what is a black hat/white hat?

a black hat hacker is a hacker who is interested in doing or actually does bad things... black hats are the bad guys, the attackers, the ones who make things worse for everyone else by breaching the security or corrupting the integrity and reliability of systems... crackers are a type of black hat...

a white hat hacker is the opposite of a black hat... it's a hacker who tries to prevent bad things from happening or from being done... white hats are the good guys, the ones who try to help vendors make their products more secure and users/administrators make their systems more secure... most of the security researchers on the various security lists are white hats...

the two terms come from the old movie stereotype where the bad guy always wears a black hat and twirls his mustache and the good guy always wears a white hat... the colours denote a moral polarity and so as one might expect the concept of shades of grey was introduced with the term grey hat, which is someone who sometimes acts as a black hat and sometimes as a white hat and basically shows no significant alignment with either side...

more recently, microsoft introduced the term blue hat... blue hat doesn't fit into the existing moral color code framework of good/bad/indifferent, and will probably lead to the dilution of the concept because after asking what a blue hat is a person would most likely ask what a red hat is...

back to index

rebuttal to 'how the anti-virus industry is turning a white hat black'

read the original article here... i'm amazed at the shoddy analysis performed by the author...

first of all, just because someone calls themself a white hat doesn't make it so... the guy put a modified version of a so-called 'rootkit' (we won't go there this time) on the web where anyone can get it... modified in such a way that existing detection routines would fail to find it... how the hell does anyone mistake that for something a white hat would do?...

second, just because he put it on the web doesn't mean it's going to find it's way to the anti-virus developers or to anyone else for that matter... the idea that important people will sit up and take notice because you put something on your website is the height of egocentricity (i'm lucky if i get 10 hits a day here, i know i'm not reaching many people)...

third, it was a 'rootkit' not a virus... why do people insist on calling everything bad a virus?

fourth, the reality is that at most the anti-virus companies were given 1 month and 5 days notice (march 1 to april 5)... now that's still a pretty long time for so many companies to fail to add detection but it's not the 3 months the author was claiming...

should anti-virus companies add detection for this non-virus? probably, since it's now more a matter of defending against malware in general than viruses in particular... is it a high priority? probably not... at least not yet... non-replicating malware rarely becomes as big a threat as the self-replicating variety... i'm sure it'll get added eventually but i'm not too concerned if it has to prove itself as a threat first...