What is Ethical Hacking to you??

hi, i'm not sure if what i'm asking here has been asked before.
i got into a discussion with a friend(programmer) recently.
we were playing a new game incorporated into a forum both of us were in and was put into beta testing.
as with any new games, there's bound to be bugs and he managed to find them.
he was happily playing with the game using the bug till confronted by the other members of the forum who were unhappy with his actions. he claimed that he was merely testing out the exploits to confirm them before reporting to the owner of the game.
if he were to just spawn 1 or 2 items, cash and increase the stat by a little for testing purposes, i'd take it that he is just trying to confirm the bugs but he went as far as too gaining the maximum amount of items, cash and increase his character till near invincible status.

is that still considered ethical?? even if he did report the bug later on to the owner??

sorry if everything is too confusing. my english isn't really that good.

Well lets take this into consideration... what ever you call yourself be it hacker/cracker or as I like to call myself just a average guy who is sick of little children nameing everything they see online... I'd just like to go online for once without being surrounded by peaple who want to be appart of a big scene. But what ever you call what you are or what you do with the time you have... be it the ability to programing or just the enjoyment of computers. A phrase comes to mind "who cares".

And with that said If you need someone to tell you what is right and wrong then find a priest or something. I know it sounds sarcastic but seriously dude.

Before we judge whats right and wrong FOR YOU... you never said how he was testing this. For all we know it could have been over a small LAN, over the localhost through loopback addressing if possable, & (ect). As for the way he handeled this... so he braged a bit so what? I turn on my computer and 99.9% of the dumb kids out there are usually looking for a way to appear to have know-how infront of others & to make a name for themselves. But either way the information is out there.

Shouldn't this be in Cosmos? It's nothing to do with SEC as far as I am concerned...

"right" and "wrong", such big words. Is it right to break hearts? Is it wrong to relieve somebody of funds or items? I don't know, but priests don't come within 9 metres of me, and mental help is poorly organized around here. So I don't have my answers...

Quote:

---

Well lets take this into consideration... what ever you call yourself be it hacker/cracker or as I like to call myself just a average guy who is sick of little children nameing everything they see online

---

As humans, it is our nature to place a label upon things, so that we may better understand them, and recognize them apart from other things.

Quote:

---

And with that said If you need someone to tell you what is right and wrong then find a priest or seek out for some mental help or something. I know it sounds sarcastic but seriously dude.

---

There are no need for insults here. People sometimes must question actions as wrong and right, as those lines can be blurry to even the most devoute priest. To ask, to be informed, and to seek others to help you understand is no different than a child learning to apologize. We must each have a time to learn the rights and wrongs of everything, even if our heart speaks it, and may thus need the backing of others.

Quote:

---

Shouldn't this be in Cosmos? It's nothing to do with SEC as far as I am concerned...

---

AO isn't just about system security alone, nor is Cosmos just for debates. The question they have is a true honest newbie question, in which they are curious about the ethics of someone else. To know right from wrong helps them plan their path better.


To the parent poster, I offer my thoughts:

- The moment he found the bug and had basic information, he should have reported it. Even without basic information, even the knowledge of such a bug should have been reported ASAP.

Why? Because if he honestly was there to help, he would not have continued using it. I do not feel his heart was set on help, rather than "Taking advantage" until he was caught. He was in the wrong, but that is merely my opinion.

first off, thanks for both replies.
just to clarify something, i am no hacker nor expert in computers.
i'm just a regular computer user.
i'm not exactly sure where this thread should go to, if it is the Cosmos, then i hope the moderator will help me move it there.

i don't mean for this to be a right or wrong discussion.
what i want to know is,

should an ethical hacker exploit the bugs he/she discovered and report it later on
or
report the suspected exploit the moment it is discovered whether or not it is a confirmed that the exploit really works.tests can be carried out later after reporting it,right??

In responce to your new post, I say this:


An exploit should be announced the moment it is discovered, but make sure to have an example. One example, two if the problem allows more than two things. However, you do not CONTINUE to test it to every aspect. You are only there to help them find the existance of bugs and with support to prove it does exist. Leave indepth testing and exploitation testing up to them, or until they give you permission to further explore.

Even then, you should never do what your friend did. As it would be similar to finding a hole in a bank's servers, exploiting it and stealing all the money, and then letting them find out for themselves.

Quote:

---

Originally posted here by pooh sun tzu
In responce to your new post, I say this:


An exploit should be announced the moment it is discovered, but make sure to have an example. One example, two if the problem allows more than two things. However, you do not CONTINUE to test it to every aspect. You are only there to help them find the existance of bugs and with support to prove it does exist. Leave indepth testing and exploitation testing up to them, or until they give you permission to further explore.

Even then, you should never do what your friend did. As it would be similar to finding a hole in a bank's servers, exploiting it and stealing all the money, and then letting them find out for themselves.

---

yup, i did quote the example of finding a bug in the bank servers and exploiting it but he kept arguing that he was just merely testing and meant no harm.
i needed some expert views on this because he kept saying that we do not have the mentality of a tester to understand his point of view.

thanks a lot. i welcome all views on this.

