# data[].attributes.body
The general definition is someone who uses computers to gain unauthorized access to data.
HOWEVER
Not all hackers have a malicious intent.
There are three different types of hackers, White Hat Hackers, Gray Hat Hackers, and Black Hat Hackers

# data[].attributes.body
White hat hackers use their skills to improve a company's security and work to expose possible vulnerabilities within a system to help the company in the long run.
- White hat hackers work specifically for the company
- These guys do not work for free though, depending on the hacker, the prices can be varied.

# data[].attributes.body
Gray hat hackers work in the 'gray' area. They do not work directly for the company. But they work to their own digression.
- They try to find errors and vulnerabilities in a system of a company (without the company knowing), and then they let the company know about the weakness, but for a 'small' fee.

# data[].attributes.body
Black hat hackers are the most malicious and often are the type of hackers that we think of when we hear stories in the news about large corporations being hacked.
- These hackers attempt to find security flaws and exploit them for their own personal and often malicious gain.

# data[].attributes.body
Do you need to hire a hacker?

# data[].attributes.attachment_link.keywords[]
permanent removal of bad/negative reviews or reputation hacker

# data[].attributes.attachment_link.title
Hire A Hacker Cheap Online!Online Hackers Help|Need Genuine Phone Hacker?

# data[].attributes.attachment_link.description
Hire A Hacker Cheap Urgently from the most Genuine,Legit,Trusted Professional Craigslist Hackers for Hire.Our Online Hackers Help team of certified ethical hackers offer hacker for hire services at Affordable prices.

# data[].attributes.body
These attacks are when the user systematically attempts and checks all possible passwords passphrases until the correct one is found.

# data[].attributes.attachment_link.readable_text
Cybersecurity Threat Categories

Before diving into specific types of cyberattacks, let's first discuss some of the motivations behind why threat actors would look to wreak havoc on a security organization.

Cybercrime

This category includes efforts by threat actors to profit from malicious attacks, and can be subcategorized into actions like direct financial theft, use of stolen credit card information, dark-web marketplaces for information obtained via data breach, or even hijacking computing resources for activities like crypto-jacking to mine cryptocurrencies.

Disruption

This category includes attempts to disrupt the operations of organizations by attacking their IT and operational technology (OT) infrastructure to damage it, temporarily shut it down, or hold it for ransom.

Espionage

This category includes cyberattacks backed by state agencies that are part of broader intelligence and/or military activities. This can cover actions like spying on a foreign government to steal confidential data to further strategic or financial advantages.

Unintentional Threats

According to the Cybersecurity & Infrastructure Security Agency (CISA), this category includes:

"Negligence - An insider of this type exposes an organization to a threat through carelessness. Negligent insiders are generally familiar with security and/or IT policies but choose to ignore them, creating risk for the organization. Examples include allowing someone to "piggyback" through a secure entrance point, misplacing or losing a portable storage device containing sensitive information, and ignoring messages to install new updates and security patches.

Accidental - An insider of this type mistakenly causes an unintended risk to an organization. Examples include mistyping an email address and accidentally sending a sensitive business document to a competitor, unknowingly or inadvertently clicking on a hyperlink, opening an attachment in a phishing email that contains a virus, or improperly disposing of sensitive documents."

Often there is considerable overlap between these top-level categories. For example, state-based operatives frequently hand over newly obtained documents or discovered vulnerabilities to cybercriminals to use in malware, ransomware, and other cyberattacks.

Common Types of Cyberattacks

When a criminal is trying to hack an organization, they won't try something novel unless absolutely necessary. They draw upon common hacking techniques that are known to be highly effective, such as malware or phishing.

Whether you're trying to make sense of the latest data-breach headline in the news or analyzing an incident in your own organization, it helps to understand different cyberattack vectors.

Malware

Malware refers to various forms of harmful software, such as viruses and ransomware. Once it is in your computer, it can wreak all sorts of havoc, from taking control of your machine, to monitoring your actions and keystrokes, to silently sending all sorts of confidential data from your computer or network to the attacker's home base.

