of security exploits quietly, grey hat hackers are prone to ‘advise the hacker community as well as the vendors and then watch the fallout.’

The term grey hat was coined by a hacker group called L0pht in 1998. The earliest known use of the term grey hat in the context of computer security literature may be traced back to 2001. The phrase was used to describe hackers who support the ethical reporting of vulnerabilities directly to the software vendor. He contrasted this with the full disclosure practices that were prevalent in the white hat community at the time and with the principles of the black hat, whereby no one should be made aware of security holes.

In 2002, however, the Anti-Sec (Anti Security) community published use of the term to refer to people who work in the security industry by day, but engage in black hat activities by night. The irony was that for black hats, this interpretation was seen as a derogatory; whereas among white hats it was a term that lent a sense of popular notoriety.

Following the rise and eventual decline of the full disclosure vs. anti-sec ‘golden era’—and the subsequent growth of an ‘ethical hacking’ philosophy—the term grey hat began to take on all sorts of diverse meanings. The prosecution in the U.S. of Dmitry Sklyarov for activities which were legal in his home country changed the attitudes of many security researchers. As the Internet became used for more critical functions, and concerns about terrorism grew, the term white hat started referring to corporate security experts who did not support full disclosure.

Nevertheless, in 2004, Harris (et al.) published a book on grey hat methodologies. This built upon the idea that black hats have malicious intentions and do not disclose their secrets, whereas white hats always engaged in public full disclosure, freely publicizing security flaws in the hope that they will be fixed. The authors espoused that grey hats fall somewhere between, in that they derive income from notifying the vendor of what needs to be fixed after they have penetrated a system. In 2006, the term was used to describe freelance hackers who browse the Internet in search of security holes and then seek to charge the host a fee for fixing the issue.

In 2008, the EFF (Electronic Frontier Foundation) defined grey hats as ethical security researchers who inadvertently or arguably violate the law in an effort to research and improve security. They advocate for computer offense laws that are clearer and more narrowly drawn. In summary, the term ‘grey hat’ may refer to a hacker who: Engages in security research with the intention to secure rather than exploit; Grapples with questions of ethics and law in the line of their work; Does not support full disclosure of vulnerabilities; and Usually reports the vulnerability to the product vendor.

In 2010, a group of computer experts known as ‘Goatse Security’ exposed a flaw in AT&T security which allowed the e-mail addresses of iPad users to be revealed. The group revealed the security flaw to the media after AT&T had been notified. Since then, the FBI has opened an investigation into the incident and raided the house of ‘weev,’ the group’s most prominent member.

In 2011, a group of experts discovered that the Apple iPhone and 3G iPads were ‘logging where the user visits.’ Apple released a statement saying that the iPad and iPhone were only logging the towers that the phone could access. There have been numerous articles on the matter and it has been viewed as a minor security issue. This instance would be classified as ‘grey hat’ because although the experts could have used this for malicious intent, the issue was reported.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.