Some systems only get patched when someone accidentally stumbles into a security flaw. This can be things like “typing in the wrong URL for a page and discovering the website has a really easy-to-crack method for accessing content normally behind a password gate”, or “if you refresh too many times really quickly, this app’s whole server crashes”. These are problems that a normal person who’s just slightly (un)lucky might run into while trying to use modern websites to do stuff, and generally, they’re pretty easy to fix.
But what about the things that aren’t easy to run into, and aren’t easy to fix? Something that someone could only ever stumble upon if they were deliberately testing the security of a system? Obviously, scammers finding their way into a system like that is bad – but it’s not like people are just putting flaws they know about in on purpose.
This leaves limited options for remediating. Waiting until something bad happens to fix problems is not ideal and can cripple hospitals, state-level agencies, military devices, banks, et cetera. It’s a giant problem. But it’s not one without a solution – white-hat hackers who test systems and reveal problems before someone with the same level of skill (but darker motives) gets in can save everyone a whole lot of time and pain.
This is the concept behind white-hat hackers! The name (allegedly) comes from old Western films, where the protagonist wears a white hat, and the antagonist wears a black one. White-hat hackers are often working directly with the owner of a site or system in order to test their limits, and push the security into stress tests they don’t normally encounter unless a hack is taking place.
This is different from groups that hack things in an effort to enact social change. While this is sometimes a good thing, it’s also oftentimes legally considered terrorism. This falls into a gray zone; the term “gray hat hacker” covers many groups that may or may not be hacking pro-socially, but are at least still hacking for reasons that aren’t purely monetary or out of spite. White-hat hacking often also isn’t strictly a moral position, because the NSA itself employed a number of them even ahead of the Snowden incident trying to ensure the Snowden incident couldn’t happen. Sometimes the fix is needed, sometimes it gets someone politically exiled or jailed. The legal system is often working on the assumption every attempted hack made without specific permission is a legitimate attempt to get in, whether it was gray-hat bounds-testing or black-hatters trying to deliver ransomware. However, it is still better than the alternative, and many governments and organizations realize this, even if the hack technically falls into the gray zone because of a lack of prior organization. Some instead function on a sort of bounty system – once a serious flaw is identified, the flaw is fixed, and the hacker is rewarded after, not paid before. One white-hat hacker identified a serious flaw with the Dutch government’s website, and got a shirt for it! https://medium.com/@Aaxash/i-hacked-the-dutch-they-sent-me-a-t-shirt-911d3367632f