Attackers will use a variety of methods to get malware into your computer, but at some stage it often requires the user to take an action to install the malware. This can include clicking a link to download a file, or opening an email attachment that may look harmless (like a document or PDF), but actually contains a hidden malware installer.

Ransomware

Ransomware is a form of malware that encrypts data on infected IT systems. It demands a ransom in exchange for a code that will - hopefully - decrypt the infected system. The ransom payment usually goes to an anonymous address using Bitcoin.

Adware

Adware is a type of malware that displays unwanted ads on end-user devices to generate revenue from advertisers. It often will be installed on user devices after tricking people into clicking a link. Adware then displays the ads and simulates user clicks to defraud advertisers into thinking that legitimate users are interacting with their ads. They then pay the cybercriminals for these clicks.

Crypto-Jacking

Crypto-jacking is a type of malware that uses the resources of the infected IT systems to "mine" for cryptocurrencies. This steals the attacked system's computing resources by running at a high load to generate income for the remote attackers. They'll then make money from the sale of the cryptocurrencies generated on the infected system.

Phishing

In a phishing attack, an attacker may send you an email that appears to be from someone you trust, like your boss or a company you do business with. The email will seem legitimate, and it will have some urgency to it (e.g. fraudulent activity has been detected on your account). In the email, there may be an attachment to open or a link to click.

Upon opening the malicious attachment, you'll unknowingly install malware in your computer. If you click the link, it may send you to a legitimate-looking website that asks you to log in to access an important file - except the website is actually a trap used to capture your credentials.

Spear Phishing

Spear phishing is a highly targeted variant of phishing that uses a fake email or message from a supposedly important individual to trick a person within the same organization or a partner organization. Spear phishing attempts hope to use the extra authenticity - albeit imposter authenticity - of the sender to trick people into providing information they shouldn't.

SQL Injection Attack

A structured query language (SQL) injection attack specifically targets servers storing critical website and service data. It uses malicious code to get the server to divulge information it normally wouldn't. SQL is a programming language used to communicate with databases, and can be used to store private customer information such as credit card numbers, usernames and passwords (credentials), or other personally identifiable information (PII) - all tempting and lucrative targets for an attacker.

Cross-Site Scripting (XSS)

Cross-site scripting (XSS) attacks also involve injecting malicious code into a website, but in this case the website itself is not being attacked. Instead, the malicious code only runs in the user's browser when they visit the attacked website, where it directly targets the visitor.

One of the most common ways an attacker can deploy an XSS attack is by injecting malicious code into a comment or a script that could automatically run.

Botnets

Botnets are widespread groups of devices that have been compromised and hijacked by cybercriminals. The threat actors use them to target IT systems with distributed DoS attacks or other attack types.

Denial-of-Service (DoS)

Denial-of-service (DoS) attacks flood a website with more traffic than it's built to handle, thereby overloading the site's server and making it near-impossible to serve content to visitors. It's possible for a denial-of-service to occur for non-malicious reasons. For example, if a massive news story breaks and a news organization's site is overloaded with traffic from people trying to learn more about the story.

Man In The Middle Attack

A man in the middle (MITM) attack occurs when cybercriminals intercept and alter network traffic flowing between IT systems. The MITM attack impersonates both senders and receivers on the network. It aims to trick both into sending unencrypted data that the attacker intercepts and can use for further attacks or financial gain.

Session Hijacking

Session hijacking occurs when an attacker hijacks a session by capturing the unique - and private - session ID and poses as the computer making a request, allowing them to log in as an unsuspecting user and gain access to unauthorized information on the web server. If everything goes as it should during any internet session, web servers should respond to your various requests by giving you the information you're attempting to access.

Credential Reuse

Credential reuse occurs when someone uses the same credentials on multiple websites. It can make life easier in the moment, but can come back to haunt that user later on. Even though security best practices universally recommend unique passwords for all applications and websites, many people still reuse their passwords. This is a fact attackers will readily exploit, thereby turning those reused passwords into compromised credentials.