So he feels that if he breaks into a bank, steals the money, that he can merely tell the police/fbi that he was "merely testing, and meant no harm"?

Point in case, it went beyond "wow, look what I found by accident" into a crime. As for mentality of a tester, I'm a beta tester for Vendetta, many Opensource projects, Microsoft, Ragnarok Online (years ago), and many Ragnarok Online emulators. Many of us are beta testers and understand the limits, so we understand how to test from a beta testers point of view.

Your friend turned it into a crime the moment he realised what he was doing, and decided to continue doing it instead of reporting it.

I did not mean to sound... like I know everything. I do not :). Just a thought.

I agree with pooh sun tzu on this one, going more than just finding the exploit goes into something else than beta-testing. In the case of the game it was cheating, in the case of applications and programs it is considered illegal [well, in France it is illegal altogether to even say you found an exploit, as per Bug-traq newsletter and posted by MsMittens on AO]. Was it "wrong" or "unethical"? In your friend's case I just think it's unfair given that it was known the server was still in developing. In general I refrain from formulating an universal recipee, I acknowledge that certain circumstances might call for certain variance in the way this problem is tackled.

[edit]
If some of this seems redundant with the above post, it should be known I was posting at the same time with pooh
[/edit]

Yes pooh sun tzu... since it is in the beta version companies I beleave under certian promisses you are forced to make and under the law I also beleave that you are not even supposed to talk about the game when its still in its beta stages. And yes he could have told the company about this. But if that were not the case here you'd make that sound as if talking to a guys on a board or whatever about it before any offical reports are made and sent out to peaple is somehow "less ethical" than posting it all over sites just like bugtraq and securityfocus where thousands if not millions will see it and start a war over who can produce the best exploits and patches in the fastest ammount of time.

Quote:

---

But if that were not the case here

---

I speak only on a case by case basis, and for now, this parent poster is the only case worth thinking about.

edit:

TheSpecalist, I don't know how you keep getting positive points on a post in which you insulted someone. So, I'm going to now continue quoting from your continually edited post.

Quote:

---

Before we judge whats right and wrong FOR YOU... you never said how he was testing this. For all we know it could ha..

---

How his friend tested does not matter. It was his friends actions, and his actions that we were to decide. Chances are, they are not able (by the TOS agreement) to even say what game, company, or methods. You should have known better.

Quote:

---

..bragging ..

---

He never said his friend bragged. He said his friend was caught. Please RTFA. We need to help him with advice, not continually critisize his post with things that make no difference to an ethical question.


I wish the parent poster the best, and that his friend learns from this.

Quote:

---

Originally posted here by Peregin
as with any new games, there's bound to be bugs and he managed to find them.
he was happily playing with the game using the bug till confronted by the other members of the forum who were unhappy with his actions.

---

Ummm... he went on a forum and talked about how he did this and that and as you said... he could have just reported it without makeing a big scene over it. So yeah I'd call that braging a bit. I gave a frank and honest opinion about my thoughts on ethics. Me and you have already talked about this once before through another account. Go ahead and report me to JupM agian.

And as before I still don't see where I insulted anyone. If I did then ummm opps?! But I don't get where I insulted peaple for example saying "your a dumb mother ****ing bitch" or simply "go to hell mother ****er".

it was some kind of web based script games. as to how he found the bug, i have no idea. that is why i did not mention the methods.

I agree with TheSpecialist on the part about bragging but he did not talked about it in the forum. after increasing everything for his character he went on challenging people to play the game with him. i take that as bragging.

thanks again everyone for their opinion. i hope this does not turn into a quarrel.

Quote:

---

Originally posted here by pooh sun tzu
I speak only on a case by case basis, and for now, this parent poster is the only case worth thinking about.

edit:

TheSpecalist, I don't know how you keep getting positive points on a post in which you insulted someone. So, I'm going to now continue quoting from your continually edited post.

---

Hey thanks for the neg. I enjoy the excitement of being a stupid noob and luaghing at negative responses over nothing at all. I find the stupidity of alot of this to be very funny.

Quote:

---

Originally posted here by pooh sun tzu
How his friend tested does not matter. It was his friends actions, and his actions that we were to decide. Chances are, they are not able (by the TOS agreement) to even say what game, company, or methods. You should have known better.

---

You clearly are NOT much of a hardcore gamer or have not had alot of experienced with cheaters in action. Well lets take this as a example in diablo 2 there are some localy stored files on your HD. These files contain various information about your money, items, & character stats. And guess what he claimed the type of things this person gained a large ammount of? If he simply tweaked with localy stored files then he was simply testing the game and takeing advantage of his new found *cough "Abilities" which was unethical. But lets say if he found a overflow and was DoSing peaple he had no chance of beating... well this would not only be unethical but would be tottaly steping over the line here. So like this thread was about ethics so you go ahead and read what I said then get angry with me agian & say that this does not matter.

(Edited)

Quote:

---

I won't ask how you suddenly got extreme points, but I won't allow it. You insulted someone, and didn't even get the facts correct. His friend NEVER bragged. They caught him.

