deletescape.ch Open in urlscan Pro
104.198.14.52  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Skip to main content
 * Home
 * About
 * Posts
 * DNS
 * Press
 * Contact

Jul 19, 2021 by maia arson crimew


NSO GROUP IS WHITE HAT, REALLY

Chances are you hate-clicked your way onto my blog, look­ing for a com­ments
sec­tion where you can yell at me to let me know I’m wrong. But be­fore you do
that let’s first talk clas­si­fi­ca­tion, shall we.


WHAT IS YOUR CLAS­SI­FI­CA­TION BASED ON?

There are two co­ex­ist­ing ways in which most seem to un­der­stand and ex­plain
the ‘hacking hat con­cept’, they’re both pretty flawed. When you ask some­one to
ex­plain white/ black hats they will prob­a­bly tell you that white hats are
de­fen­sive, while black hats are of­fen­sive, this ex­pla­na­tion falls apart
fairly quickly once you ask them if so called “ethical” pen­testers and red
team­ers are black hats and peo­ple hard­en­ing the se­cu­rity of ran­somware
gangs are white hats. This is be­cause even the peo­ple ex­plain­ing it as such
ac­tu­ally clas­sify hack­ers into groups based on their (the ob­servers)
per­sonal value sys­tem, those who are or work for the “good peo­ple” (the
“good” gov­ern­ments, lo­cal cor­po­ra­tions, law en­force­ment, peo­ple on
their side of the po­lit­i­cal spec­trum) are white hats and those work­ing for
the “bad/evil peo­ple” (other gov­ern­ments, or­ga­nized crime, lo­cal
re­sis­tance groups, for­eign state ac­tors) are black hats. It’s easy to see
how this way of clas­si­fy­ing is highly sub­jec­tive and leads to col­li­sions.


THIS CLAS­SI­FI­CA­TION CAN­NOT BE AB­SOLUTE

One thing that should be clear by now is that any clas­si­fi­ca­tion of hack­ers
into black and white hats needs to be rel­a­tive to the sys­tem a hacker is a
part of. Which is how we very quickly come to how I clas­sify hack­ers into
hats:

> White hats are hack­ers who work within or in sup­port of a sys­tem, they
> gen­er­ally do so with­out con­se­quences and usu­ally legally, though not
> nec­ces­sar­ily. Black hats are hack­ers who work out­side or against the
> sys­tem, gen­er­ally with even­tual con­se­quences and of­ten il­le­gally,
> though not nec­ces­sar­ily.

White hats and black hats are not uni­ver­sal good and evil, I mean how could
they be when the con­cepts of good and evil are sub­jec­tive and not the same
ac­cross the world. Of course this clas­si­fi­ca­tion is still based on the
val­ues within a given sys­tem and has to be viewed with that con­text in mind.
It should now be clear to you why I con­sider NSO Group (and Corporate
Intelligence in gen­eral) white hat and how that is the only proper way to view
them in that clas­si­fi­ca­tion.


WHAT GOOD IS THAT CLAS­SI­FI­CA­TION THOUGH?

It’s ab­solutely use­less and al­ways has been, the clas­si­fi­ca­tion in white
and black hats serves no one other than the sys­tem and those in power, it’s
their way of clas­si­fy­ing hack­ers into good and evil from their point of
view. The more you un­der­stand about this clas­si­fi­ca­tion the less use it
brings. Letting hack­ers (and peo­ple in gen­eral) clas­sify them­selves into
cat­e­gories based on their val­ues and goals is way more use­ful for dis­course
about “good” and “evil” hack­ers.


YOU’RE STILL WRONG AND I STILL WANT TO YELL AT YOU!

Feel free to do so on Twitter or Mastodon.