Insider Threats

Not all cyber threats originate from external sources. Data and other sensitive information like login credentials can leak from inside organizations. This can occur via malicious staff activity or - more frequently - due to an unintended action. An example of such a mistake could be sending an email containing an unencrypted attachment to the wrong recipient.

How to Prevent Cyberattacks

We could cover thousands of tactics and tips for preventing cyberattacks at scale, but let's zoom in and take a look at some key examples:

Phishing Awareness Training

Educate employees on why phishing is harmful and empower them to detect and report phishing attempts. This type of training includes emailing simulated phishing campaigns to employees, monitoring results, reinforcing training, and improving on simulation results. Ongoing security awareness training for staff is also vital, so they know how to spot the most recent versions of suspicious emails, messages, or websites.

Encrypt Data

All data at rest on servers or devices and in transit over the network should be encrypted. If an attacker does get access to data or intercepts it, strong encryption should render it unreadable.

Compromised Credentials Detection

Leverage user and entity behavior analytics (UBA) to create a baseline for normal activity on your network. Then, monitor how administrator and service accounts are being used, which users are inappropriately sharing credentials, and whether an attacker is already expanding from initial network compromise to move around and infiltrate other systems.

Use Multi-Factor Authentication

Implementing multi-factor authentication (MFA) for all systems is a crucial best practice. Requiring an additional piece of information in combination with a username and password protects systems if login details are exposed to cybercriminals. Additional tokens, specific device requirements, and biometrics are all examples of MFA that can be leveraged when logging into IT systems.

Ransomware Prevention

Create a three-point plan to prevent ransomware attacks. This includes minimizing an attack surface, mitigating potential impact once exposure has been detected, and debriefing to pinpoint existing plan gaps. From there, teams can rebuild systems, quarantine endpoints, change credentials, and lock compromised accounts.

Use Endpoint Protection

End-users are frequent targets for cybercriminals, both on their devices and via social-engineering attacks. All end-user devices should have endpoint security protection software deployed. This should integrate with a wider security information and event management (SIEM) tool that allows for organization-wide monitoring and analyses of threats.

XSS Attack Prevention

Institute a filtering policy through which external data will pass. This will help to catch malicious scripts before they can become a problem. This leads into creating a wider content security policy that can leverage a list of trusted sources that are able to access your web applications.

Threat Intelligence Program

Create a central hub that feeds all security-organization functions with knowledge and data on the highest-priority threats. Organizations rely heavily on automation to help scale a threat intelligence program by continuously feeding data into security devices and processes, without the need for human intervention.

Implement Network Deception Technologies

Deception technologies implement onto a network "dummy" applications, databases, and other IT systems. Any cyberattackers who breach the external firewalls will be tricked into thinking they have access to internal systems. In reality, the dummy systems are intended as honeypots to allow security teams to monitor the attacker's activities and gather data without exposing the production systems.

Mobile Device Management Solution

A lot of business activity now happens on laptops, smartphones, and tablets. Plus, many people use laptops for their work. The mobile nature of all these devices means they are at high risk for being lost and/or stolen. All mobile devices (including laptops) should be enrolled and managed in a mobile device management (MDM) solution. If a device is lost or stolen, it can be quickly wiped so that unauthorized users cannot access any data.

Read More
Attack Surface Security: Latest Rapid7 Blog Posts

# data[].attributes.attachment_link.title
Types of Cyber Attacks | Hacking Attacks & Techniques | Rapid7

# data[].attributes.attachment_link.description
What are the most common cybersecurity attacks being performed today? Explore Rapid7's resources to learn more about various types of hacking attacks.

# data[].attributes.body
These attacks are malware that is often disguised as a legitimate piece of software, similarly to the real Trojan horse attack on Troy. Trojans are often malicious hackers that are employed by cyber-thieves.

# data[].attributes.body
This type of attack is executed by manipulating the victim into revealing sensitive or personal information by gaining false trust. Victims of social engineering attacks often mistakenly give away their own passwords, birthdays, etc. due to manipulation from the attacker. Common methods of social engineering attacks are baiting, scareware, phishing, and spear phishing.

