Hacker News new | ask | show | jobs
by ransackdev 1030 days ago
Greyhats and especially bug bounty programs, pen testers, etc, have explicit authorization from the owners of the systems to access their systems, and perform ethical hacking with a mutually beneficial goal, hackers get paid, and the company gets a little bit less of an attack surface.

That’s not illegal

What’s illegal is accessing a computer system without the authorization of the owners of the computer system. Technically speaking, port scanning the internet is illegal hacking, as you are not authorized to scan each port number on any of those machines. Ever find a random ip and give port 22 a few random tries over ssh to see if the root password is “guest”, you just committed a federal offense, because you were not authorized to access and attempt to login to that system. Is anyone going to report port scans to the fbi? Failed ssh loggin attempts? (Use a vpn/tailscale and don’t expose ssh to the internet anyway).

I often wonder where “knowing” someone’s password and “hacking” their social accounts falls in this discussion. You see or hear about it all the time. “So and so hacked my page” If you have someone’s FB login info and they have no idea that you do, you may have permission to access FB, as everyone does if you accept their TOS, but you don’t have the account owner’s permission to access their account, and if FB knew it wasn’t the account owner, they would not allow that either. So if they don’t allow that, you’re likely violating their TOS, and no longer allowed to access their systems, so maybe it could technically be able to be prosecuted as illegal hacking, idk.

1 comments

> Greyhats [...] have explicit authorization from the owners of the systems to access their systems.

It sounds to me like you're describing whitehat. Greyhat do these things without authorization, but also without malicious intent.

https://en.wikipedia.org/wiki/Grey_hat

Ah yeah I guess it’s true they don’t have permission. At the end of the day I think it comes down to the owner choosing to press charges or not, or even detecting it and subsequently reporting it. I would guess that if the systems have ways to be hacked, the owners likely won’t see the hacks until the white/grey hat reports it to them.

Somewhat related, the hackers submitting a vulnerability disclosure to the companies are in a very “extortion-y” dynamic. I wonder how often companies get something like “pay us X amount or we let the world know today instead of waiting for you to fix it”.

Greyhats may or may not have malicious intent. They don’t play by anyone’s rules but their own.
A greyhat with malicious intent is just a blackhat.
Not really, because it depends on who the target is. If the greyhat for example maliciously targets a Mexican cartel or Iranian nuclear centrifuge, are they really the bad guy?
Which in turn depends on how many innocent bystanders get killed, maimed or injured as a result of those actions and if the means justify the end...
It’s a very grey area. If we knew the answers with certainty there would only be black and white.