Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to system, just proves there are some security holes.

share|improve this question

closed as not constructive by womble, Chopper3 Aug 18 '11 at 14:13

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

21  
First, get a lawyer on retainer... you may need them soon. –  Marc Gravell May 13 '09 at 8:47
    
Whether it's ethical depends on the standard against which it's measured. You figure that part out. Legality is arguable but less subjective. Call your lawyer for advice on that. This question can't be answered here. –  sh-beta May 14 '09 at 4:00
6  
You will never know if it made any damage or not. –  Oskar Duveborn May 14 '09 at 8:58
    
@Oskar, I'm fairly sure doing something like echo 'you have security trouble' > /root/HACKED is going to cause much damage. –  Unkwntech Jul 24 '09 at 15:52
1  
Do you find it ethical? It's not ehtical and you know it and nobody of sound mind is going to tell you that it's OK. Is it ethical to break into someone else's home? Not to steal anything but just to test your knowledge and learn something new. Is it ethical for me to hack your systems? Not for profit, just to test my knowledge and learn something new. –  joeqwerty Dec 1 '09 at 15:46

13 Answers 13

up vote 27 down vote accepted

It has been shown time and time again it's not ethical. And if you discover a flaw, then they'll likely nail you to the wall if they don't mind the publicity. When you do any sort of security testing, make sure you have permission in writing from someone with the authority to give it. Why?

See Randal L. Schwartz. He fought the conviction for 12 years and finally had his record expunged. He was doing something most sysadmins at the time wouldn't have thought twice about. But convicted he was.

share|improve this answer
2  
Corporations pay large sums of money to penetration testers to break into their own systems. A good penetration tester will use a live exploit to break in and leverage the issue to find more vulnerabilities. It comes down to permission. –  Rook May 17 '10 at 20:27

The key flaw I see in your question is that you seem to believe it is possible to correctly assess from the outside what the damage hacking will do to a given system.

How do you know that flipping a given bit the wrong way isn't going to completely destroy something and cost your target thousands or millions of dollars.

Since ethics are very subjective I will answer you this way. It would be far more ethical to leave stuff alone that doesn't belong to you or you don't have explicit permission to touch.

share|improve this answer

If you just want to improve you security knowledge, there is a linux distribution called Damn Vulnerable Linux. It is used as a teaching aid in university security classes and includes many security vulnerabilities on purpose.

Just install that on a spare computer, much more ethical and you can learn just as much.

share|improve this answer
1  
+1 because it's far better to hack your own stuff to learn than it is to hack someone else's. Then, once you've learned some tricks, the suggestions to get in league with some black hat services companies makes sense, because those folks are contracted to hack systems, so legality is no longer in question. –  Milner May 13 '09 at 13:06
1  
+1 for the suggestion. Also @Milner, I believe you are referring to "white hat" companies. –  tomjedrz May 13 '09 at 16:00

In a word, No.

If you find something out in a routine way then it would be good to alert them and not exploit it. But deliberately going out to test someone else's security is not really ethical.

They ought to be paying security firms to do this for them and if they have contracted you to do this, then it is clearly not unethical. But if you have not been contracted to do this, and you unintentionally expose some problem, or cause a problem unwittingly through your hacking actions, I suspect most corporations would want you prosecuted.

For your own safety, I would not go there. If you are really interested in this, try applying for jobs with the security firms contracted to do this.

share|improve this answer

No, that is not ethical.

If they take you to court for illegally breaking and entering, the judge will not let you off because you were "testing your security knowledge and learning something new".

If you stumble upon a security vulnerability during normal use of their system, I would argue it is absolutely ethical to alert them of the problem, but to explicitly go searching for vulnerabilities when you are not contracted to do so is not only unethical, in many localities it is also illegal.

share|improve this answer
    
Actually in many legislations, the judge might let you off. In such legislation, act of hacking itself isn't illegal, it is illegal to gain access privileged information, modify such information in any way, disrupt normal operations of the system, etc. But IMHO, that doesn't make that ethical. –  vartec May 13 '09 at 10:06
3  
I wouldn't risk jailtime over a judge's potential lack of technical knowledge. –  ceejayoz May 13 '09 at 15:19
    
@vartec: even attempting to hack computer systems you do not own is illegal. Kind of like attempting to steal someones car is still illegal whether you are able to actually drive away with it or not. –  Chris Lively Dec 1 '09 at 14:51

Permit me to paraphrase your question:

"Is it ethical to break into someone's house, just to prove that it can be done, even if you don't steal anything?"

@Marc Gravell's point about retaining a lawyer is well made...

share|improve this answer

We had a security specialist check some legacy AIX applications and server configurations, he did a very friendly and narrow scan of an IBM blade chassis with PPC blades and when it tried to connect to the management card - that instantly rebooted!

No one would ever have thought that, and it was clearly a bug in the card. But the possible damages of even a friendly ping are simply astounding. You can't say you "do no damage" - that's simply not a statement you can guarantee.


(in this case, rebooting the management card had little impact except the fans losing management, going into full speed, which if you've ever had an IBM Bladecenter know means the visitors in the reception area two floors down from the server room can't hear each other for a few minutes ;)

share|improve this answer

Only if you tell them first and they give you permission to give it your best shot.

...and how likely is that :)

share|improve this answer

Calling upon my advanced knowledge of what the question "is it ethical to do X?" means (1), the answer is "no".

(1) It means "should we do X?"

share|improve this answer

The other two answers to this question (when I read it) are excellent, so I would just like to add a small suggestion. Don't take for granted that you can't gain the same amount of knowledge through completely legal means. Studying encryption, trying to find security holes in the source code of free open source software, setting up your own dummy systems that you can experiment on safely, reading articles on internet security, etc, can be just as educational.

share|improve this answer

The answer is: it depends.

It is, generally speaking, not legal to hack into systems that you do not own.

However, there are some very limited and very hypothetical situations where it may in fact be ethical to do so.

  • Hacking into an enemy government's computer systems during a time of war
  • Identifying the perpetrator of a crime in a "smoking gun" situation
  • Providing evidence of corporate misbehavior that affects the health and safety of others

These scenarios are extremely rare in real life (but happen in hollywood all the time), and are just as likely to get your ass thrown in jail as anything else. But the difference between legal and ethical is important.

share|improve this answer
    
Item #2, is covered by laws against illegal search and seizure. –  Chris Lively Dec 1 '09 at 14:53

There are organisations/companies that charge for their 'white hat' services, they're usually paid by large companies to periodically test their system's security. Perhaps you could find one of these groups near you and offer your services (initally for free I would suggest), it'll be good training for you, possibly make you a bit of money eventually and importantly is inherently morally sound.

share|improve this answer

About every other advice given...

I think he's asking about ethicals, not legal, if he want's to know if it's legal, he should ask a lawyer on his state/country...

About the ethical thing... I think its on himself. Maybe it's ethical for me, or for him (or not), maybe for some of you it is, maybe not... but would be nice to know your reasons for this...

share|improve this answer
1  
If he was in fact amoral, he wouldn't be asking the question. –  David Thornley Dec 1 '09 at 17:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.