Hacker Types

A couple of weeks ago, I was in a business meeting, showing the administrator how to use the NIDS I had just set up for the office. After the appointment was done, I happened to come across a very friendly lady, with sparkling dark eyes, curly hair stacked neatly in a ponytail, and a very inviting smile. Her secretary glasses, obscured her age, but I placed her somewhere in her mid thirties. Gracious people, with a kind and genuinely inviting attitude, always leave an impression with me. We started talking about the moon and the stars (actually, we were talking about societal misconceptions towards certain groups of people), when the conversation changed to what I do for a living. This part is always hard for me to explain to others...and unfortunately is a question that comes up more often than not. I told her "I work in IT", to which she replied "That's very general. What part of IT are you in?"....."Ummm, I write stuff for people that need content on the web and I find, fix and try to prevent problems that might occur in computer systems". As the conversation progressed, we started talking about recent data breaches, where, somewhere in the conversation, I started to explain how not all hackers are bad, that they in fact get paid very well by companies to find weaknesses in systems and applications and strengthen security, and that sometimes will just report vulnerabilities out of global consciousness, with no financial gain, which basically resulted with me defending what it is hackers do. This was also the moment where I felt her cringe, because the sparkle in her eyes left her and the reply I got was "I thought all hackers are bad". Using every piece of knowledge I could extract from my brain in split seconds, I did my best to prove that this is a huge misconception.

The number for classifications of hackers has grown over the years, much like computer system terminologies have, the inevitable result of our speedy technological advancements and societal progressions. And same as our technology is growing too fast for us to keep up with, so will the terms we use in conjunction. The list below may be accurate today, but a year from now, it could need to be updated with new terms and meanings.

Here is a current list of most common Hacker classifications:

• White Hats: Also known as Ethical Hackers, Information Security Experts or Penetration Testers, they will only utilize their skills to test security under legal contract in exchange for remuneration. Attacks by WhiteHats are never compiled without prior consent and they are always done to assess the security systems in place for the defense of a business, corporation or government sector. They also improve security by exposing any vulnerabilities before malicious hackers (known as black hat hackers) can detect and exploit them.
• Black Hats: Also known as Crackers or Malicious Hackers, this type is a hacker who unlawfully violates computer security for personal gain or simply maliciousness. Black hats break into networks and systems to destroy, modify, or steal data, or to make the networks unusable for authorized users and legitimate traffic.
• Grey Hats: Walking the thin line between permissive and unlawful attacks, these computer security experts may sometimes violate laws or typical ethical standards, but do not have the malicious intent typical of a black hat hacker. Grey (or Gray) Hats, may sometimes attack a system or network without permission, only to bring attention to the vulnerabilities or weaknesses present that may exist. Grey Hats are also considered the people that were once Black Hats, but changed their outlook and perspective towards ethical hacking, for mostly personal or legal reasons.
• Red Hats: As the color may suggest, this type of hacker is very dangerous, but not for the same reasons as a Black Hat. Red Hats are the vigilantes of cyberspace. This title only emerged in recent years, because simply some White Hats got tired of waiting for permission to fight the actions of Black Hats. It is also used to describe the course of action they would take, if they were to stumble upon a malicious attacker: Instead of reporting the Cracker, they shut them down by using the same methods as a Black Hat, such as uploading malware in their systems, accessing their accounts, releasing spyware, worms and generally anything malicious, but for the purpose of revenge or simply stopping the nefarious intentions of a Black Hat. They leverage multiple aggressive methods that might force a cracker to need new equipment, as a result of the attack. The original term of Red Hat is the trademark of a leading software company in the business of assembling open source components for the Linux operating system and related programs. Businesses and individuals need not feel any threat from a Red Hat, as their only objective is to destroy Black Hats.
• Green Hats: These are the newbies of the hacking world. They mostly use software to complete their activities, but at the same time, aspire to learn programming and command language and become fully matured hackers with multiple capabilities. Of course, many factors come into play, when it comes to what side a Green Hat will end up choosing . We're hoping they'll always choose to be White.
• Script Kiddies: This is a derogatory term, coined by Black Hats and it is used to Define a hacker who is just as dangerous, in that their intent is malicious, but has lack of knowledge and a simultaneous lack of desire to learn in depth. These "hackers" use software or well known techniques for all their tasks. Typically, they will exploit weaknesses in other computers on the Internet, in most cases randomly and with little regard or understanding of the potentially harmful consequences of their actions.
• Hacktivists: Hackers with political or social motivations, that unlawfully break into systems and networks, in order to promote a political idea or societal change. One famous group in this category, are the Anonymous. With roots in hacker culture and ethics, it is usually a group that may attack for motives such as free speech, freedom of information and human rights, among others.
• Suicide Hackers: This variety doesn't care about any consequences that may occur as a result of their actions. The concept is similar to that of a suicide bomber. They have no regard for the law or who may be hurt by their activities. Jail-time is not something they will take into consideration in order to stop their activities.
• Organized Criminal Groups: These are groups with diverse expertise, that assemble in order to monetize their gains. They have well established control centers, where different tasks are executed by different individuals, such as spam and phishing operations, wiretapping operations, backdoor operations, carding operations, stalking operations, break and enter operations, extortion, fraud, threats and hosting operations. Cyber Mercenaries are a vital part of this group. In the real world, they would simulate the soldiers on the front line. They take the most risks for survival of the group and are the first ones to "fall".
• Social Engineers: Social engineering is the art of obtaining confidential information, using deceptive means and manipulation, and requires no technical skills. This kind of intrusion, relies heavily on human interaction and often involves tricking people into breaking normal security procedures. Social Engineering can be human or computer based (phishing, redirecting etc). Social Engineering Experts are essential to security, as this type of attack is responsible for 91% of data breaches globally. A successful hack, can be accomplished by using nothing but social engineering techniques.
• IT Gurus: The term connotes someone who is a teacher, expert, master or specialist of the Internet Technology field. An IT Guru should know a little or a lot about just about anything that has to do with internet technology.
• Cyber Ninjas: Term is used mostly for malicious attackers that are exceptionally good at hiding their tracks.

Important to note, that in the technology world, hackers are also supposed to have excellent programming skills. If and when a hack is compiled by someone with no knowledge of programming, then in the virtual world, that person doesn't deserve the "elite" label of being a hacker. It is a very unfortunate fact, that all colors and kinds of Cyber Wars soldiers, must use the same weapons in order to reach their goals and complete their objectives. In the physical world, police officers, the army and other authorities, must use covert operations, go undercover, act and live the same way as their target criminals and enemies, because in order to capture their targets, they have to blend in, be exactly like them and do exactly as they would do. Otherwise, they'd never learn how certain operations and transactions take place, they would be unaware how things are done, therefore, wouldn't know how to stop certain activities or build up their defenses. Being a hacker, good or bad, is not something you advertise. It's like getting hired to work covertly for the CIA, yet turning around and telling anyone, friend or stranger, that you just got hired to be a spy. Even if your story was believable, which to most it wouldn't be (as if hackers and spies are not well known to exist), not only would you be useless because you blew your cover, but you could also put your whole being at risk, endangering everyone and everything you know and have in your life.