Defacers Really a Problem?

Everybody seems to treat website defacers like they are the scum of the earth.I dont agree with what they do, but are they really that bad? I got defaced 3 times, but it isnt really a problem. You jhust undeface it, which isnt that much effort unless they defaced a string of your websites or every page. But a defaced homepage isnt that much of a problem. shouldnt we be more worried about people deleteing all our files than changing our homepage? Defacers also create MORE traffic. for instance if you are put on ZONE-H people will visit your site. They will get you HIGHER rankings in google, because the google randking system is partly based on how many sites link to your site, and if your site is archived a bunch.... thats a higher link status. Im not saying defacers are good people, but shouldnt we be less worried about them?
its just a philosophical question i think pople should ask themselves.

If you are defaced, then it means there is a hole in your server that gives the public access to information they shouldn't have. What if they have access to email? Payroll? A list of emails? It's information security. If you own a personal website on your own server, then by all means, leave some holes in it so you can get defaced. But if you run a site that others depend on, then your server should be locked, because its your responsibility. I don't see two sides to it, it's someone breaking into your server, and screwing with your work. Having my defaced website posted on zone-h isn't a reputation I would like.

3 times huh? I'd be furious. Good luck when your payment database password is in the hands of a middle school loser. Have fun undefacing that one.

I don't see any good in having a site defaced. It makes you look bad as an administrator (if you were doing your job it wouldn't have been defaced and istead of wasting time "undefacing" the site you could be patching the vulnerable software to keep you from getting defaced.) Also the extra traffic... what if your site does a lot of credit card transactions? If it's defaced then how are your customers gonna feel about trusting your company with private info in what is suppossed to be a secure environment? I am still just a kid and I understand that much.

So like...it kinda like credit card theft. If I steal a card, and go on a spending spree, the customer isn't responsible for the charges (depending on the card). So what's the big deal? I mean, I get my new stuff, they don't pay, and the company gets to make a commercial that promotes their zero-liability policy...

Not exactly the same thing, but similar concept...

Mr. Soda is right, there are other things that come up besides ratings. Believe it or not, while the "hit rating" may go up, the "dependability rating" will go down. If Microsoft gets plastered, that puts up a negative image. That means less people may trust a certain product. That means lost money.

Not to mention revenue lost during the duration of the swapped index page. An e-commerce site will lose BOOKOO bucks, even if they are down for a few hours (which wouldn't be the case - they'd fix it pretty darn fast - but what if?). I think defacers tend to be the scum of the earth. They somehow get access to a box, and THEN figure out some righteous cause for doing it, or they do a shout out to their other uberleet buddies.

Not coo my friend...not coo.

Your question is only slightly less shallow than most of the answers you've recieved. Save for Soda_P's.

There's no debate young one. Defacing Walmart.com is akin to tagging every Walmart storefront in the world... There's no two ways about it. Illegal, immoral, and unethical.

And as far as it not mattering to you, obviously it doesn't matter... it's happened more than twice, which in my book is saying more about how YOU handle security than about THEM getting in and defacing your puny lil' vanity site.

"Those with nothing to lose don't care about what they have." - ME

peace

Quote:

---

Originally posted here by KorpDeath
Your question is only slightly less shallow than most of the answers you've recieved. Save for Soda_P's.

---

Ouch man. We're trying to help, too. No need to be dissin...

Quote:

---

So like...it kinda like credit card theft. If I steal a card, and go on a spending spree, the customer isn't responsible for the charges (depending on the card). So what's the big deal? I mean, I get my new stuff, they don't pay, and the company gets to make a commercial that promotes their zero-liability policy...

---

I don't understand how you think no one gets harmed in credit card fraud and I really don't understand how you can compare the two. Do people get reimbursed if their webpage gets defaced?

Quote:

---

Originally posted here by muert0
I don't understand how you think no one gets harmed in credit card fraud and I really don't understand how you can compare the two. Do people get reimbursed if their webpage gets defaced?

---

Did you not catch my "Not exactly the same thing, but similar concept..." disclaimer? I meant that, from the card holders point of view, if they have zero-liability, they don't have to worry about the charges (zip to subject -> "just un-deface it"), but that doesn't mean they should leave their cards around ("low security"). It's a strech, but use those creative thinking skills...

