Editing White hat (computer security)

{{short description|Computer hacker who hacks ethically}}
{{Computer hacking}}
A '''white hat''' (or a '''white-hat hacker''', '''a whitehat''') is an ethical [[security hacker]].<ref>{{cite web |url=http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci550882,00.html |title=What is white hat? - a definition from Whatis.com |publisher=Searchsecurity.techtarget.com |access-date=2012-06-06 |archive-date=2011-02-01 |archive-url=https://web.archive.org/web/20110201231325/http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci550882,00.html |url-status=live }}</ref><ref>{{Cite journal |last1=Okpa |first1=John Thompson |last2=Ugwuoke |first2=Christopher Uchechukwu |last3=Ajah |first3=Benjamin Okorie |last4=Eshioste |first4=Emmanuel |last5=Igbe |first5=Joseph Egidi |last6=Ajor |first6=Ogar James |last7=Okoi |first7=Ofem, Nnana |last8=Eteng |first8=Mary Juachi |last9=Nnamani |first9=Rebecca Ginikanwa |date=2022-09-05 |title=Cyberspace, Black-Hat Hacking and Economic Sustainability of Corporate Organizations in Cross-River State, Nigeria |journal=SAGE Open |language=en |volume=12 |issue=3 |page=215824402211227 |doi=10.1177/21582440221122739 |s2cid=252096635 |issn=2158-2440|doi-access=free }}</ref> Ethical hacking is a term meant to imply a broader category than just penetration testing.<ref>{{cite journal |last=Ward |first=Mark |title=Sabotage in cyberspace |journal=New Scientist |volume=151 |issue=2047 |date=14 September 1996 |url=https://www.newscientist.com/article/mg15120471-700-sabotage-in-cyberspace-the-threat-to-national-security-from-computer-terrorists-is-vastly-overblown-most-hackers-are-after-nothing-more-than-an-intellectual-thrill/ |access-date=28 March 2018 |archive-date=13 January 2022 |archive-url=https://web.archive.org/web/20220113120127/https://www.newscientist.com/article/mg15120471-700-sabotage-in-cyberspace-the-threat-to-national-security-from-computer-terrorists-is-vastly-overblown-most-hackers-are-after-nothing-more-than-an-intellectual-thrill/ |url-status=live }}</ref><ref name=Knight>{{cite journal |last=Knight |first=William |title=License to Hack |journal=InfoSecurity |date=16 October 2009 |volume=6 |issue=6 |pages=38–41 |url=http://www.infosecurity-magazine.com/view/4611/license-to-hack-ethical-hacking/ |doi=10.1016/s1742-6847(09)70019-9 |access-date=19 July 2014 |archive-date=9 January 2014 |archive-url=https://web.archive.org/web/20140109211618/http://www.infosecurity-magazine.com/view/4611/license-to-hack-ethical-hacking/ |url-status=live |url-access=subscription }}</ref> Under the owner's consent, white-hat hackers aim to identify any vulnerabilities or security issues the current system has.<ref>{{Cite journal |last1=Filiol |first1=Eric |last2=Mercaldo |first2=Francesco |last3=Santone |first3=Antonella |date=2021 |title=A Method for Automatic Penetration Testing and Mitigation: A Red Hat Approach |journal=Procedia Computer Science |language=en |volume=192 |pages=2039–2046 |doi=10.1016/j.procs.2021.08.210|s2cid=244321685 |doi-access=free }}</ref> The white hat is contrasted with the [[black hat (computer security)|black hat]], a malicious hacker; this definitional dichotomy comes from [[Western (genre)|Western films]], where [[black and white hat symbolism in film|heroic and antagonistic cowboys might traditionally wear a white and a black hat, respectively]].<ref>{{Cite book |url=https://books.google.com/books?id=aVnA8pQmS54C&pg=PA26 |title=Ninja Hacking: Unconventional Penetration Testing Tactics and Techniques |first1=Thomas |last1=Wilhelm |first2=Jason |last2=Andress |publisher=Elsevier |year=2010 |pages=26–7|isbn=978-1-59749-589-9 }}</ref> There is a third kind of hacker known as a [[grey hat]] who hacks with good intentions but at times without permission.<ref name="Symantec Group">{{cite web |title=What is the difference between black, white, and grey hackers |url=https://us.norton.com/internetsecurity-emerging-threats-what-is-the-difference-between-black-white-and-grey-hat-hackers.html |website=Norton.com |publisher=Norton Security |access-date=2 October 2018 |archive-date=15 January 2018 |archive-url=https://web.archive.org/web/20180115172110/https://us.norton.com/internetsecurity-emerging-threats-what-is-the-difference-between-black-white-and-grey-hat-hackers.html |url-status=live }}</ref>

