White Hats pt. 2

Examples of White Hat activities

   A great example of a white hat hacker is something known as a penetration tester, or just "pen tester" for short. Typically contracted by a business, their job is to test the overall security of a network, usually by any means necessary. Interestingly, a white hat hacker will often use many of the same tools and methods that black hats will use, including DoS attacks, social engineering, or utilizing the same exploits known to black hats.

   Let's say you work for a government contracted corporation that is involved with military technology. You take your job and your work security very seriously, and rightfully so. Some of the things you actively work on require a security clearance. Recently, your manager has hired a pen tester (unbeknownst to you) to attempt to find exploits or loopholes that could be manipulated by unwanted parties, such as hacking groups or even state-sponsored hackers.

   The pen tester decides first to test the wit and attentiveness of you and your coworkers. Using the tools available to him, he is able to scour the internet and discover your work email, posted in a forum regarding stamp collecting. This may seem like a harmless thing at first, but for the pen tester, this is a golden chance to send you a "spear fishing" email. The pen tester quickly writes a bogus email regarding some rare stamps he has in his possession, and creates a malicious link designed to run a script upon mouse click.

   You open up your email, and out of sheer excitement and inquisitiveness, you click on the link. Within seconds, the pen tester has gained access to your computer and possibly the whole network. Without even finding flaws in the critical infrastructure of the network, he was able to get unauthorized access. This is the main function of a pen tester: to test not only the stability of the network, but also the general attentiveness of the company's employees, regarding overall computer security.