What I was trying to point out was, if it doesn't REALLY hurt anyone, does that make it okay, even if it's wrong? (Unless you don't see it was wrong, which would explain why you would think this post was in the favor of the defacer...and I pitty you. Fool.)

Trust me. It works. Barely.

You don't think defacing is a problem? It is like breaking into a persons house and then leaving a note saying haha I broke in and could have taken everything and you don't know what I have scoped out (or taken).

I just hope that the little punks that break into your site don't take anything!

However, I must state that I am not classifying all defacers as lame scriptkiddies (ie. WoH) but if noticed most of theses defacers leave the scene once they find out about the stupidity and illegal side of defacing.



- Adiz

Quote:

---

However, I must state that I am not classifying all defacers as lame scriptkiddies (ie. WoH) but if noticed most of theses defacers leave the scene once they find out about the stupidity and illegal side of defacing.

---

Tru dat. I was resisting the urge to call em all lamewise scripters, since it actually takes a certain amount of...skill?...research?...to get into some of these places. The everyday AOL-1337-h4x0|2-bomber-dude is unlikely to pull it off.

But that doesn't mean it doesn't happen....

No what I was saying is I dont understand how you think they are a similar concept. People who get their credit card stolen don't have to pay the bill. The government does that. People who get their website defaced get no retribution and the cheapest webdesigner I've seen lately is $15/hr.

If someone defaces your site, you obviously have a security vulnerability - you should proceed based on the assumption that they have admin/root access on your server and act accordingly unless you definitely know otherwise.

This is typically very expensive, requiring considerable downtime while you reinstall the OS, restore everything from backups, reinstall the security patches, and audit any data you had to take from the compromised system (for example database data which could have been subtly modified).

Then there's the annoying task of reissuing all your legit users with new passwords, re-establishing any trusts you have set up to allow external programs in.

If you're running a web application which uses its own authentication, you have to re-issue all the passwords for that system, as the attacker could have compromised those too.

I'd say that's pretty much a pain in the arse, and far more annoying than "un-defacing". That's pretty much totally useless, as they could have installed a zillion backdoors etc. Even on a relatively simple system (say a static web site with a small number of legit users), it's going to cost you many man-hours in repair work.

Slarty

im not saying defacing is a good thing, im saying its not as bad as we traditionally think. They may be the scum of the earth, and may destroy our reputation and stuff, but its not that difficult to undo. When most peoples sites get defaced they are like:
OMG, my sites defaced, the world is going to end, im screwed, im gonna kill them, where are the feds?
and hings orf that matter. If your not running a high profit site, like me its not really a problem, you can email the members and politely ask them to change pwds etc, not a hard/end of the world thing. Now if microsoft got defaced as you suggested that would be a bigger problem, im not supporting defacers/ments im just saying its not as bad as we usually say it is. It doesnt cost "many hours in repair work" unless your american express of something, and EVEN then you should be worried more about a black hat that crashes the server than a black cap defacer that changes your homepage! If they are crashing the server they obviously have bad intentions so trhey will probably steal pwds etc. The defacer usually defaces and thats all. See how this isnt such a big deal as we as a community normally percieve?Again, im not saying this is a good thing, im just saying its not as good as we thought.

Hint Hint... When you are posting on an IT security forum, you have to accept that most ASSUME you are talking about corporate websites, that run their own servers. Not some puny little website on 50megs.com....

unit321 - I don't think you're taking security seriously at all.

If there's even a *slight* chance that a blackhat has put backdoors in a machine, it MUST be reformatted. Potentially compromised data MUST be audited. This all takes a long time. It needs to be avoided.

So what if in 90% of the cases, the skiddie who defaced the site wouldn't know a backdoor if it slammed in their face? It's a chance that you can't take.

Changing passwords might sound easy, but even with a small site, there can be hundreds.

Couple that with the effort to discover the source of the breach and attempt to rectify it - could be a very expensive process indeed.

It's not a can of spray-paint, you can't just whitewash over it and hope it fades away.

Slarty

Quote:

---

Originally posted here by muert0
No what I was saying is I dont understand how you think they are a similar concept. People who get their credit card stolen don't have to pay the bill. The government does that. People who get their website defaced get no retribution and the cheapest webdesigner I've seen lately is $15/hr.

---

Yo creo que no entiendes lo que estoy diciendo, Sr. Muert0.... When I mentioned that, I was referring to Unit's post - "just changing the index page" - surely it wouldn't take a webdesigner an hour to fix that.

And surely - most corporations have their own designers...so they wouldn't have to pay any more than what they already pay them. But as I said before, that still doesn't MAKE IT RIGHT. ¿Comprendes?

Ahora, pon atención, and stop nitpicking my posts.

Whilst website defacement might seem childish, trivial or a "prank", I think that Soda~ and Slarty are both right on target here............what are the underlying security implications?

Yes you do need to format, re-install etc, just like you would if your desktop PC became "owned".............it is the only secure practice?

The only positive thing I can say is that it has shown you that you have a problem. Unfortunately, just because it was done in such an obvious way does not mean that you can assume that it is harmless................you have to assume the worst?

Remember, it is not like a virus attack that you can "repair".............you have been owned by alien life-forms :eek:

Just my thoughts.......

For the most part it isn't all that difficult to undo. The biggest problems you'll have will most likely be figuring out how they broke in, and the public image hit you'll take for having a security problem thrown in the faces your users. Pretty much everyone who has anything to with this kind of work knows and accepts this.

The incident handling aspects of this can go well beyond what is mentioned in many posts of this thread. If you are a bigger site doing something like e-commerce or online banking there is a very good chance you will end up taking down your entire site to verify the extent of the break in. Then you will be pulling machines out of comission to get backups, or put them on a shelf for later forensic analysis. You'll have to do a good bit of analysis before the wipe and reinstall so that you aren't putting out a box with the exact same vulnerability that got you hit in the first place or at least some more logging and such to collect more data when they make their second attempt. The actual restore process usually will just involve a ghosting of the machine and an install of your web site/web application. Getting your machines back into production is trivial if you have your act together. Doing it right can be a lil more difficult at times.

Next you have your legal problems....If you deal with peoples personal or financial information you will have to do a good bit of work to prove that you did your 'due dilligence'. The proper authorities have to be notified, the data has to be passed between internal and external parties with the appropriate safeguards in place, your legal team notified, etc. If you operate in certain areas (such as california) you may have to send out a mass notification to all of your users to inform them of the security breach. This will further tarnish your image and cost you money.

This whole exercise can cost your dept, company, self, whatever quite a bit of money and time.

If it is your personal site hosted by your isp, you probably won't care as much and will just re-prop or re-write your content. It all depends on your situation.

Judging by your site... are you a web host?

I would think that the reputation of a webhost would be hurt more than the reputation of any other company? Who would use a web host that didn't offer secure servers? Thats horrible...

Our premium plan offers 3 defacements a year?
:confused:


Like nihil said... :borg:

Most sites are also moving away from the old style static pages to dynamic content which normally involves some sort of Database. Now changing your hompeage back aint gonna be that hard as long as you make a backup everytime you update - just load up the backup

but what about i they drop the table your using in your database? Even if your doing daily backups of the database your stil going to lose what ever information has been entered into that database since the last backup - which would be a pain.

Also as alot of people have said already - ok it might increase your hits....but for all the wrong reasons. More people may see your site but less will trust it. Would you write all your credit card information down on a piece of paper and leave it lying in a busy street?

Well thats what you would be asking your visitors to do with any details you collect from them. The fact that someone accessed your site shows that any information you collect from visitors is not secure - and if your visitors know this do you think they will ever trust your site enough to give over sensitive information?

As for your site itself - I really hope you aren't offering webhosting as for you its just a pipe dream and i would give it up now. Its not that you dont have the knowledge to run one (which I dont think you do) - knowledge can be gained.....its your whole attitude...who would want to have hosting with you? what so that they are constantly being asked to fix their sites as you've allowed some defacer to ruin it.

"I'm sorry Mr X that your site has been defaced and you've lost $700 that you paid the designer for it, as well as the $300 your going to lose while your site is down due to lost business....oh and the $350 your going to have to pay the designer to fix it for you.....and not forgetting the damage to your companies reputation which will cost you new customers and repeat purchases from people who did use your site. But hey its not that big a deal - think of the extra traffic you'll get!!" ¬_¬

Of course it isn't going to worry you - your site is just a place to put up ads

Quote:

---

Website Offline
Due to a recent catastrophy our website is currently offline. We will have it back up asap.