White-hat hackers may also work in teams called "[[hacker (computer security)|sneakers and/or hacker clubs]]",<ref name= Secpoint>{{cite web |url=http://www.secpoint.com/What-is-a-White-Hat.html |title=What is a White Hat? |publisher=Secpoint.com |date=2012-03-20 |access-date=2012-06-06 |archive-date=2019-05-02 |archive-url=https://web.archive.org/web/20190502061110/https://www.secpoint.com/what-is-a-white-hat.html |url-status=live }}</ref> [[red team]]s, or [[tiger team]]s.<ref name="Palmer">{{cite journal|last=Palmer|first=C.C.|title=Ethical Hacking|journal=IBM Systems Journal|year=2001|volume=40|issue=3|page=769|url=http://pdf.textfiles.com/security/palmer.pdf|doi=10.1147/sj.403.0769|access-date=2014-07-19|archive-date=2019-05-02|archive-url=https://web.archive.org/web/20190502061107/http://pdf.textfiles.com/security/palmer.pdf|url-status=live}}</ref>

==History==
One of the first instances of an ethical hack being used was a "security evaluation" conducted by the [[United States Air Force]], in which the [[Multics]] operating systems were tested for "potential use as a two-level (secret/top secret) system." The evaluation determined that while Multics was "significantly better than other conventional systems," it also had "... [[vulnerabilities]] in hardware security, [[software security]] and procedural security" that could be uncovered with "a relatively low level of effort."<ref>{{cite report |author=Paul A. Karger |author2=Roger R. Scherr |date=June 1974 |title=MULTICS SECURITY EVALUATION: VULNERABILITY ANALYSIS |url=https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/karg74.pdf |access-date=12 Nov 2017 |archive-date=13 November 2017 |archive-url=https://web.archive.org/web/20171113060242/https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/karg74.pdf |url-status=live }}</ref> The authors performed their tests under a guideline of realism, so their results would accurately represent the kinds of access an intruder could potentially achieve. They performed tests involving simple information-gathering exercises, as well as outright attacks upon the system that might damage its integrity; both results were of interest to the target audience. There are several other now unclassified reports describing ethical hacking activities within the [[United States Armed Forces|US military]].

By 1981 ''[[The New York Times]]'' described white-hat activities as part of a "mischievous but perversely positive 'hacker' tradition". When a [[National CSS]] employee revealed the existence of his [[password cracker]], which he had used on customer accounts, the company chastised him not for writing the software but for not disclosing it sooner. The letter of reprimand stated "The Company realizes the benefit to NCSS and encourages the efforts of employees to identify security weaknesses to the VP, the directory, and other sensitive software in files".<ref name="mclellan19810726">{{cite news | url=https://www.nytimes.com/1981/07/26/business/case-of-the-purloined-password.html?pagewanted=3&pagewanted=all | title=Case of the Purloined Password | work=The New York Times | date=1981-07-26 | access-date=11 August 2015 | author=McLellan, Vin | archive-date=2016-03-07 | archive-url=https://web.archive.org/web/20160307215920/http://www.nytimes.com/1981/07/26/business/case-of-the-purloined-password.html?pagewanted=3&pagewanted=all | url-status=live }}</ref>

On October 20, 2016, the [[United States Department of Defense|Department of Defense]] (DOD) announced "[[Hack The Pentagon]]."<ref>{{Cite web |title=DoD Announces 'Hack the Pentagon' Follow-Up Initiative |url=https://www.defense.gov/News/News-Stories/Article/Article/981160/dod-announces-hack-the-pentagon-follow-up-initiative/platform/dod-announces-hack-the-pentagon-follow-up-initiative/https://www.defense.gov/News/News-Stories/Article/Article/981160/dod-announces-hack-the-pentagon-follow-up-initiative/ |access-date=2023-12-15 |website=U.S. Department of Defense |language=en-US}}{{dead link|date=April 2025|bot=medic}}{{cbignore|bot=medic}}</ref><ref>{{Cite web |last=Perez |first=Natasha Bertrand, Zachary Cohen, Alex Marquardt, Evan |date=2023-04-13 |title=Pentagon leak leads to limits on who gets access to military's top secrets {{!}} CNN Politics |url=https://www.cnn.com/2023/04/13/politics/pentagon-leaks-limit-access-military-secrets/index.html |access-date=2023-12-15 |website=CNN |language=en |archive-date=2023-12-15 |archive-url=https://web.archive.org/web/20231215184601/https://www.cnn.com/2023/04/13/politics/pentagon-leaks-limit-access-military-secrets/index.html |url-status=live }}</ref>

