| Part of a series on |
| Computer hacking |
|---|
 |
|
Agrey hat (greyhat orgray hat) is acomputer hacker orcomputer security expert who may sometimes violate laws or typicalethical standards, but usually does not have the malicious intent typical of ablack hat hacker.
The term came into use in the late 1990s, and was derived from the concepts of "white hat" and "black hat" hackers.[1] When a white hat hacker discovers avulnerability, they will exploit it only with permission and not divulge its existence until it has been fixed, whereas the black hat will illegally exploit it and/or tell others how to do so. The grey hat will neither illegally exploit it, nor tell others how to do so.[2]
A further difference among these types of hacker lies in their methods of discovering vulnerabilities. The white hat breaks into systems and networks at the request of their employer or with explicit permission for the purpose of determining how secure it is against hackers, whereas the black hat will break into any system or network in order to uncover sensitive information for personal gain. The grey hat generally has the skills and intent of the white hat but may break into any system or network without permission.[3][4]
According to one definition of a grey hat hacker, when they discover a vulnerability, instead of telling the vendor how the exploit works, they may offer to repair it for a small fee. When one gains illegal access to a system or network, they may suggest to the system administrator that one of their friends be hired to fix the problem; however, this practice has been declining due to the increasing willingness of businesses to prosecute. Another definition of grey hat maintains that grey hat hackers only arguably violate the law in an effort to research and improve security: legality being set according to the particular ramifications of any hacks they participate in.[5]
In thesearch engine optimization (SEO) community, grey hat hackers are those who manipulate websites' search engine rankings using improper or unethical means but that are not consideredsearch engine spam.[6]
A 2021 research study looked into thepsychological characteristics of individuals that participate in hacking in the workforce. The findings indicate that grey hat hackers typically go against authority, black hat hackers have a strong tendency toward thrill-seeking, and white hat hackers often exhibitnarcissistic traits.[7]
The phrasegrey hat was first publicly used in the computer security context whenDEF CON announced the first scheduledBlack Hat Briefings in 1996, although it may have been used by smaller groups prior to this time.[1][8] Moreover, at this conference a presentation was given in which Mudge, a key member of the hacking groupL0pht, discussed their intent as grey hat hackers to provide Microsoft with vulnerability discoveries in order to protect the vast number of users of its operating system.[9] Finally, Mike Nash, Director of Microsoft's server group, stated that grey hat hackers are much like technical people in the independent software industry in that "they are valuable in giving us feedback to make our products better".[10]
The phrasegrey hat was used by the hacker groupL0pht in a 1999 interview withThe New York Times[11] to describe their hacking activities.
The phrase was used to describe hackers who support theethical reporting ofvulnerabilities directly to the software vendor in contrast to thefull disclosure practices that were prevalent in thewhite hat community that vulnerabilities not be disclosed outside of their group.[2]
In 2002, however, theAnti-Sec community published use of the term to refer to people who work in the security industry by day, but engage in black hat activities by night.[12] The irony was that for black hats, this interpretation was seen as a derogatory term; whereas amongst white hats it was a term that lent a sense of popular notoriety.
Following the rise and eventual decline of the full disclosure vs. anti-sec "golden era"—and the subsequent growth of an "ethical hacking" philosophy—the termgrey hat began to take on all sorts of diverse meanings. The prosecution in the U.S. ofDmitry Sklyarov for activities which were legal in his home country changed the attitudes of many security researchers. As the Internet became used for more critical functions, and concerns about terrorism grew, the term "white hat" started referring to corporate security experts who did not support full disclosure.[13]
In 2008, theEFF defined grey hats as ethical security researchers who inadvertently or arguably violate the law in an effort to research and improve security. They advocate for computer offense laws that are clearer and more narrowly drawn.[14]
In April 2000, hackers known as "{}" and "Hardbeat" gained unauthorized access toApache.org.[15] They chose to alert Apache crew of the problems rather than try to damage the Apache.org servers.[16]
In June 2010, a group of computer experts known asGoatse Security exposed a flaw inAT&T security which allowed the e-mail addresses ofiPad users to be revealed.[17] The group revealed the security flaw to the media soon after notifying AT&T. Since then, theFBI opened an investigation into the incident and raided the house ofweev, the new group's most prominent member.[18]
In August 2013, Khalil Shreateh, an unemployed computer security researcher, hacked the Facebook page ofMark Zuckerberg in order to force action to correct a bug he discovered which allowed him to post to any user's page without their consent. He had tried repeatedly to inform Facebook of this bug only to be told by Facebook that the issue was not a bug. After this incident, Facebook corrected this vulnerability which could have been a powerful weapon in the hands of professionalspammers. Shreateh was not compensated by Facebook's White Hat program as he violated their policies, thus making this a grey hat incident.[19]