12
votes

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to system, just proves there are some security holes.

5
  • 21
    First, get a lawyer on retainer... you may need them soon. May 13, 2009 at 8:47
  • Whether it's ethical depends on the standard against which it's measured. You figure that part out. Legality is arguable but less subjective. Call your lawyer for advice on that. This question can't be answered here.
    – sh-beta
    May 14, 2009 at 4:00
  • 6
    You will never know if it made any damage or not. May 14, 2009 at 8:58
  • @Oskar, I'm fairly sure doing something like echo 'you have security trouble' > /root/HACKED is going to cause much damage.
    – Unkwntech
    Jul 24, 2009 at 15:52
  • 1
    Do you find it ethical? It's not ehtical and you know it and nobody of sound mind is going to tell you that it's OK. Is it ethical to break into someone else's home? Not to steal anything but just to test your knowledge and learn something new. Is it ethical for me to hack your systems? Not for profit, just to test my knowledge and learn something new.
    – joeqwerty
    Dec 1, 2009 at 15:46

12 Answers 12

27
votes

It has been shown time and time again it's not ethical. And if you discover a flaw, then they'll likely nail you to the wall if they don't mind the publicity. When you do any sort of security testing, make sure you have permission in writing from someone with the authority to give it. Why?

See Randal L. Schwartz. He fought the conviction for 12 years and finally had his record expunged. He was doing something most sysadmins at the time wouldn't have thought twice about. But convicted he was.

1
  • 2
    Corporations pay large sums of money to penetration testers to break into their own systems. A good penetration tester will use a live exploit to break in and leverage the issue to find more vulnerabilities. It comes down to permission.
    – Rook
    May 17, 2010 at 20:27
51
votes

The key flaw I see in your question is that you seem to believe it is possible to correctly assess from the outside what the damage hacking will do to a given system.

How do you know that flipping a given bit the wrong way isn't going to completely destroy something and cost your target thousands or millions of dollars.

Since ethics are very subjective I will answer you this way. It would be far more ethical to leave stuff alone that doesn't belong to you or you don't have explicit permission to touch.

17
votes

If you just want to improve you security knowledge, there is a linux distribution called Damn Vulnerable Linux. It is used as a teaching aid in university security classes and includes many security vulnerabilities on purpose.

Just install that on a spare computer, much more ethical and you can learn just as much.

2
  • 1
    +1 because it's far better to hack your own stuff to learn than it is to hack someone else's. Then, once you've learned some tricks, the suggestions to get in league with some black hat services companies makes sense, because those folks are contracted to hack systems, so legality is no longer in question.
    – Milner
    May 13, 2009 at 13:06
  • 1
    +1 for the suggestion. Also @Milner, I believe you are referring to "white hat" companies.
    – tomjedrz
    May 13, 2009 at 16:00
12
votes

In a word, No.

If you find something out in a routine way then it would be good to alert them and not exploit it. But deliberately going out to test someone else's security is not really ethical.

They ought to be paying security firms to do this for them and if they have contracted you to do this, then it is clearly not unethical. But if you have not been contracted to do this, and you unintentionally expose some problem, or cause a problem unwittingly through your hacking actions, I suspect most corporations would want you prosecuted.

For your own safety, I would not go there. If you are really interested in this, try applying for jobs with the security firms contracted to do this.

9
votes

No, that is not ethical.

If they take you to court for illegally breaking and entering, the judge will not let you off because you were "testing your security knowledge and learning something new".

If you stumble upon a security vulnerability during normal use of their system, I would argue it is absolutely ethical to alert them of the problem, but to explicitly go searching for vulnerabilities when you are not contracted to do so is not only unethical, in many localities it is also illegal.

3
  • Actually in many legislations, the judge might let you off. In such legislation, act of hacking itself isn't illegal, it is illegal to gain access privileged information, modify such information in any way, disrupt normal operations of the system, etc. But IMHO, that doesn't make that ethical.
    – vartec
    May 13, 2009 at 10:06
  • 3
    I wouldn't risk jailtime over a judge's potential lack of technical knowledge.
    – ceejayoz
    May 13, 2009 at 15:19
  • @vartec: even attempting to hack computer systems you do not own is illegal. Kind of like attempting to steal someones car is still illegal whether you are able to actually drive away with it or not.
    – NotMe
    Dec 1, 2009 at 14:51
8
votes

Permit me to paraphrase your question:

"Is it ethical to break into someone's house, just to prove that it can be done, even if you don't steal anything?"

@Marc Gravell's point about retaining a lawyer is well made...

7
votes

We had a security specialist check some legacy AIX applications and server configurations, he did a very friendly and narrow scan of an IBM blade chassis with PPC blades and when it tried to connect to the management card - that instantly rebooted!

No one would ever have thought that, and it was clearly a bug in the card. But the possible damages of even a friendly ping are simply astounding. You can't say you "do no damage" - that's simply not a statement you can guarantee.


(in this case, rebooting the management card had little impact except the fans losing management, going into full speed, which if you've ever had an IBM Bladecenter know means the visitors in the reception area two floors down from the server room can't hear each other for a few minutes ;)

3
votes

Only if you tell them first and they give you permission to give it your best shot.

...and how likely is that :)

3
votes

Calling upon my advanced knowledge of what the question "is it ethical to do X?" means (1), the answer is "no".

(1) It means "should we do X?"

2
votes

The other two answers to this question (when I read it) are excellent, so I would just like to add a small suggestion. Don't take for granted that you can't gain the same amount of knowledge through completely legal means. Studying encryption, trying to find security holes in the source code of free open source software, setting up your own dummy systems that you can experiment on safely, reading articles on internet security, etc, can be just as educational.

2
votes

The answer is: it depends.

It is, generally speaking, not legal to hack into systems that you do not own.

However, there are some very limited and very hypothetical situations where it may in fact be ethical to do so.

  • Hacking into an enemy government's computer systems during a time of war
  • Identifying the perpetrator of a crime in a "smoking gun" situation
  • Providing evidence of corporate misbehavior that affects the health and safety of others

These scenarios are extremely rare in real life (but happen in hollywood all the time), and are just as likely to get your ass thrown in jail as anything else. But the difference between legal and ethical is important.

1
  • Item #2, is covered by laws against illegal search and seizure.
    – NotMe
    Dec 1, 2009 at 14:53
1
vote

There are organisations/companies that charge for their 'white hat' services, they're usually paid by large companies to periodically test their system's security. Perhaps you could find one of these groups near you and offer your services (initally for free I would suggest), it'll be good training for you, possibly make you a bit of money eventually and importantly is inherently morally sound.

Not the answer you're looking for? Browse other questions tagged .