We DO NOT offer free hosting

---

the only _content_ on the site the rest is ads - thats just taking the piss!! and a whole 100 visitors....no wonder your soo keen on doing anything to drive up traffic Oo

v_Ln

As SodaP said it isn't the defacement that is the major problem; that can be easily restored. The issue is that you have security hole and that the defacers could possible have access to "secret" information such as passwords, etc... However, I think people who deface websites just want to get their name out there and don't care a whole lot about what your server has. Think about it this way, would you advertise the fact you can break in so they tighten up security and change passwords if you want access, especially continued access? Of course not. Defacers are either script kiddies or people who don't know very much, or it is someone who is looking for a challenge (depending on what webserver they crack, say Microsofts or Googles is probably harder than joeschmo.com).

-Cheers-

Quote:

---

Originally posted here by unit321
Everybody seems to treat website defacers like they are the scum of the earth.I dont agree with what they do, but are they really that bad?

---

i put them on a par with those that would spray paint your property after you fix it up. well actually a step or two below that. sure its easy to restore it but it takes some time and effort to see what else has been compromised which means $$. the site should have been secured better so one or more people could loose their jobs for it. it could have been a new admin just getting started and advice on the vuln would have been appreciated. but after the defacement its going to take allot of effort to overcome that blackmark. i dont think there bad. they might take that as a compliment. i think they're nauseating punks that need a spanking.

I see asking if defacers are a problem akin to everyone saying hackers are malicious. Its a misconception imo. If people were able to secure their box from attack and configure everything correctly, then they should not get defaced. If you do, then find out how they did it and fix it.
Its probably been said but (quit reading thread after juridian's post....got bored) I feel the idea needs to get pounded into people.

They arent the Problem you are. hmmm maybe i'll put that on a uncle sam picture.

I agree with what seems to be the general consensus. Defacing is an illegal act and looks bad on the company/person running the site. Who cares about the number of links to the site when it's reliability has been tainted?

Just my opinoin but if I ever saw a financial institution get defaced and posted on Zone-H, even if for just a few minutes, I can garentee you that I'd yank my money from their accounts and make sure to never do business with them again. If they don't take security seriously enough on their web servers, what makes you think they're taking it any more seriously on the rest of their servers?

I say we always need to be keen on the ways sites can be defaced, cause if they can be defaced, the intruder likely has plenty more access to the system then I'd ever like them too.

There are ways a defacement can occur without running vulnerable software. Whether it be weak FTP passwords, an automated entry path not involving the webserver in question, or even social engineering. Almost all defacements occur due to configuration issues I would say, or rather, the bulk of the attack vectors would be configuration issues.

To answer the OP's question, no, defacers are not a problem for me. Consider that a defacement can be prevented/blocked with appropriate configuration and maintenance practices. Sure, it's not behaviour to be encouraged, but it's a reality of the internet, sysadmins who manage/maintain sites that are defaced are partially to blame.

Quote:

---

Originally posted here by slarty
If someone defaces your site, you obviously have a security vulnerability - you should proceed based on the assumption that they have admin/root access on your server and act accordingly unless you definitely know otherwise.

---

That depends largely on your configuration. If you have an insecure configuration where root access via the webserver is achievable, you are correct. If you do not, you have recourses other than Format & Reinstall.

Quote:

---

This is typically very expensive, requiring considerable downtime while you reinstall the OS, restore everything from backups, reinstall the security patches, and audit any data you had to take from the compromised system (for example database data which could have been subtly modified).

Then there's the annoying task of reissuing all your legit users with new passwords, re-establishing any trusts you have set up to allow external programs in.

If you're running a web application which uses its own authentication, you have to re-issue all the passwords for that system, as the attacker could have compromised those too.

---

Again, this depends largely on the configuration of the system. It is not 100% necessary at all times.

Quote:

---

Originally posted here by The Grunt
Hint Hint... When you are posting on an IT security forum, you have to accept that most ASSUME you are talking about corporate websites, that run their own servers. Not some puny little website on 50megs.com....

---

I don't see why. There are likely an equal number of people who use other hosts here as host their own whether workplace or personally. Indeed the bulk of the questions asked and advice dispensed here relates to home use, not corporate use. Consider the number of "What is the best software/hardware firewall/antivirus/etc.?" threads, and it points to a larger percentage of users being home/SOHO users.