---

Oh yes one dot its really just to extreme for you to handel... Oh but wait you neging me and then in a kinda threatening way saying you won't allow greenish responses directed towards me wow... and you think im the jerk here? P.S. Everyone stop greening me for stupid reasons with AP messages such as "good post" or "Welcome back" because this makes Pooh angry when he loses arguements. Oh and from now on we have to say what ever he wants us to talk about, anything else causes him to get angry and accuse peaple of insulting others.

Oh and yes I may have went off topic. It happends to almost all of the peaple who post here but go ahead and singleing me out... thats perfectly fine. And you talking about me insulting peaple along with other things which never happend in this thread oh and you trying to hold a arguement that you couldn't keep going (was not) off topic. Suuuure :rolleyes:

Quote:

---

Hey thanks for the neg

---

Insult people again and tell them to visit priests, and I'll neg you again too. Rudeness is not something we need on this forum. You did get banned for that before, please remember how to act.

Quote:

---

You clearly are NOT much of a hardcore gamer or have not had alot of experienced with cheaters in action

---

Cheating is different than beta testing. There are rules to follow and ethics to follow when beta testing. If you have ever been a beta tester, you should know this.

Quote:

---

But lets say if ..

---

I discuss on a case by case basis. If you want to talk about a completely different subject filled with "what if" and "if this had been different" then by all means do so -but- in a new thread. Keep in mind that this situation is not "what if" or "different". This situation has it's own circumstances and I shall discuss only with those.


There is little need to double post when you already said everything behind your censored post. If you honestly want to discuss this, don't take the parent off topic and confront me via PM. I will be more than happy to continue this through PM, however you would have to be much more civil. This is a good thread so far, and I would hate to see the parent confused because people keep discussing other things, including insults.


edit:

Quote:

---

because this makes Pooh angry when he loses arguements.

---

No, I am not angry at all. I merely know the difference between a good post (one without insults) and points given away for reasons other than the post being good (such as "Welcome back"). The AP system is not a group warming, welcome back system. It is there to help people sort through information that has been deemed as good, and information deemed as bad.

And so you can't once again try to twist the words of another, my AP said this:

" I won't ask how you suddenly got extreme points, but I won't allow it. You insulted someone, and didn't even get the facts correct. His friend NEVER bragged. They caught him. -"

I wouldn't allow such a comment that insulted someone and undermined them go uncaught and be seen as valid information (aka "everyone can talk down to others and get points!!!!111one") The parent posted deserved more than your harsh tounge.

Well it may have seemed off topic but he didn't go into much detail as to what happened. Right from the start all that was said was he cheated, got alot of money/items then took advantage of various things, then he admitted it and talked about it on some board. I wanted to go further into detail by useing as you call it my "what ifs" as to what happend but apparently keeping it going, how others respond to it, along with not being controlled by you is very insulting. Wow I shall kneel before you. Clearly you doing some of the same stuff which you claim that I did wrong makes you better than me. The only thing insulting about the posts in this thread is the fact that I wasted my time posting here and that I wanted some things pointed out at the same time deffending my own words because you can't accept that you have no authority over me. I tell ya what pal... next time you PM me instead then just save us all this time by me editing my "offensive" behaviour. Or you could just skip my hidden stuff and leave me the hell alone.

Ethical Hacking.

Beating the combination lock on your friends fridge to feed his dog ?

I will say this, I am not completely for releasing exploits to companies anymore. It is becoming way to common for a person that finds an exploit and doesn't exploit it but reports it to the company is charged with a crime. This might bring up another topic all together but, I must say. I for one wouldn't of said anything about finding the exploit. Maybe if I were in a really good mood I would send them an Email from a Yahoo account while I was using a proxy

I don't I just find that people are always to fast to label and your friend had he of told the company he would of been labeled a "Hacker/cracker" which is not a term many people want associated with them by any company these days.

Now as for Ethical Hacking, I believe MB has the best idea of what it is, I have a better way to explain it though. Breaking in your friends house to grab his house keys that he left inside.

/me goes and gets his tool kit and walks off.

to the main question id say that ethical hacking to me, is a hacker hired by any company. they hire them to hack into their own company to see how they can stop other hackers from gaining access to private information on the website or something similar.

by: william

MsB'sITGS Class

Hello and welcome to AO. You are the first whole class that we have had. Naturally, MsB is the account holder, and you guys are responsible to her?. One thing you may not have noticed is the date at the top of a post. If the last one is flashing/blinking, it generally means that the thread is effectively closed, so you should start a new one.

I would recommend that you all read the "stickies" at the top of each forum, and the general site rules. I would also suggest that you get MsB to approve anything new you want to post.

I am not even sure if multiple user accounts are OK with the site rules, I am just advising in my capacity as a fellow member................I personally have no problem, provided MsB accepts "ownership"

To fellow members :

I have talked to the Mods about this account, I can assure you that it is genuine............hey I live in the UK and have my sources ;)

This is a high school for American students living in the UK............I know that quite a few of you have had similar experiences, particularly those from military or major corporate backgrounds.

Cheers



:)