The idea to bring this tactic of ethical hacking to assess the security of systems and point out vulnerabilities was formulated by [[Dan Farmer]] and [[Wietse Venema]]. To raise the overall level of security on the [[Internet]] and [[intranets]], they proceeded to describe how they were able to gather enough information about their targets to have been able to compromise security if they had chosen to do so. They provided several specific examples of how this information could be gathered and exploited to gain control of the target, and how such an attack could be prevented. They gathered up all the tools they had used during their work, packaged them in a single, easy-to-use application, and gave it away to anyone who chose to download it. Their program called [[Security Administrator Tool for Analyzing Networks]], or SATAN, was met with a great amount of media attention around the world in 1992.<ref name= Palmer />

==Tactics==
While [[penetration testing]] concentrates on attacking software and computer systems from the start&nbsp;– scanning ports, examining known defects in protocols and applications running on the system, and patch installations, for example&nbsp;– ethical hacking may include other things. A full-scale ethical hack might include emailing staff to ask for password details, rummaging through executive dustbins, usually without the knowledge and consent of the targets. Only the owners, CEOs, and Board Members (stakeholders) who asked for such a security review of this magnitude are aware. To try and replicate some of the destructive techniques a real attack might employ, ethical hackers may arrange for cloned test systems, or organize a hack late at night while systems are less critical.<ref>{{cite book|title=Black Hat Python, 2nd Edition: Python Programming for Hackers and Pentesters|author=Justin Seitz, Tim Arnold|url=https://python.engineering/black-hat-python/|date=April 14, 2021|publisher=No Starch Press|isbn=978-1-7185-0112-6|access-date=August 30, 2021|archive-date=August 26, 2021|archive-url=https://web.archive.org/web/20210826111249/https://python.engineering/black-hat-python/|url-status=live}}</ref> In most recent cases these hacks perpetuate for the long-term con (days, if not weeks, of long-term human infiltration into an organization). Some examples include leaving [[USB]]/flash key drives with hidden auto-start software in a public area as if someone lost the small drive and an unsuspecting employee found it and took it.

Some other methods of carrying out these include:
<!---♦♦♦ Please keep the list in alphabetical order ♦♦♦--->
* [[Memory forensics|Disk and memory forensics]]
* [[Denial-of-service attack|DoS attack]]s
* Frameworks such as:
** [[Metasploit]]
* [[Network Security]]
* [[Reverse engineering]]
* Security scanners such as:
** [[Burp Suite]]
** [[Nessus (software)|Nessus]]
** [[W3af]]
* [[Social engineering (security)|Social engineering]] tactics such as:
** Phishing
** Pretexting
* Training Platforms
* [[Vulnerability research]]

The methods identified [[Exploit (computer security)|exploit]] known security [[Vulnerability (computing)|vulnerabilities]] and attempt to evade security to gain entry into secured areas. They can do this by hiding software and system 'back-doors' that can be used as a link to information or access that a non-ethical hacker, also known as 'black hat' or 'grey hat', may want to reach.

==Legality==
===Belgium===
Belgium legalized white hat hacking in February 2023.<ref>{{cite web |last1=Drechsler |first1=Charlotte Somers, Koen Vranckaert, Laura |title=Belgium legalises ethical hacking: a threat or an opportunity for cybersecurity? |url=https://www.law.kuleuven.be/citip/blog/belgium-legalises-ethical-hacking-a-threat-or-an-opportunity-for-cybersecurity/ |website=CITIP blog |access-date=7 May 2023 |date=3 May 2023 |archive-date=17 May 2023 |archive-url=https://web.archive.org/web/20230517194250/https://www.law.kuleuven.be/citip/blog/belgium-legalises-ethical-hacking-a-threat-or-an-opportunity-for-cybersecurity/ |url-status=live }}</ref>

=== China ===
In July 2021, the [[Government of China|Chinese government]] moved from a system of voluntary reporting to one of legally mandating that all white hat hackers first report any vulnerabilities to the government before taking any further steps to address the vulnerability or make it known to the public.<ref name=":0">{{Cite news |last=Brar |first=Aadil |date=18 January 2024 |title=China Raises Private Hacker Army To Probe Foreign Governments |url=https://www.newsweek.com/china-hackers-probe-foreign-governments-computers-online-cybersecurity-1861721 |access-date=20 January 2024 |work=[[Newsweek]] |archive-date=20 January 2024 |archive-url=https://web.archive.org/web/20240120053025/https://www.newsweek.com/china-hackers-probe-foreign-governments-computers-online-cybersecurity-1861721 |url-status=live }}</ref> Commentators described the change as creating a "dual purpose" in which white hat activity also serves the country's intelligence agencies.<ref name=":0" />

