Hackers make the news regularly for their ever-evolving exploits on major brands and small businesses alike.
But to call someone a hacker alone is ambiguous. There are many different types of cyber security hackers, all with separate motivations and tactics for launching their attacks.
Let’s get some clarity around the many faces of the bucket-term hacker to more accurately describe what it means to breach protected systems.
When people think of the word hacker, this is the persona that often comes to mind. Black hat hackers are the “bad actors” looking to break into a secure system for nefarious reasons. They hack without permission, in a stealthy manner to remain undiscovered until they gain unauthorized access to a system. Their goals are usually to cause harm by stealing or destroying data, halting operations of technology, or any other act with malicious intent.
The complete opposite of a black hat hacker is a white hat. This is someone who never means harm to a system. These are your ethical hackers and are trained professionals within the IT industry who use their knowledge of systems for “good.” Oftentimes, white hat hackers are penetration testers and other cybersecurity experts — like our team at Mitnick Security! — with the goal of helping companies discover their vulnerabilities and build stronger cyber defenses.
A grey hat hacker is someone in between a nefarious black hat hacker and an ethical white hat hacker. Like black hat hackers, grey hats often exploit systems without permission and compromise data or technology. The key difference is grey hats breach or steal information for what they deem a higher purpose — often one that would benefit others.
For example, grey hats may be an activist who breaks into a major makeup brand to prove they lie about testing their products on animals. They often overlap with a more vendetta-driven hacker, coined the term “hacktivists”. These grey hats are devoted to a social, ideological, religious, or political cause. Overall, grey hats do not have “bad” intentions — rather, they violate privacy, leak data, block network connections or cause trouble for the greater good of the public against a company they have a vendetta against.
Similar to grey hat hackers, red hats are a blend of white and black in that they don’t necessarily ethically hack. Red hat hackers often pursue black hats in an attempt to take them down, destroying their computer systems (vs. turning them over to the police) and are often thought of as “vigilantes.” Other times, red hats work directly with government agencies, the feds, and other organizations to bring a malicious hacker to justice.
These are the new kids on the digital block. Green hats are amateur hackers still learning the ropes. They often are wannabe hackers who study the hacking community through how-to videos or tutorials. Sometimes, they practice actual hacking to see what they’re capable of doing and learn new ways to breach systems.
Unlike green hats who are keen to learn about the world of hacking, blue hats are often amateurs with an attitude. They use their rudimentary skills for revenge or to “show off” and rarely execute complex exploits, as they aren’t very technically advanced, nor do they have the experience to back it up.
BlueHat (as one word) is a different type of hacker. The word is used to describe computer security firms hired to test a system prior to launch. The brand Microsoft is well known for hiring BlueHats to test their Windows products for vulnerabilities.
Script kiddies get their name for being amateur hackers who rely on predefined scripts and programs developed by elite hackers to conduct their attacks. One of their big “Kiddie Script” moves is DoS and DDoS attacks, as they’re noisy and can grab a lot of attention — which may seem important as a newbie, as they seek to prove their worthiness as a hacker.
Governments across the world hire professional hackers to break into another nation or international agency’s digital system. They sometimes have designated assignments to unlock certain sensitive information or broad “find whatever you can dig up” orders. They typically fly under the radar to remain undetected by their rivals and their findings are exclusively reported back to their government client.
Some use their hacking intel to terrorize a specific business, industry, or sector in a rival nation. These cyber attackers are usually politically-motivated and seek to cause mayhem or warfare. A recent example of a cyber-terrorist is the Eastern European ransomware-as-a-service group DarkSide and their attack on the U.S. Colonial Pipeline.
Bad actors are not just hackers outside of your organization… Sometimes they work within. An angry employee or disgruntled partner with access to sensitive data may use their privileges for malicious purposes. For example, they could route money to their personal account or install unauthorized malware to watch other employees.
Whistleblowers get their name for leaking and drawing attention to private data stolen from within their own organization or an organization they used to work for. Often it’s information or activity occurring within a private, public, or government organization that’s illegal, illicit, abusive, or deemed otherwise immoral or questionable behavior.
In order to protect your business against all these different types of hackers, it’s important to know their methods of attack and what kind of data they’re after.
In our 5-1/2 Easy Steps to Avoid Cyber Threats guide, we share some actionable tips for safeguarding your organization from internal and external threats hackers leverage to breach systems. Download your complimentary ebook today.