# data[].attributes.body
In this type of attack, legitimate users are blocked from using their own services. The attacker will often overload the victims server with messages that have no return, therefore overloading the server and denying the victim of any use of their own services.

# data[].attributes.body
This is a qualification obtained by demonstrating of assessing the security of computer systems by looking for weaknesses in target systems, but using the same tools as a malicious hacker.  However, without the malicious intent.  It is instead used in a lawful manner to help improve security of devices.

# data[].attributes.body
Hacktivism is a term describing hacking that is done with intent of promoting a certain political or social stance. Hacktivists often believe they are hacking for the "greater good" and will often expose flaws in major corporations or governments to promote their ideological agenda.

# data[].attributes.body
In today's world, a certification in hacking is as essential as ever. Almost every single business has an online/internet part to it, whether that be a website or online order service. As a result, businesses are also in need of someone to help provide defenses to the certain device. It is a very popular certification in today's society.

# data[].attributes.attachment_link.title
What is an ethical hacker and what does the work entail?

# data[].attributes.attachment_link.description
An ethical hacker is a security expert who acts like a malicious intruder to penetrate a computer system to reveal vulnerabilities to the system owners.

# data[].attributes.body
In short, no. Hacktivism directly exposed or threatens private information that is protected by law. While hacktivists may believe they are hacking for the greater good, or even doing the right thing in some cases, the type of information exposed is often protected and it is strictly illegal to reveal to the public. For example, the FBI arrested 12 men and two women in July of 2011 from the hacktivist group Anonymous for a DDoS attack against Paypal in December of 2010.

# data[].attributes.attachment_link.readable_text
Not all hackers are inherently bad. When used in mainstream media, the word, "hacker," is usually used in relation to cyber criminals, but a hacker can actually be anyone, regardless of their intentions, who utilizes their knowledge of computer software and hardware to break down and bypass security measures on a computer, device or network. Hacking itself is not an illegal activity unless the hacker is compromising a system without the owner's permission. Many companies and government agencies actually employ hackers to help them secure their systems.

Hackers are generally categorized by type of metaphorical "hat" they don: "white hat", "grey hat", and "black hat". The terms come from old spaghetti westerns, where the bad guy wears a black cowboy hat, and the good guy wears a white hat. There are two main factors that determine the type of hacker you're dealing with: their motivations, and whether or not they are breaking the law.

Black Hat Hackers

Like all hackers, black hat hackers usually have extensive knowledge about breaking into computer networks and bypassing security protocols. They are also responsible for writing malware, which is a method used to gain access to these systems.

Their primary motivation is usually for personal or financial gain, but they can also be involved in cyber espionage, protest or perhaps are just addicted to the thrill of cybercrime. Black hat hackers can range from amateurs getting their feet wet by spreading malware, to experienced hackers that aim to steal data, specifically financial information, personal information and login credentials. Not only do black hat hackers seek to steal data, they also seek to modify or destroy data as well.

White Hat Hackers

White hat hackers choose to use their powers for good rather than evil. Also known as "ethical hackers," white hat hackers can sometimes be paid employees or contractors working for companies as security specialists that attempt to find security holes via hacking.

White hat hackers employ the same methods of hacking as black hats, with one exception- they do it with permission from the owner of the system first, which makes the process completely legal. White hat hackers perform penetration testing, test in-place security systems and perform vulnerability assessments for companies. There are even courses, training, conferences and certifications for ethical hacking.

Grey Hat Hackers

As in life, there are grey areas that are neither black nor white. Grey hat hackers are a blend of both black hat and white hat activities. Often, grey hat hackers will look for vulnerabilities in a system without the owner's permission or knowledge. If issues are found, they will report them to the owner, sometimes requesting a small fee to fix the issue. If the owner does not respond or comply, then sometimes the hackers will post the newly found exploit online for the world to see.

These types of hackers are not inherently malicious with their intentions; they're just looking to get something out of their discoveries for themselves. Usually, grey hat hackers will not exploit the found vulnerabilities. However, this type of hacking is still considered illegal because the hacker did not receive permission from the owner prior to attempting to attack the system.

Although the word hacker tends to evoke negative connotations when referred to, it is important to remember that all hackers are not created equal. If we didn't have white hat hackers diligently seeking out threats and vulnerabilities before the black hats can find them, then there would probably be a lot more activity involving cybercriminals exploiting vulnerabilities and collecting sensitive data than there is now.

# data[].attributes.attachment_link.title
What is the Difference Between Black, White and Grey Hat Hackers?

# data[].attributes.attachment_link.description
Not all hackers are inherently bad. When used in mainstream media, the word, "hacker," is usually used in relation to cyber criminals, but a hacker can actually be anyone, regardless of their intentions, who utilizes their knowledge of computer software and hardware to break down and bypass security measures on a computer, device or network.

# data[].attributes.attachment_link.provider_name
Technology Solutions That Drive Government

# data[].attributes.attachment_link.readable_text
The Air Force is continuing to invest in bug bounty programs to identify cybersecurity vulnerabilities. The service branch recently disclosed a new one in which it hired certified ethical hackers to demonstrate what would happen if an insider "went rogue " and attacked the Air Force's maintenance system.

This past fall, the Reliability and Maintainability Information System program office at Wright-Patterson Air Force Base, was intentionally hacked by "white hat" hackers from bug bounty company Synack. REMIS is the "central, common source of all unclassified maintenance information for Air Force weapon systems." The Air Force wanted to test how much "damage" or "malice" an authorized user could accomplish, according to an Air Force press release.

Over four weeks, 73 hackers spent more than 1,700 man-hours testing REMIS for vulnerabilities and weaknesses, ultimately identifying 12 vulnerabilities with varying severities. The REMIS program office and the REMIS contractor, Northrop Grumman, were able to immediately fix 11 of the vulnerabilities and are taking steps to mitigate the remaining vulnerability, according to the press release. Overall, senior Air Force leaders were pleased with the results.

"The objective of this exercise was not only to assess the strength of REMIS' cybersecurity posture, but to learn how to most effectively establish an enterprise level bug-bounty for the entire Logistics-Information Technology portfolio," the Air Force says. The latest effort lays the foundation for "a broader friendly hack that will further the cybersecurity of Air Force logistics systems," according to the release.

The first Hack the Pentagon bug bounty program occurred in 2016, as the Defense Department used crowdsourced cybersecurity expertise to detect hundreds of vulnerabilities in its public websites. Since then, the DOD has conducted a total of 11 bug bounty programs, including sessions examining the Army, Air Force, Defense Travel Service and the Marine Corps, FedScoop reports.

# data[].attributes.attachment_link.title
Air Force Used White Hat Hackers to Target Its Maintenance System

# data[].attributes.attachment_link.description
The Air Force is continuing to invest in bug bounty programs to identify cybersecurity vulnerabilities. The service branch recently disclosed a new one in which it hired certified ethical hackers to demonstrate what would happen if an insider "went rogue " and attacked the Air Force's maintenance system.

# data[].attributes.attachment_link.readable_text
Step inside the offices of Bluescreen and you'll find some of the UK's most talented young hackers, dragged from a world of crime to fight for the other side.

These computer experts have swapped the confines of their bedrooms for a fairly ordinary looking cyber-security company in Plymouth.

Bluescreen employs hackers the authorities have deemed worthy of a second chance, who pit their wits against some of the anonymous online criminals they used to see as brothers in arms.

When Jack was 19 years old, the police sent five squad cars, a tech team and a riot van to his home.

"It was about 08:10 in the morning. I'd had the most awful night's sleep and I'd just started watching The Lion King.

"It didn't even get past the intro before my bedroom door flew open and 10 police officers came in to arrest me.

"I was not expecting that on any day of my life."

The police were there for a good reason: when he was 16, Jack had stolen personal information from about 1,000 people.

