being a whitehat means taking sides

you wouldn't think this needs to be said, but apparently it does - being a whitehat means taking sides. more than that, it means taking the side aligned (more or less) with the general public's interests - doing things for their direct or indirect benefit.

and so it is that i always seem to find myself surprised by people who call themselves whitehats but who sacrifice the public's interests for their own agendas. those people are just lying - to others and perhaps even to themselves - about how good of a 'good guy' they really are. these are greyhats at best or, perhaps more likely, blackhats.

one such case that came up recently was that of peter kleissner (another post on the subject here), an ex-employee of the av vendor ikarus software who released proof of concept attack code and then, after being ousted from his position within the av industry, came up with a service to help malware authors evade the av industry.

i suspect mr. kleissner doesn't actually think of himself as a whitehat anymore, even though he would have generally been considered one at the time his descent started. the thing that stands out most to me, however, and the thing i think needs underlining is the following quote:

I won't make a difference between black hats and AV companies. To me it's not good or bad, it's just technology.

which seems to suggest he doesn't care to draw a distinction between good and bad. there's a word for that boys and girs, and that word is amoral. while it is true that he is still quite young, he is 18 and he was part of the av industry for over a year. i'm curious how one at such an impressionable age could manage to be part of the av industry and still manage to avoid having his moral compass align with that industry and community.

what is a black hat/white hat?

a black hat hacker is a hacker who is interested in doing or actually does bad things... black hats are the bad guys, the attackers, the ones who make things worse for everyone else by breaching the security or corrupting the integrity and reliability of systems... crackers are a type of black hat...

a white hat hacker is the opposite of a black hat... it's a hacker who tries to prevent bad things from happening or from being done... white hats are the good guys, the ones who try to help vendors make their products more secure and users/administrators make their systems more secure... most of the security researchers on the various security lists are white hats...

the two terms come from the old movie stereotype where the bad guy always wears a black hat and twirls his mustache and the good guy always wears a white hat... the colours denote a moral polarity and so as one might expect the concept of shades of grey was introduced with the term grey hat, which is someone who sometimes acts as a black hat and sometimes as a white hat and basically shows no significant alignment with either side...

more recently, microsoft introduced the term blue hat... blue hat doesn't fit into the existing moral color code framework of good/bad/indifferent, and will probably lead to the dilution of the concept because after asking what a blue hat is a person would most likely ask what a red hat is...

back to index

rebuttal to 'how the anti-virus industry is turning a white hat black'

read the original article here... i'm amazed at the shoddy analysis performed by the author...

first of all, just because someone calls themself a white hat doesn't make it so... the guy put a modified version of a so-called 'rootkit' (we won't go there this time) on the web where anyone can get it... modified in such a way that existing detection routines would fail to find it... how the hell does anyone mistake that for something a white hat would do?...

second, just because he put it on the web doesn't mean it's going to find it's way to the anti-virus developers or to anyone else for that matter... the idea that important people will sit up and take notice because you put something on your website is the height of egocentricity (i'm lucky if i get 10 hits a day here, i know i'm not reaching many people)...

third, it was a 'rootkit' not a virus... why do people insist on calling everything bad a virus?

fourth, the reality is that at most the anti-virus companies were given 1 month and 5 days notice (march 1 to april 5)... now that's still a pretty long time for so many companies to fail to add detection but it's not the 3 months the author was claiming...

should anti-virus companies add detection for this non-virus? probably, since it's now more a matter of defending against malware in general than viruses in particular... is it a high priority? probably not... at least not yet... non-replicating malware rarely becomes as big a threat as the self-replicating variety... i'm sure it'll get added eventually but i'm not too concerned if it has to prove itself as a threat first...