Slashdot Mirror
Would You Hire a Former Black Hat?
Mark Zenson asks: "Understanding the mindset of a hacker and the likes of one may be useful to counter security attacks, but apparently companies still object to hiring former, or even reformed, black hats."
The article asks this question of several executives in the industry and for various reasons, many of them were skeptical to the idea of hiring such people. Would you give black hats a second chance if you were in their position?
Takes one to know one, I suppose. Looking at what Frank Abagnale did to improve security against bank fraud, I'm sure that a 'black hat' turned good could be of some use to a company.
If the company is going to be ripped off, it will probably start in the boardroom as upper management are granted perks that they shouldn't have. One company I worked for is on the road to bankruptcy but the company is still paying for the CEO's $200K/year New York City apartment. This is the same management that banned free soda when they figured out that employees were taking a can or two home. Go figure.
Are these big companies likening it to hiring a reformed bank robber as a teller, or a paedophile as a teacher?
Anyway, I thought the biggest part of being a 'black-hat' was to keep your online identity COMPLETLY SEPARTE from your real life ID... A big company should have no idea they've employed a 'former' black hat - at least if they were any good at it. If they got caught then he/she might not have the attention to detail you require for an employee in that field.
My question is, why would they know of their "Black Hat" exploits? I have to admit I've skipped applicants who admitted to "hacking" in a black hat context (Not "I sniffed my neighbors WiFi to get free internet", but I hacked into a potential employers network and explored). It shows an inability to set bounds and a lack of understanding of appropriate/inappropriate. I'd rather have lower skills that I can trust over high skills that might be working against me.
You are in a maze of twisted little posts, all alike.
My observations as an old person by definition using your rules:
* Can they work with people?
* Can they dress well?
* Do they shower?
* Are they capable of staying after normal work hours every now and then to see to something getting finished?
* Are they sensitive to other people and their surroundings?
Black Hat Hacker.
I am clean, charming, well dressed, always working, and my sensors are constantly monitoring people and places. I'm also perfectly cold and capable of taking every coin you own and are capable of borrowing. I will do this using my clean, charming, well dressed, and sensitive persona.
White Hat Hacker.
I showered today because I wasn't up all night playing WOW. Jeans, T-shirt, piercings, tatoos, uncombed long hair and beard are my personality, get over it. People are either cool or annoying. I try not to be around too many of them at one time but there is nothing wrong with that. Most of my friends are on IRC and WOW anyway. As long as I bang out enough code to meet my boss' requirements I'm golden.
Having to work for a living is the root of all evil.
Not only that, but also what they were doing during their "black hat" phase.
Running scripts you've downloaded to scan for default passwords on websites so you can post that you've "pwn3d" their site
On the other hand, knowing enough about TCP/IP to crack servers with an injection routine that you've written
Script kiddies are a dime a dozen. And their "knowledge" is just about useless in the corporate world. What else do you have that's better than I can find elsewhere without the issue of your past behaviour?
The same with social engineering attacks (unless you're hired by HP to investigate leaks).
Real hackers, on the other hand, are extremely valuable not only for the technical skills they've built up, but also because they're driven by problem solving and they are more than happy to get down to the metal.
Oh Gods. It depends on what you mean. If you mean my normal attaire is that uncomfortable garish dandy's outfit known as a three piece suit, I'll have to say no. The apparell oft proclaims the man, and I generally don't choose what clothes to wear based on what everyone else deems appropriate. If you need me to meet customers, I suppose, but for gods sakes why are you making me wear a shirt in my cubicle? Would anything else make you feel uncomfortable somehow?
This is reasonable. If you're going to ask me to do this every morning unconditionally, I'm gogint to ahve to say that if I choose the odd tuesday or so as a "wash the bits" morning and you take offense; you're standing to close inside my bubble.
Of course I am! You'll never see me do or say anything inappropriate. Oh, wait. Do you mean by sensitive that I must take time away from my job to engage in vapid conversation to make insecure coworkers feel better? Must my meetings and greeting be peppered with trite reassurances and shallow smiles? Must I waste precious minutes of my life decoding and responding precisely to oh so many unfathomable and illogical social nuances, walking a tightrope of peril with each word I utter lest someone take grevious and irremediable offense and a misplaced clause or syllable. I'd rather just, you know, work.
Oh, that kind of job. Sorry, despite what the above might lead one to imply, I do in fact have a life. Or at least, enough of a one not to waste it patching up someone elses mistakes.
May the Maths Be with you!
I am not sure a "history of fraud" defines a black hat (according to my defination anyway).
Having worked with some people from this kind of background I would say that having them around in any kind of hi-tech start-up is a geniune asset. High IQ comes with the terroritory and I have also found that uber-geeks (as most dedicated black-hats are, by default) have a deep pride and sense of ownerships in their projects. I think that 'black hat' behaviour is more about ego than they would like to admit, and egos can be good if they make the owner strive to make their project the best out there.
There definatly will be a few assholes that try to screw you over, but I am not sure that it is fair to say there are more of these people in the 'ex black-hat' community than in the general population.
That's a valid analogy for script kiddies. If a blackhat has serious skills (like finding and exploiting holes), these same skills can be used to find and block holes. The surgeon analogy falls apart here. How about if you were infected with an engineered biological agent. Someone who had experience making them would have some useful skills to offer you. The bank fraud example cited earlier is another good analogy.
Which isn't to say that hiring former blackhats is always a good choice. It's a matter of judgement -- has the person really reformed?
"No one likes working in a hamster wheel, and your shop smells of cedar shavings from here." - TaleSpinner
I'd hire a reformed bank robber to do a pen test on my bank, which is really what they're talking about.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
But even harder to rebuild once you lost your trust in other people.
Trust goes both ways, it's a mutual phenomena, not sigularly subjective.
Trust is gained or lost through the fostering of a secure relationship or
by the abuse of the relationship, it does not exist a priori
or in isolation.
Understand this psychology and you are closer to understanding the "black hat".
I am always shocked at the shallow treatment the words "hacker" and "blackhat"
get on Slashdot, supposedly a bastion of that very "outsider" culture. Maybe you're
all fakes who just give it lip service to fit in somewhere.
As it stands, in the current commercial employment environment, the employee
still takes a far greater risk and is more vulnerable to abuse than the employer.
The employer wants it all on a plate with a spoon, to own your life and soul.
You don't need to be a "blackhat" to find yourself in a situation where industrial
sabotage is the only leverage you have left. I'm sure the words "disgruntled employee"
have some resonance there.
The question is therefore rhetorical, since no blackhat would be applying for a
commercial job if they were not already outside the abuse/mistrust mindset.
Personally, I'd hire a confessed blackhat on their skillset alone, but then make a big point
of overseeing their psychological/spiritual wellbeing, their happiness and fullfilment, in other words
treating them with respect Treating people with respect is the very thing most large organisations are incapable of doing and therefore why they should not hire blackhats. It's a clash of ideologies
and an accident waiting to happen.
Yes, that's exactly what you want. A *bored* (ex)black hat hacker.
Maybe not
I am a bit confused about the iimplication. The black hat's.. well, they weren't called that in the beginning. I don't remember anyone but old people talking about your moral compass in regards to exploiting security holes. All information is knowable. It's a belief that borders on faith. In my circles, it was just assumed that you would do no harm to the whole. When a surgeon takes out your bulging appendix, he has to do some damage to make sure you survive in the end. That's a proper analogy to the successful "black hat" folks. Even if it meant OOB'ing Microsoft's site for 3 days(winnuke was brought up by a previous poster). A much worse scenario would ensue when a hospital was taken down because they(OS/ipsec company,etc.) ignore their own weakness.
I have to tell you that the people I knew that did those things and worse are running your fortune 500 companies right now. The smartest don't get caught. Mitnick had an ego. These people don't. They are innately good at what they do and there is a higher than likely possibility that a "black hat" has saved your company from disaster more times than anyone else. That's my observation.
There are those that destroy to destroy. They don't survive. It's natural law. Smart people know this. Smart people also know that you don't own information or thought- and everything can be altered. I don't think the connotation of "black hat" describes the best of us accurately. I think they are something different and you will see it when their intuition saves your company time and time again. Where the metal meets the meat, you would rather have a person who's been on the other side rather than some cert collector that's just guessing. Media likes to make their misconception reality because it lends them credence. Black Hat does not mean evil. Hacker does not mean cracker. They are not one and the same.
hell we all break the law daily most likely.. there is probably some mundane code buried in some law somewhere that forbids me from making a post on a disccussion board on the last friday of a month.. The law anymore has become such a complex mess.. I personally say if you cant reduce a law to a one page document.. it gets thrown out.. anything more than a page is just retarded... Do not kill.. Do not steal.. Don't mess with your neighbors wife or cattle.. there's 7 more but basically.. Dont fuck with other people..
There are many ways to dress well, a suit is not required.
Like it or not, but every day, every single day, you are selling yourself. Now yes, the main criteria in our field to yourself by is definitely your intelligence/knowledge. But you know who the PHB's remember? That really smart guy that looked good and could provide a convincing argument to a group of people at their level and got along with everyone.
I consider myself to dress pretty well, and I own 2 suits, which I wear only on interviews, weddings, funerals, and similar functions. I wear jeans alot, but not the 80's nuthuggers. Go to a mall, get yourself some decent jeans and some shirts (hint: the ones that are 80% off are there for a reason), button down... standard. Get a little creative to stand out a bit.
It may depend, I work in finance, and my bosses from the business side are really sharp, they know their shit, and they take people with them when they get promoted often. So impressing them by trying to get on their level is more important than at a more techie-only firm like MS.
And if none of the above reasons convince you, take a look at that cute asian girl (stereotype stereotype I know, but come on now there is some truth no?) in the cube on the other side of the floor. She's cute, which is cool, she can code and probably has a math or CS degree, which is hot, and when she starts talking about the advantages of the linux tcp/ip stack over windows, you just want to take your pants off. She is probably going to notice the guy that actually pays attention to his appearance than the legions of dudes wearing ratty years old t-shirts from computer companies.
Just my $.02
Simply working a 16 hour work day today doesn't prove anything about the quality of your code. Maybe if you'd gotten enough sleep last week, and weren't being so "personally motivated", you wouldn't have written that bug in the first place and would have saved yourself a whole workday this week.