He told police he'd never had any intention of using it for his own gain; to him, it was just an intellectual exercise.

Stories like this are not uncommon at Bluescreen IT, which has a direct link with the police to find hackers in need of direction.

These are young men who have been accused of serious crimes, but instead of being taken through the criminal justice system, they've been given a second chance.

About 15 people work in the Security Operations Centre, a handful of whom have been referred to the company as hackers who aren't malicious in nature and are deemed capable of reform.

Another employee, Cameron, was arrested on his way to school when he was just 14 years old.

Officers from the National Crime Agency had planned the sting so that Cameron would be out of the house, and unable to destroy his hard drives in the event he heard them coming.

"Up to that point my biggest worry was that I hadn't done my maths homework," he said.

"I was walking to school when I heard my name being called. I turned round and there was a man in a suit walking behind me.

"Then I heard him say my name louder, so I turned around and said 'yeah?' and that's when he told me I was under arrest.

"I turned around and there were five more officers spread out across the grass.

"I just didn't realise that what I'd done was that serious. It was all just one big joke - messing around - it never seemed like I was actually causing any real harm. I soon found out how serious it was."

"Grey hat hackers" like Jack and Cameron are seen as having committed their crimes for reasons that weren't to do with personal gain or cyber-terrorism. Sometimes it might have been a practical joke, or perhaps the motive was to launch a server-debilitating attack.

Now they try to stop others - using the methods they once employed - from wreaking the same havoc.

Hackers' hats

White hat hackers - These are the nice guys of the hacking world. They know what they're doing and they use their talents for good, such as getting rid of viruses or legitimately testing the security systems of companies and governments.

Black hat hackers - The bad guys. They're the ones who steal your bank details and sell them on the dark web. They usually hack for personal gain, although it could be some form of cyber-espionage or protest.

Grey hat hackers - Somewhere in between. They might hack a company without permission, only to point out the flaws without exploiting them. What they're doing is still illegal.

The route into a life of hacking isn't always the same, but a lot of the stories are similar, and they often start with gaming.

When he was younger, Cameron liked to tinker with things to see how they worked.

"I didn't like my high scores being beaten in video games - I always had to be the best at them."

He started making "mods" to video games - changes to the code that enabled him to get higher scores - which he said led him to online forums, and then darker areas of the internet.

"I ended up launching cyber attacks, and was later caught by the National Crime Agency," Cameron said.

You may also be interested in:

'I play American football against men'

'Oh my god, it's Gareth Southgate'

The art gallery challenging Islamophobia

For Jack, now 23, it was his "laziness" that led him into the world of computing.

"I was 12. We'd just started doing algebra, but I didn't want to do it.

"I went home and tried to make a calculator for algebra. It didn't really go well, but that is my earliest memory of that side of things.

"I was trying to cut corners any way I could. Rather than studying, I would try and make it look like I was studying and doing well.

"I'd be failing in all my classes but pull it out of the bag at the last minute. After a while the school had had enough of me.

"I got my five GCSEs in Year 10 and then the school expelled me."

Just four years after his arrest, Jack is now working at an advanced level, carrying out processes like penetration testing - trying to break into clients' servers to find weaknesses.

He and Cameron, now 19, also defend against incoming attacks - an area where their hacking experience comes in handy.

One of the more surreal moments in Cameron's first year at Bluescreen was going on the same course as the police officer who had arrested him in 2014.

Det Sgt John Atkin from the South West Regional Cyber Crime Unit was attending a Bluescreen security course as part of his own professional development.

Cameron said: "It's unbelievable - what are the chances of that?

"I never would've thought when he was arresting me as a 14-year-old kid, that we'd one day be on the same course.

"There's an element of learning from each other now. Whenever something comes up in forensics he's the man to explain it best; we're lucky to have him there.

"And then for the attacks I can explain it better.

"We always got along, but I don't think John appreciated much of what I did."

Det Sgt Atkin has "no problem" meeting the hackers he's arrested because the whole point of the police Cyber Futures programme is to "try and develop people".

