I teach a course on hacking every other year. It's a very difficult class, and it only attracts kids who are really enthusiastic about delving deep into the bowels of
gdb, stackframes, format string vulnerabilities, buffer overflow attacks, and the like. 1
At the beginning, I give a short lecture talking about ethics. The basic analogy that I draw is to a locksmith: a good locksmith can get into your car, and can get into your house. But an honest locksmith does not, because the lock that is in place communicates that he or she is not supposed to enter. Thus, a good lock is there to keep out honest people.2
From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.
The question, then, is is this a sufficient message to impart? If not, what more need be said? Bear in mind that it is not actually a course in ethics per se. I really can't spare more than about 15-20 minutes to impart the most important ideas, so I really want to make that short time count.
¹ The course largely emphasizes security holes from the 90's and the 00's. This isn't to prevent them from being able to work in modern system, but because you can study the attacks we focus on in relatively pure forms using virtual machines from that time, so we don't have to spend time working around more advanced security features. And learning about those attacks in any depth is already plenty hard!
² The lock may not be effective against, say, a determined burglar. But it helps people who generally wish to stay honest avoid temptation and conquer moments of ethical weakness.