Quote:

---

Originally posted here by slarty
If there's even a *slight* chance that a blackhat has put backdoors in a machine, it MUST be reformatted. Potentially compromised data MUST be audited. This all takes a long time. It needs to be avoided.

---

Every time you boot up and connect to the internet there is a *slight* chance a blackhat could/has put a backdoor on your machine. There are other verification methods than simply "format and reinstall". That is a time consuming way of going about things, and if that's how you do things it explains your view on how much of a pain it is to recover from a defacement.

Quote:

---

Originally posted here by valhallen
Most sites are also moving away from the old style static pages to dynamic content which normally involves some sort of Database. Now changing your hompeage back aint gonna be that hard as long as you make a backup everytime you update - just load up the backup

but what about i they drop the table your using in your database? Even if your doing daily backups of the database your stil going to lose what ever information has been entered into that database since the last backup - which would be a pain.

Also as alot of people have said already - ok it might increase your hits....but for all the wrong reasons. More people may see your site but less will trust it. Would you write all your credit card information down on a piece of paper and leave it lying in a busy street?

Well thats what you would be asking your visitors to do with any details you collect from them. The fact that someone accessed your site shows that any information you collect from visitors is not secure - and if your visitors know this do you think they will ever trust your site enough to give over sensitive information?

As for your site itself - I really hope you aren't offering webhosting as for you its just a pipe dream and i would give it up now. Its not that you dont have the knowledge to run one (which I dont think you do) - knowledge can be gained.....its your whole attitude...who would want to have hosting with you? what so that they are constantly being asked to fix their sites as you've allowed some defacer to ruin it.

"I'm sorry Mr X that your site has been defaced and you've lost $700 that you paid the designer for it, as well as the $300 your going to lose while your site is down due to lost business....oh and the $350 your going to have to pay the designer to fix it for you.....and not forgetting the damage to your companies reputation which will cost you new customers and repeat purchases from people who did use your site. But hey its not that big a deal - think of the extra traffic you'll get!!" ¬_¬

Of course it isn't going to worry you - your site is just a place to put up ads



the only _content_ on the site the rest is ads - thats just taking the piss!! and a whole 100 visitors....no wonder your soo keen on doing anything to drive up traffic Oo

v_Ln

---

we dont have just 100 visitors, that is since the site has been down with no data. We have had thousands and have like 60 members. (b4 the crash) The defacers didnt cause the crash, the host ran out of disk space and crashed. We had like hundreds of posts etc. Were not a struggling site. I think if MR X had enough brains to start that suscessfull of a company, he would have enough to see hes getting ripped off by his advisor who is using his money to help buy a rolls royce with all the other money he is taking from him.

It is odd to keep seeing 'Mr X' used as an example since that is the other nick I use....

Quote:

---

Originally posted here by hopelessC#coder

Just my opinoin but if I ever saw a financial institution get defaced and posted on Zone-H, even if for just a few minutes, I can garentee you that I'd yank my money from their accounts and make sure to never do business with them again. If they don't take security seriously enough on their web servers, what makes you think they're taking it any more seriously on the rest of their servers?

I say we always need to be keen on the ways sites can be defaced, cause if they can be defaced, the intruder likely has plenty more access to the system then I'd ever like them too.

---

If the pentagon got hacked would you leave the country? If you would and you live in america you should have left by atleast the 80s, Pentagon, White house, army, navy, airforce, pretty much all our government sites have been hacked..... Shouldnt you leave using that logic earlier?

Those two examples are NOTHING alike. Ok, maybe a little itty bitty bit, but not close enough to count. If your financial institution gets hacked, all you have to do is withdraw your money and walk down the street to a different one (or type a diff. URL if you do net banking). When you have the choice to make your information/money that much more secure that easily, why not? It's a lot simpler than moving out of the country, and costs a lot less.

Quote:

---

If the pentagon got hacked would you leave the country? If you would and you live in america you should have left by atleast the 80s, Pentagon, White house, army, navy, airforce, pretty much all our government sites have been hacked..... Shouldnt you leave using that logic earlier?

---

Lets use that logic to your argument.

If the bank / webhost / ecommerce web site I use on a regular basis got hacked, would I discontinue my business there?

HELL YEAH.

Would I refer them to anyone?

HELL NO.

Could someone possibly sue them for negligence if their personal information was lost (3 times)?

For the sake of your buisness / site / whatever... I hope you get the idea.