"What you can see here is that by working with Cameron and his family, and providing the support and knowledge we have, we're able to deliver and put him in a place where his future is set, rather than where he could have been.

"Cameron's a good kid so he's doing really well; the future's bright for him. Hopefully, he'll take this forward and then the world's his oyster."

There's a relaxed atmosphere when you walk into the Security Operations Centre, but it's serious work.

Three monitors on the wall detail which of Bluescreen's clients are being attacked, and how serious the threat is.

The clients, mostly smaller and medium-sized businesses from around the South West, are given codenames like "Black Mamba" or "Green Starfish" - usually a colour and an animal.

The business has just won part of a £500,000 grant from the Department of Culture, Media and Sport to encourage more diverse candidates into cyber-security jobs, meaning it can keep growing, and potentially take on more former hackers.

As apprentices, employees like Jack and Cameron start on a wage of about £650 a month, but after five years of experience they could easily be earning close to £50,000 a year.

But for some reformed hackers, moving into a professional environment can be a big adjustment: even getting out of bed on time is sometimes a bit of a struggle for young men used to working unsupervised, to their own schedule and their own rules.

Now they must do regular office hours as part of a team dedicated to protecting the interests of the company's clients.

It's not just a challenge for the new recruits: some of the hackers who arrive at Bluescreen are autistic, which isn't something that management have had much experience of dealing with.

"It's been a really hard journey for us and a massive learning curve," said the company's chief operating officer, Richard Cashmore.

"We've had to adapt how we manage people - if they need to work in a certain space, we'll go and do that.

"It's about give and take - we can't bend over too far for them because we need them to be employable, but we meet in the middle."

Bluescreen sees itself as a place to develop young people, give them a second chance, and be a haven for those with nowhere else to go.

"It makes me really proud when they achieve industry-recognised qualifications," said Mr Cashmore.

"It's a big deal for them and it's a big deal for us, because we invest a lot of time and emotional effort into these guys, and seeing them succeed after everything we've all been through is very satisfying."

# data[].attributes.attachment_link.title
'I was walking to school when I was arrested'

# data[].attributes.attachment_link.description
Step inside the offices of Bluescreen and you'll find some of the UK's most talented young hackers, dragged from a world of crime to fight for the other side. These computer experts have swapped the confines of their bedrooms for a fairly ordinary looking cyber-security company in Plymouth.

# data[].attributes.attachment_link.readable_text
Hacking to help - and not everyone appreciates it.

In the interest of keeping things light on a Friday, let's turn our attention to a fascinating story that wa s first reported on by ZDNet's Catalin Cimpanu: a Russian-speaking grey-hat hacker has been breaking into people's MikroTik routers and patching them so they won't be exploited by crypto-miners and other kind of digital ne'er-do-wells.

On a Russian blog site, the Russian-speaking Grey Hat, Alexey, boasted that he had already patched over 100,000 MikroTik routers.

"I added firewall rules that blocked access to the router from outside the local network," Alexey wrote. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions."

Unfortunately, the response has been tepid at best. About 50 people have contacted Alexey, a few to say thank you but most of them were angry at the invasion.

There's a little bit to unpack here about Hacker hats, the MikroTik vulnerability and the ethics of this kind of activity.

So, let's hash it out.

What is a Grey Hat Hacker?

When discussing colored hats, there are three that relate to hackers and one that relates to the US president. We're going to focus on the first three.

A White hat hacker is an ethical hacker, typically you see White hats in the context of penetration testing, where they're looking to break a system or application in order to better secure it. They are indeed hacking, but they're doing it for ethical reasons. And they typically have authorization to do what they're doing.

A Black hat hacker is on the opposite end of the spectrum, they have malicious intent and are looking to break into and exploit vulnerable systems. Pretty much every major hack that you see in the news is as a result of state-backed hackers or black hat hackers. Depending on who you talk to, those can actually be one in the same, but there is a distinction to be made between a group like Fancy Bear, which is acting maliciously on behalf of a government and a group like Magecart that is acting maliciously in their own self-interest.

