Ethical hacking

Image from Unsplash

After years, it was time for me to go back to training. I looked for one where the chance would be small that I’d learn very little; something that tends to happen quickly when you’ve been around the block in this field. A course on ethical hacking more than met that requirement.

For more than three decades, I’ve viewed the world from the right side of the line. My work revolves around security policies, risk analyses, and compliance, to name just a few things. I read and hear about what goes on on the wrong side of the line and try to make life as difficult as possible for the folks who hang out there. With this hacking course, I wanted to see the world from their side for once. Because, as Sun Tzu already knew in the fifth century BC: ‘Know your enemy and know yourself, and you will not have to fear the outcome of a hundred battles.’

But what is ethical hacking, exactly? Broadly speaking, there are two kinds of hackers: the good and the bad. The latter usually make the news, for instance through data breaches at the police or at telco Odido, both here in the Netherlands. That’s how hacking is known to the general public: unlawfully breaking into computer systems. The people who do this come in many shapes and sizes. At the bottom of the ladder you find the script kiddies: people who use ready‑made recipes to do things without really understanding how they work. And right at the top you have organized crime and state actors.

But there are also benevolent hackers. Like their malicious counterparts, they look for weaknesses in defenses. The big difference is that they don’t exploit those weaknesses for personal gain; they responsibly report them to the organization where they found the vulnerability. You can hire ethical hackers to test your systems, but some also operate on their own initiative. Quite often, if they play by certain rules, they even receive a reward. That can range from a T‑shirt to (a lot of) money.

Of course, after a five‑day course I am far from a seasoned hacker. Quite the contrary: last week my head was spinning from hacking tools with countless options, the many ports that can be attacked, and lots of other things that any self‑respecting hacker is expected to know by heart. Back in the MS‑DOS era, you also had to do everything from the command line (the C:\ prompt), but by today’s standards that feels rather archaic. And yet that’s still how things work in that world, only now with Linux instead of MS‑DOS.

The most important thing I learned is that hacking involves quite a lot, but that once you’ve mastered the tricks, it can be remarkably easy – at least if your opponent doesn’t defend themselves well. In the simple scenario we practiced, you find the IP address of your target, check which ports are open, investigate whether known vulnerabilities exist for the services running there, and boom, you’re in. Obviously, it’s (hopefully!) not always that easy, but the principle is likely the same: the hacker looks for weak spots in the defense. And you’d much rather have those vulnerabilities discovered by an ethical hacker than by a criminal. That only helps, of course, if you then actually act on the findings. Fortunately, everyone understands that. Right?

I’ve always had admiration for colleagues who do this for a living. Now that I better understand what they do, that respect has received a serious upgrade. It’s important, rewarding puzzle work that requires a great deal of knowledge and skill. They make discoveries that sometimes cause quite a stir. And then you see them walking around beaming. A fine sight.

Finally, I’d like to share something entirely different that I learned and that anyone who uses AI chatbots such as Copilot, ChatGPT, and Claude can enjoy. It’s about ELI5. That stands for ‘explain like I’m five’ and ensures that answers are phrased in simple terms and don’t assume prior knowledge. Not baby talk, but often using nice analogies. Just try something like: ‘ELI5: Explain what an IP address is.’

 

And in the big bad world…

• You can even hack a coffee machine.
• The Russians might be in your router (tip: reboot it from time to time).
• It’s not only the Dutch police who have been hacked.
• A romance scammer ends up in prison after accidentally trying to lure a colleague.
• Even astronauts suffer from IT problems.
• This trick exposes North Korean fake job applicants.
• Security legend Mikko Hyppönen has taken a different path these days: he fights drones.
• This new AI model is considered too dangerous to be released publicly for now.
• Some presidents still have room to grow when it comes to security awareness.
• Iranian state hackers have their sights set on critical infrastructure in the United States.