You originally said about how if you were defaced it would bring more visitors to your site, well that might be fine for some britney spears fan club its not ok for any sort of site with credability. What if you a computer security site, do u really think people are going to carry on taking any advice from a site when it cant even protect itself. You say you have 60 members of your site, well thats 60 peoples personal information compromised. I hope your getting the idea, the attention you`ll recive from being defaced is not the kinda attention any decent web site would want.

we dont have much personal data, the only REQUIRED DATA( of my best reccolection is):
EMAIL
ACCOUNT NAME
PASSWD
(maybe name)

optional:
location
hobbies
etc.

um... what kinda problem is that? most ppl only have required information. A username and passowrd: regenerate pwds with a click of a button sending the new ones to the emails supplied, which we could use the old DB for to be sure they werent altered. The pwds are stored in a microsoft acccess database document ;ast time i looked at it (maybe on a diffferent for7um system) with enxryption on the pwds. even i couldnt get to them, and I have root access. If they is using the vulnerability i think they are using they only have aceess in PHP-NUKE ADMIN CPANEL, which isnt really a threat, the real threat is if they have root ftp access, which is how they would get pwds. I notices wetico and alucard of wetico defaced several php-nuke sites around that time, suggesting they used that vunerability which came out around that time and is yet to be patched (last time i checked). so... no what happened isnt a security risk, or a problem for our 60 users. ALL the information they supplied except password is supplied to users who want it, unless they specify and i dont believe anybody chose that option. It wasnt a risk I had 2 worry about, and our members aeren't in any danger.

Any level of unauthorised access is highly relevant. Someone who gains a php-nuke site admin, may be able to run php code on the server. Being able to do that, they may be able to gain shell access on the server. Once they have shell access on the server, they may be able to use an exploit to gain root access on the server, and once they have that they can get all the passwords off the machine they want.

Being encrypted in the DB doesn't stop attackers from obtaining them; they can simply modify the PHP scripts to save copies unencrypted somewhere.

Even ssh passwords are vulnerable to this attack - someone with root can modify sshd to record plaintext passwords.

So any level of penetration is serious cause for concern.

Slarty

To continue Slarty's line of thought and to debunk this phrase:-

Quote:

---

and our members aeren't in any danger

---

Since you have already been compromised it would have been trivial for the defacer to alter the web pages themselves in such a way that your visitors computers become compromised without altering the look of the site one bit. From the sound of it you wouldn't have noticed for a good long time. Then that "little piece of data" your not worried about becomes everything they have on their computer.

Naaaah, your peeps are not in any danger.... except from your lack of understanding of the problem..... Open a new account.... Call yourself ph34r_M3....... then at least everyone listening will be forewarned......

ths iste isnt even up right now, how should I be concerned about the security of it? Theres nothng there any more, all gone the host ran out of disk space and crashed. ALL that is on the ftp server last time i checked is that wimpy skimpy index page, no member info, nothing.

Sounds like a lost cause. If you didn't have backups (I'm not going to say you deserved it...but...) then I really don't know what the point is. If you plan to start from scratch, do things right this time...

Belive it or not the defacers are actually doing web site owners a favour because for every expliot they find and use there is someone out there making a patch ¨to block the hole¨ or there is a admin making his boxś security evan stronger.The question i would be asking is when the patchs out strip the crackers what will they do then,Guess it will be back to playiing the Xbox!!!

a white hat hacker who tells your your vulnerability would be a better way to find a hole

erm, defacers aren't doing anyone any favors. If you need someone to find holes in your software you hire Software Test Engineers, contract them out, or learn the skills yourself. Good STE's can test your website, web application, server configuration, etc in a sane fashion that does no damage and doesn't ruin the reputation of your company.

Quote:

---

Originally posted here by unit321
a white hat hacker who tells your your vulnerability would be a better way to find a hole

---

You've been influenced by too much D$D, my friend. No one is a white hat hacker. Those would be security admins or people who work for security firms. There is no such thing as grey hats either, that's a bulls**t metaphor for someone who decides, at the moment, whom they serve. If you draw too many lines you end up with a scribble that no one can decipher.

Of course that is my opinion. And you can argue all you want, it still doesn't make what hackers do, ethical.

Invading anyone's system is akin to invading anyone's body. If no one invted you,
rape is still rape. ;)