===United Kingdom===
Struan Robertson, legal director at Pinsent Masons LLP, and editor of [[OUT-LAW|OUT-LAW.com]] says "Broadly speaking, if the access to a system is authorized, the hacking is ethical and legal. If it isn't, there's an offense under the [[Computer Misuse Act]]. The unauthorized access offense covers everything from guessing the password to accessing someone's webmail account, to cracking the security of a bank. The maximum penalty for unauthorized access to a computer is two years in prison and a fine. There are higher penalties&nbsp;– up to 10 years in prison&nbsp;– when the hacker also modifies data". Unauthorized access even to expose vulnerabilities for the benefit of many is not legal, says Robertson. "There's no defense in our hacking laws that your behavior is for the greater good. Even if it's what you believe."<ref name=Knight />

==Employment==
{{Globalize|article|USA|2name=the United States|date=June 2011}}
The United States [[National Security Agency]] offers certifications such as the CNSS 4011. Such a certification covers orderly, ethical hacking techniques and team management. Aggressor teams are called "red" teams. Defender teams are called "blue" teams.<ref name=Secpoint /> When the agency recruited at [[DEF CON]] in 2020, it promised applicants that "If you have a few, shall we say, ''indiscretions'' in your past, don't be alarmed. You shouldn't automatically assume you won't be hired".<ref>{{Cite web |url=http://www.nsa.gov/careers/dc20 |title=Attention DEF CON® 20 attendees |year=2012 |publisher=National Security Agency |archive-url=https://web.archive.org/web/20120730224626/http://www.nsa.gov/careers/dc20 |archive-date=2012-07-30}}</ref>

A good "white hat" is a competitive skillful employee for an enterprise since they can be a [[countermeasure]] to find the [[bug (engineering)|bugs]] to protect the enterprise network environment. Therefore, a good "white hat" could bring unexpected benefits in reducing the risk across systems, applications, and endpoints for an enterprise.<ref>{{Cite journal|last=Caldwell|first=Tracey|date=2011|title=Ethical hackers: putting on the white hat|journal=Network Security|volume=2011|issue=7|pages=10–13|doi=10.1016/s1353-4858(11)70075-7|issn=1353-4858}}</ref>

Recent research has indicated that white-hat hackers are increasingly becoming an important aspect of a company's network security protection. Moving beyond just penetration testing, white hat hackers are building and changing their skill sets, since the threats are also changing. Their skills now involve [[Social engineering (security)|social engineering]], mobile tech, and [[social networking]].<ref>{{Cite journal |last=Caldwell |first=Tracey |date=2011-07-01 |title=Ethical hackers: putting on the white hat |url=https://www.sciencedirect.com/science/article/pii/S1353485811700757 |journal=Network Security |volume=2011 |issue=7 |pages=10–13 |doi=10.1016/S1353-4858(11)70075-7 |issn=1353-4858|url-access=subscription }}</ref>

==Notable people==
<!---♦♦♦ Only add a person to this list if they already have their own article on the English Wikipedia ♦♦♦---> 
<!---♦♦♦ Please keep the list in alphabetical order by LAST NAME ♦♦♦--->
*[[Jim Browning (YouTuber)|Jim Browning]], alias of a Northern Ireland white hat hacker, [[scam baiting|scam baiter]], and [[journalist]], with investigations published on [[YouTube]] and on [[BBC]] programmes such as ''[[Panorama (British TV programme)|Panorama]]'' and ''[[Scam Interceptors]]''
*[[Charlie Miller (security researcher)|Charlie Miller]], an American white hat hacker previously employed by the [[National Security Agency]] and [[Uber]] who has, amongst other exploits, published successful hacks into the vulnerabilities of the computer on a 2014 [[Jeep Cherokee]] along with [[Chris Valasek]], being able to take control of acceleration, braking, and steering 
*[[Jennifer Arcuri]], an American technology entrepreneur founded the white hat consultancy Hacker House in 2016.

==See also==
* [[Bug bounty program]]
* [[IT risk]]
* [[Locksmith]]
* [[MalwareMustDie]]
* [[Wireless identity theft]]

==References==
{{reflist}}

{{DEFAULTSORT:White Hat (Computer Security)}}
[[Category:White hat (computer security)| ]]
[[Category:Hacking (computer security)]]
[[Category:Computer ethics]]