13

Developers, sysadmins, and users (the holy trinity SO, SF and SU) should know black hat techniques to defend themselves better against them. Posting such instructions on public forums, however, creates the risk of malicious use. Would you answer questions that require black hat knowledge?

Improve this question
2

9 Answers 9

Reset to default
10
+100

Developers tend not to have been taught anything about security (see blog post) I particularly like the quote:

"I start my security training class by asking developers "how many years of development experience do you have?" On average there are about 3-5 years experience. Then I ask "how many people have done a one day software security class?" About one hand will usually go up.

So in class of 30 people, we can expect 150 years of programming experience and about one day of software security training experience! Is it just me or should we really give up on this stuff when we haven't even really started trying seriously yet? "

So if there is a base of knowledge that I can point develoers at and say "Here read this, follow the instructions and test the hell out of your app" then I'd be a little (not a lot) happier that the application may be secure.

Likewise I'd love QA/testers to do the same. Hell I'd love management to take it seriously too.

Ultimately all this knowledge is out there somewhere, and the blackhats are already using it. If we (as whitehats) do not equip ourselves with even the basic knowledge we don`t stand a chance of securing our computers.

If you ban guns, only bad guys will use them...

Improve this answer
24

"Black hat" is based on intent, only. There's no difference between "black hat" and "white hat" knowledge. If it's publicly available info (e.g.-a public exploit, SQL injection), then I don't see a problem with it. Preferably, you leave something explaining how to protect against whatever it is you're explaining.

Improve this answer
4

This question is impossible to answer, because it depends so heavily on specifically what is being asked, and why.

As they say, "It depends."

Improve this answer
1
  • 1
    This answer is completely unhelpful.
    – bjb568
    Aug 21, 2015 at 22:22
3

It is a difficult question to answer definitively. Increasingly there may be legal issues, and I'm no lawyer.

Computers and those that program and even use them have historically been regarded with some suspicion. As As Janet Reno, at the time the US Attorney General, said in 1998: "They have computers, and they may have other weapons of mass destruction."

Many countries, including the UK, log all web sites users visit and the source and destination of all emails, retaining this information for several years.

Several countries, including the UK and Germany, have, to varying extents, made the programming, possession, use or distribution of "hacker1 tools" illegal. Within this there seems to be little understanding of the dual-use possibilities of most software.

It may be that providing assistance in obtaining and using such tools could be seen as a criminal or at least terrorist activity, especially if the advice given did, indeed, lead to criminal use of the tools or methods.

Whether we need to take these possibilities too seriously is hard to know. Do they affect the amount and usefulness of information given in response to genuine queries from sysadmins? Probably yes. At least as worrying is the deleterious effect on dissemination of information about known weaknesses in software and systems and the availability of good tools for testing and evaluating software and systems.

1 Sadly, attempts to retain 'hacker' as a positive term seem long-since lost in the media and political worlds: perhaps we should have copies of Henry S Warren's "Hacker's Delight" on our desks to remind us of a happier use of the term.

Improve this answer
1
  • 2
    In Germany it shouldn't be a problem, if you are a white hat. A prosecuter refused preliminary proceedings in one case (only in German): heise.de/ix/…
    – Ladybug Killer
    Aug 5, 2009 at 16:01
2

Like this?

Security Admins toolkit? What's in yours?

Improve this answer
1
  • many of these tools serves multiple purposes. but it was in a question like this that I learned about some tools that could serve only security experts.
    – Jader Dias
    Aug 13, 2009 at 12:30
1

Knowing the worst code is often the only way to truly understand how to know the best. I would have no objection to posting black hat techniques in response to a question as long as I was satisfied that nobody, including myself, would be vulnerable to any sort of trouble from it, that the person was not intending to use such information to no good, and that the information was already readily available and reported to those responsible for fixing said vulnerabilities.

If on one hand, I discovered a hole in a particularly important piece of software, I would make it my priority that I make sure I give due notice to those whose business it is to fix that hole, but on the other hand, I would surely not let it stop me from educating those in the community on best practises to prevent the exploit from affecting them.

Education is prevention, and even black hat techniques can be taught in an educational way.

Improve this answer
0

A determined malicious user would surely be just as capable of obtaining these techniques as a 'white hat' user...

Improve this answer
1
  • 2
    A determined malicious user, probably doesn't need a public forum to find the answer either. After all public forums leave a trace :)
    – dimitri.p
    Aug 5, 2009 at 17:47
0

"Black hat" or "White hat" is how the knowledge is used, not the actual knowledge.

The question is then are you writing for a Black hat or white hat audience?

  • If you are writing for a white hat audience include information about how to defend against it.
  • If you are writing for a black hat audience include information about ....
Improve this answer
-1

Short answer No Way. Just because it's possible to "---------" to make "--------" unusable by just typing "------" at the "----------" it should not be announced.

That's no different asking your buddy working airport security how to sneak xyz past airport security. I hope they don't tell you. I even hope they don't even know so they can't tell you.

If you know what I mean. If you don't know, sorry, I can't tell you :)

Improve this answer
2
  • I wish this information could be posted in public forums, so the airport authorities could take measures to prevent such things to happen again. The same way I think that public forums should contain hacking tutorials so every sysadmin could be aware of how they can protect their systems.
    – Jader Dias
    Aug 5, 2009 at 18:08
  • 1
    If people working airport security knows of a weakness, the correct response is for them to fix it, and if not specific to their airport, share the information with other airports' security. In computing, there's no small close group of security teams, because it affects everyone, so to share it means to make it public.
    – KTC
    Aug 7, 2009 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .