Slashdot Mirror
Would You Hire a Former Black Hat?
Mark Zenson asks: "Understanding the mindset of a hacker and the likes of one may be useful to counter security attacks, but apparently companies still object to hiring former, or even reformed, black hats."
The article asks this question of several executives in the industry and for various reasons, many of them were skeptical to the idea of hiring such people. Would you give black hats a second chance if you were in their position?
But on a more serious note, I would hire anybody as long as they have the right personality. That's right, I've seen it happen too. People who don't know anything about computers are working in corporate America as programmers. They are one trick ponies and it would take me a few minutes to show others how to do that one trick. The questions I need answered are:
- Can they work with people?
- Can they dress well?
- Do they shower?
- Are they capable of staying after normal work hours every now and then to see to something getting finished?
- Are they sensitive to other people and their surroundings?
If you answered "yes" to all these questions, you too are a potential "team member." In any business. Degrees help but are not required.Judging by the stereotypical picture of a black hat that the media has given the public, I would guess they wouldn't pass the first bullet above. Judging by the few that I know, they are risks but at some point straightened up and are valuable employees to their companies. You just need to assess whether or not they've figured out that a steady source of income is way more rewarding than having "VIODENTIA RULEZ #1" spray painted on the RIAA's website once a year. And that "selling out" isn't really "selling out" but devoting some of your time to a large project in order to better your circumstances the rest of the time. If they're past that point, then you've got a potential for a great employee.
What's unfortunate for black hats is that there is a wealth of solid programmers from America, India and Russia (if they can make it here) who are more than willing to do anything. On top of that, they have no criminal background. So even if a Blackhat is more qualified, they're probably just dismissed since a thousand other people are eager for the work and meet the basic qualifications. Unfortunate, but something to think about if you want to delve into the dark side of computers and networks.
My work here is dung.
I'm an ex-blackhat who's been working the security space for over 10 years now. My employers only know about my work experience; nothing prior to that. I'm very good at my job, I'm passionate about security, that's all that matters. As long as you're a blackhat who doesn't have a criminal record, you'll likely get a lot more value out of them than a cert crazy white hat who got into security cuz it's "cool".
If I worked at Hewlett-Packard.
we will end no whine before its time
Takes one to know one, I suppose. Looking at what Frank Abagnale did to improve security against bank fraud, I'm sure that a 'black hat' turned good could be of some use to a company.
If the company is going to be ripped off, it will probably start in the boardroom as upper management are granted perks that they shouldn't have. One company I worked for is on the road to bankruptcy but the company is still paying for the CEO's $200K/year New York City apartment. This is the same management that banned free soda when they figured out that employees were taking a can or two home. Go figure.
Not only that, but also what they were doing during their "black hat" phase.
Running scripts you've downloaded to scan for default passwords on websites so you can post that you've "pwn3d" their site
On the other hand, knowing enough about TCP/IP to crack servers with an injection routine that you've written
Script kiddies are a dime a dozen. And their "knowledge" is just about useless in the corporate world. What else do you have that's better than I can find elsewhere without the issue of your past behaviour?
The same with social engineering attacks (unless you're hired by HP to investigate leaks).
Real hackers, on the other hand, are extremely valuable not only for the technical skills they've built up, but also because they're driven by problem solving and they are more than happy to get down to the metal.
That's a valid analogy for script kiddies. If a blackhat has serious skills (like finding and exploiting holes), these same skills can be used to find and block holes. The surgeon analogy falls apart here. How about if you were infected with an engineered biological agent. Someone who had experience making them would have some useful skills to offer you. The bank fraud example cited earlier is another good analogy.
Which isn't to say that hiring former blackhats is always a good choice. It's a matter of judgement -- has the person really reformed?
"No one likes working in a hamster wheel, and your shop smells of cedar shavings from here." - TaleSpinner
But even harder to rebuild once you lost your trust in other people.
Trust goes both ways, it's a mutual phenomena, not sigularly subjective.
Trust is gained or lost through the fostering of a secure relationship or
by the abuse of the relationship, it does not exist a priori
or in isolation.
Understand this psychology and you are closer to understanding the "black hat".
I am always shocked at the shallow treatment the words "hacker" and "blackhat"
get on Slashdot, supposedly a bastion of that very "outsider" culture. Maybe you're
all fakes who just give it lip service to fit in somewhere.
As it stands, in the current commercial employment environment, the employee
still takes a far greater risk and is more vulnerable to abuse than the employer.
The employer wants it all on a plate with a spoon, to own your life and soul.
You don't need to be a "blackhat" to find yourself in a situation where industrial
sabotage is the only leverage you have left. I'm sure the words "disgruntled employee"
have some resonance there.
The question is therefore rhetorical, since no blackhat would be applying for a
commercial job if they were not already outside the abuse/mistrust mindset.
Personally, I'd hire a confessed blackhat on their skillset alone, but then make a big point
of overseeing their psychological/spiritual wellbeing, their happiness and fullfilment, in other words
treating them with respect Treating people with respect is the very thing most large organisations are incapable of doing and therefore why they should not hire blackhats. It's a clash of ideologies
and an accident waiting to happen.
Yes, that's exactly what you want. A *bored* (ex)black hat hacker.
Maybe not
I am a bit confused about the iimplication. The black hat's.. well, they weren't called that in the beginning. I don't remember anyone but old people talking about your moral compass in regards to exploiting security holes. All information is knowable. It's a belief that borders on faith. In my circles, it was just assumed that you would do no harm to the whole. When a surgeon takes out your bulging appendix, he has to do some damage to make sure you survive in the end. That's a proper analogy to the successful "black hat" folks. Even if it meant OOB'ing Microsoft's site for 3 days(winnuke was brought up by a previous poster). A much worse scenario would ensue when a hospital was taken down because they(OS/ipsec company,etc.) ignore their own weakness.
I have to tell you that the people I knew that did those things and worse are running your fortune 500 companies right now. The smartest don't get caught. Mitnick had an ego. These people don't. They are innately good at what they do and there is a higher than likely possibility that a "black hat" has saved your company from disaster more times than anyone else. That's my observation.
There are those that destroy to destroy. They don't survive. It's natural law. Smart people know this. Smart people also know that you don't own information or thought- and everything can be altered. I don't think the connotation of "black hat" describes the best of us accurately. I think they are something different and you will see it when their intuition saves your company time and time again. Where the metal meets the meat, you would rather have a person who's been on the other side rather than some cert collector that's just guessing. Media likes to make their misconception reality because it lends them credence. Black Hat does not mean evil. Hacker does not mean cracker. They are not one and the same.
* Are they capable of staying after normal work hours every now and then to see to something getting finished? Oh, that kind of job. Sorry, despite what the above might lead one to imply, I do in fact have a life. Or at least, enough of a one not to waste it patching up someone elses mistakes.
Heh. Sucks to be you. You should try looking for a job you enjoy. When you find a job where you genuinely **want** to be there - the work is challenging and engaging and keeps you interested for 8+ hours a day - it is truly a joyful experiance. Hope you find it someday. Until then work is just a job, not a career.