So, let's talk about Grey hats. A grey hat hacker lives somewhere in the middle. Generally speaking, they are breaking laws and violating ethics, but their intent isn't malicious. A good example would be our friend Alexey, who is hacking into MikroTik routers to patch them. It's a net-positive, but there are some ethical questions created by that kind of conduct. We'll address that later.

What was wrong with MikroTik routers?

It's been a bad year for routers in general, but MikroTik specifically had an issue last April ( CVE-2018-14847) that allowed attackers to bypass authentication and download the user database file, which can then be decrypted and harvested for usernames and passwords. This gives the attackers the ability to log into remote devices, jigger with OS settings and run scripts.

MikroTik, which is a Latvian-based company that specializes in routers and wireless ISP systems, released a patch almost immediately. But when was the last time you patched your router? Seriously.

Knowing full-well that most people wouldn't install the update, cybercriminals have been having a field day ever since.

The majority of the exploits have involved crypto-jacking, but some attackers have also used the vulnerability to hijack DNS servers and redirect the traffic towards malicious websites.

MikroTik is one of the larger router manufacturers in the world with over 2,000,000 currently in use-so patching 100,000 of them is still only about 5%. However, only about 420,000 have given indications of infection.

One group that hasn't had much luck with this exploit are botnet herders.

"The usual IoT blackhat botnet factory is basically clueless about the exploit, and how it can be deployed for a proper functioning botnet," Ankit Anubhav, a security researcher for NewSky Security told ZDNet.

So maybe not every cybercriminal is having a field day.

Is this Ethical?

That's the million-dollar question and it's not one that is going to find a consensus anytime soon. Depending on your philosophy about the internet and technology in general, you may look at this as a necessary evil or a complete violation.

The reason that Alexey has been able to patch so many routers is that the black hat hackers attacking them are being sloppy.

"The attackers are not closing [device ports] or patching the devices, so anyone who wants to further mess with these routers, can," Anubhav told ZDNet.

This kind of activity is nothing new, in fact Cimpanu even lists a number of notable grey-hat events.

2014 - A grey hat hacks thousands of Asus routers and planted text warnings about files that were left exposed and reminding users to patch.

2015 - A group of grey hats, ironically called the White team, releases a piece of malware that closes security holes in several models of Linux routers.

2017 - A grey hat releases a piece of malware that punishes people for not patching their IOT devices by either deleting firmware or bricking them.

2017 - A grey hat makes over 150,000 printers print a message to their owners about the dangers of leaving your printer exposed online.

2018 - Another grey hat renames thousands of MikroTik and Ubiquiti routers "HACKED" to scare their owners into updating them.

So is grey hat hacking ethical? Again, it depends on your outlook, but from the standpoint of legality, Alexey isn't exactly abiding the law. It's illegal to access someone else's computer or devices without authorization. And while Eastern Europe and Russia may have a more relaxed attitude about this kind of activity, there are plenty of cases in the US where antiquated laws and overzealous prosecutors have thrown the book at someone for activity far more trivial than this. This is almost the equivalent of breaking into someone's house to fix their deadbolts and alarm system. Thanks, but you broke into my house.

So, ethical? Maybe. Legal? Definitely not.
As always, leave any comments or questions below...

# data[].attributes.attachment_link.title
A Mysterious Russian Grey Hat Vigilante has patched over 100,000 routers

# data[].attributes.attachment_link.description
In the interest of keeping things light on a Friday, let's turn our attention to a fascinating story that wa s first reported on by ZDNet's Catalin Cimpanu: a Russian-speaking grey-hat hacker has been breaking into people's MikroTik routers and patching them so they won't be exploited by crypto-miners and other kind of digital ne'er-do-wells.

# data[].attributes.body
While it is often debated, I believe hacktivism should be supported only in scenarios that objectively benefit the public. Many acts of hacktivists are personally driven on a very debatable agenda and while some may believe this act should be supported, others may disagree entirely. Therefore, when generally speaking about hacktivism, is it best that we do not support these types of activities.