Ethical Hacking Might Not Pay the Bills and That’s a Problem

The cybersecurity expert Chris Rock is an unconventional killer. At this year's Defcon hacking conference—one of the largest conferences of its kind, attracting more than 6,000 hackers and security experts from around the globe—the Australian information-security researcher demonstrated how to manipulate online death-certification systems in order to declare a living person legally dead. Potential motivations for hackers, he explained, range from plain revenge to financial gain in the form of life-insurance payouts.

Rock began researching these hacks last year, after a Melbourne hospital mistakenly issued 200 death certificates instead of discharge notices for living patients. He also uncovered similar vulnerabilities in online birth-registration systems.

The ability to create both birth and death certificates, Rock told a packed session at Defcon, meant that hackers could fabricate new legal identities, which could in turn engender new types of money laundering and insurance-fraud schemes.

In the hacking world, Rock is known as a “white hat”: an ethical hacker who exposes vulnerabilities in computer systems to improve cybersecurity, rather than compromise it. In recent years, white-hat hacking has become increasingly lucrative, as companies have turned to professionals like Rock to protect them from the growing threat of cybercrime.

But to combat the sophistication of more malevolent hackers, the ethical-hacking industry still has a long way to go.

In a threat report published by the U.S. director of national intelligence earlier this year, cyberattacks were listed first among global threats, above both terrorism and weapons of mass destruction.

“We foresee an ongoing series of low-to-moderate level cyberattacks from a variety of sources over time, which will impose cumulative costs on U.S. economic competitiveness and national security,” the report reads. “During 2014, we saw an increase in the scale and scope of reporting on malevolent cyber activity that can be measured by the amount of corporate data stolen or deleted, personally identifiable information (PII) compromised, or remediation costs incurred by U.S. victims.”

According to the security firm Gemalto, an estimated 1 billion records worldwide were compromised in 2014.

David Burg, the head of global and U.S. cybersecurity at PricewaterhouseCoopers, says that public data breaches—like the high-profile hacks of Ashley Madison, the Office of Personnel Management, and Sony Pictures over the past year—comprise just a small portion of the hacking activities that take place.

Attacks that relate to payment cards, PII, or protected health information are publicized because of mandatory breach-disclosure laws, but “most of the cybercrime that occurs, which is of the economic-espionage variety, is never made public,” he says. “Attack activity is very big business. You’re talking trillions of dollars in wealth being transferred globally.”

These so-called black-and-white hats create an ethical quandary for the tech industry: Ensuring a company’s cybersecurity requires the same skills as destroying it. Rock believes that the issue of white-hatters who also conduct malevolent hacks is likely widespread.

“Many companies say they don’t employ black hats, but most probably do,” he says.

Kaplan, who is a former counterterrorism analyst at the National Security Agency, disagrees. “I think the vast majority of people who are doing this type of work are highly ethical and they want to be doing it legally,” he says. Notwithstanding, Synack puts all of its own candidate researchers through a thorough interview process and background check.

Burg believes that the benefits of using outside white-hatters outweigh the risks: “Organizations that are willing to take criticism and analysis from independent parties are more likely to be able to combat cyber-threat actors,” he says.

Burg also believes that the Cybersecurity Information Sharing Act, which passed the Senate in October this year, will bolster the growth of the white-hat hacking industry. The bill calls for the federal government to declassify certain pieces of intelligence on cybersecurity threats and make the information available to private-sector companies.

Rice shares Burg’s view. “We all have vulnerabilities, and we’re not going to overcome them unless we can eliminate entire categories of attacks in collaboration,” he says. “There’s a huge community of companies and hackers out there at the ready.”

(Image via welcomia/Shutterstock.com)