Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to system, just proves there are some security holes.
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.
locked by HopelessN00b Dec 5 '14 at 9:05
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.
Read more about locked posts here.
It has been shown time and time again it's not ethical. And if you discover a flaw, then they'll likely nail you to the wall if they don't mind the publicity. When you do any sort of security testing, make sure you have permission in writing from someone with the authority to give it. Why?
See Randal L. Schwartz. He fought the conviction for 12 years and finally had his record expunged. He was doing something most sysadmins at the time wouldn't have thought twice about. But convicted he was.
The key flaw I see in your question is that you seem to believe it is possible to correctly assess from the outside what the damage hacking will do to a given system.
How do you know that flipping a given bit the wrong way isn't going to completely destroy something and cost your target thousands or millions of dollars.
Since ethics are very subjective I will answer you this way. It would be far more ethical to leave stuff alone that doesn't belong to you or you don't have explicit permission to touch.
If you just want to improve you security knowledge, there is a linux distribution called Damn Vulnerable Linux. It is used as a teaching aid in university security classes and includes many security vulnerabilities on purpose.
Just install that on a spare computer, much more ethical and you can learn just as much.
In a word, No.
If you find something out in a routine way then it would be good to alert them and not exploit it. But deliberately going out to test someone else's security is not really ethical.
They ought to be paying security firms to do this for them and if they have contracted you to do this, then it is clearly not unethical. But if you have not been contracted to do this, and you unintentionally expose some problem, or cause a problem unwittingly through your hacking actions, I suspect most corporations would want you prosecuted.
For your own safety, I would not go there. If you are really interested in this, try applying for jobs with the security firms contracted to do this.
No, that is not ethical.
If they take you to court for illegally breaking and entering, the judge will not let you off because you were "testing your security knowledge and learning something new".
If you stumble upon a security vulnerability during normal use of their system, I would argue it is absolutely ethical to alert them of the problem, but to explicitly go searching for vulnerabilities when you are not contracted to do so is not only unethical, in many localities it is also illegal.
Permit me to paraphrase your question:
"Is it ethical to break into someone's house, just to prove that it can be done, even if you don't steal anything?"
@Marc Gravell's point about retaining a lawyer is well made...
We had a security specialist check some legacy AIX applications and server configurations, he did a very friendly and narrow scan of an IBM blade chassis with PPC blades and when it tried to connect to the management card - that instantly rebooted!
No one would ever have thought that, and it was clearly a bug in the card. But the possible damages of even a friendly ping are simply astounding. You can't say you "do no damage" - that's simply not a statement you can guarantee.
(in this case, rebooting the management card had little impact except the fans losing management, going into full speed, which if you've ever had an IBM Bladecenter know means the visitors in the reception area two floors down from the server room can't hear each other for a few minutes ;)
Only if you tell them first and they give you permission to give it your best shot.
...and how likely is that :)
Calling upon my advanced knowledge of what the question "is it ethical to do X?" means (1), the answer is "no".
(1) It means "should we do X?"
The other two answers to this question (when I read it) are excellent, so I would just like to add a small suggestion. Don't take for granted that you can't gain the same amount of knowledge through completely legal means. Studying encryption, trying to find security holes in the source code of free open source software, setting up your own dummy systems that you can experiment on safely, reading articles on internet security, etc, can be just as educational.
The answer is: it depends.
It is, generally speaking, not legal to hack into systems that you do not own.
However, there are some very limited and very hypothetical situations where it may in fact be ethical to do so.
- Hacking into an enemy government's computer systems during a time of war
- Identifying the perpetrator of a crime in a "smoking gun" situation
- Providing evidence of corporate misbehavior that affects the health and safety of others
These scenarios are extremely rare in real life (but happen in hollywood all the time), and are just as likely to get your ass thrown in jail as anything else. But the difference between legal and ethical is important.
There are organisations/companies that charge for their 'white hat' services, they're usually paid by large companies to periodically test their system's security. Perhaps you could find one of these groups near you and offer your services (initally for free I would suggest), it'll be good training for you, possibly make you a bit of money eventually and importantly is inherently morally sound.