| This article is part of a series on |
| Computer security hacking |
|---|
| History |
| Phreaking, Cryptovirology |
| Hacker ethic |
| Hacker Manifesto, Black hat, Grey hat, White hat, Black Hat Briefings, DEF CON |
| Cybercrime |
| Computer crime, Crimeware, List of convicted computer criminals, Script kiddie |
| Hacking tools |
| Vulnerability, Exploit, Payload |
| Malware |
| Rootkit, Backdoor, Trojan horse, Virus, Worm, Spyware, Botnet, Keystroke logging, Antivirus software, Firewall, HIDS |
| Computer security |
| Computer insecurity, Application security, Network security |
A grey hat, in the hacking community, refers to a skilled hacker whose activities fall somewhere between white and black hat hackers on a variety of spectra. It may relate to whether they sometimes arguably act illegally, though in good will, or to show how they disclose vulnerabilities. They usually do not hack for personal gain or have malicious intentions, but may be prepared to technically commit crimes during the course of their technological exploits in order to achieve better security.[1] Whereas white hat hackers will tend to advise companies of security exploits quietly, grey hat hackers are prone to "advise the hacker community as well as the vendors and then watch the fallout".[2]
Contents |
The term Grey Hat was coined by a hacker group called L0pht in 1998. The group references it in an interview with the NY Times[3] from 1999 describing their "gray-hat" behavior. The earliest known use of the term Grey Hat, in the context of computer security literature, may be traced back to 2001. The phrase was used to describe hackers who support the ethical reporting of vulnerabilities directly to the software vendor.[4] He contrasted this with the full disclosure practices that were prevalent in the white hat community at the time; and the principles of the black hat, whereby no one should be made aware of security holes.
In 2002, however, the Anti-Sec community published use of the term to refer to people who work in the security industry by day, but engage in black hat activities by night.[5] The irony was that for black hats, this interpretation was seen as a derogatory term; whereas amongst white hats it was a term that lent a sense of popular notoriety.
Following the rise and eventual decline of the Full Disclosure vs Anti-Sec "golden era" - and the subsequent growth of Ethical Hacking philosophy—the term grey hat began to take on all sorts of diverse meanings. The prosecution in the US of Dmitry Sklyarov for activities which were legal in his home country changed the attitudes of many security researchers. As the Internet became used for more critical functions, and concerns about terrorism grew, the term white hat started referring to corporate security experts who did not support full disclosure. [6]
Nevertheless, in 2004, Harris (et al.) published a book on grey hat methodologies. This built upon the idea that black hats have malicious intentions and do not disclose their secrets; whereas white hats always engaged in public full disclosure, freely publicising security flaws in the hope that they will be fixed. The authors espoused that grey hats fall somewhere between, in that they derive income from notifying the vendor of what needs to be fixed after they have penetrated a system.[7]
In 2006, the term was used to describe freelance hackers who browse the internet in search of security holes, and then seek to charge the host a fee for fixing the issue.[8]
In 2008, the EFF defined grey hats as ethical security researchers who inadvertently or arguably violate the law in an effort to research and improve security. They advocate for computer offense laws that are clearer and more narrowly drawn.[9]
In summary, the term grey hat may refer to a hacker who:
In April 2000, hackers known as "{}" and "Hardbeat" gained unauthorized access to apache.org.[10] They chose to alert Apache crew of the problems rather than try to damage the apache.org servers.[11]
In June 2010, a group of computer experts known as Goatse Security exposed a flaw in AT&T security which allowed the e-mail addresses of iPad users to be revealed.[12] The group revealed the security flaw to the media after AT&T had been notified. Since then, the FBI has opened an investigation into the incident and raided the house of weev, the group's most prominent member.[13]
In April 2011, a group of experts discovered that the Apple iPhone and 3G iPads were 'logging where the user visits'. Apple released a statement saying that the iPad and iPhones were only logging the towers that the phone could access. There have been numerous articles on the matter and it has been viewed as a minor security issue. This instance would be classified as "grey hat" because although the experts could have used this for malicious intent, the issue was reported. [14]