How do I teach ethics in hacking?

Question

I teach a course on hacking every other year. It's a very difficult class, and it only attracts kids who are really enthusiastic about delving deep into the bowels of gdb, stackframes, format string vulnerabilities, buffer overflow attacks, and the like. ¹

At the beginning, I give a short lecture talking about ethics. The basic analogy that I draw is to a locksmith: a good locksmith can get into your car, and can get into your house. But an honest locksmith does not, because the lock that is in place communicates that he or she is not supposed to enter. Thus, a good lock is there to keep out honest people.²

From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.

The question, then, is is this a sufficient message to impart? If not, what more need be said? Bear in mind that it is not actually a course in ethics per se. I really can't spare more than about 15-20 minutes to impart the most important ideas, so I really want to make that short time count.

^{¹ The course largely emphasizes security holes from the 90's and the 00's. This isn't to prevent them from being able to work in modern system, but because you can study the attacks we focus on in relatively pure forms using virtual machines from that time, so we don't have to spend time working around more advanced security features. And learning about those attacks in any depth is already plenty hard!}

^{² The lock may not be effective against, say, a determined burglar. But it helps people who generally wish to stay honest avoid temptation and conquer moments of ethical weakness.}

Answer 1

I like your locksmith comparison, but I don't agree with the following assertion:

From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.

What is wrong is to use your hacker skills in order to perform unethical actions. Hacking per se is not unethical, as it is not ethical or unethical to use a key to open a door. For the sake of comparison, a locksmith can ethically use her skills to open the door to your apartment... if you called her after you lost your keys. But if she opens the same door when you're away in order to steal your stuff, the same action becomes unethical, because the goal is now different.

Aside the goal, one has to think about the yield of a hacking attempt, i.e. what one would do when he actually found a weak point in a system. Let me illustrate this with an example.

When I was a student, I was talking with my friend about IT security and we started talking about SQL Injection. Long story short, I tried to connect to the University website using his name and " OR 1 = "1 as a password, and it worked. I got access to his account, his personal information, and, if I remember well, his e-mails. This is the actual hacking action, which, by itself, is not ethical or unethical.

From there, I had an ethical choice:

• I could behave unethically and use this weak point to my advantage. For instance, I could push further, trying to connect to the system as a teacher, in order, for instance, to change my grades, or even sell a service to other students to “improve” their grades for a small fee. I could also spy on other students, stealing their personal information.

• Or I could contact IT security staff, telling that they have a slight issue. This would be ethical.

• Or I could do nothing, which would be an ethically-neutral action.¹

Same hacking action leads to three different yields with very different ethical aspects associated with them.

if a security feature is designed to keep you out

What about a system which has no security features? Would you feel ethical doing whatever you want simply because security was not implemented?

Take an example of online games where each player competes against others. One system implemented a cheat protection system which could be easily circumvented given enough programming skills. Another system has no cheat protection whatsoever. How would cheating be unethical only in the first system, but not the second one?

Taking the same example of video games, imagine a different game where the competition notion doesn't exist—there is no online mode, and the score of an individual player is irrelevant for others. The system has a cheat protection system. Why would hacking this system be unethical?

Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.

What about the locksmith who's opening the door of my apartment because I lost my keys?

---

^{¹ By the way, I did the ethical choice and contacted the staff. The staff never replied, not even to thank me, which taught me two things: ethical choices are rarely rewarded and if someone is acting ethically just to get a reward, he's not that ethical after all.}

Answer 2

First please be very cognizant of the term "hacking" Some of what you are describing is "cracking" not "hacking" The techniques may be the same but the intent is different. I think you are having problems with this because you yourself aren't comfortable with making this distinction.

You cannot prevent someone who is rotten to the core from taking your class and abusing what they learned so don't beat yourself up trying to head that off. If they are rotten they will make you think they are an angel with a halo.

Instead why don't you assign them as the very first assignment, to write a short 1-2 page paper on "what does the difference between cracking and hacking mean to me" Then take the best 5 responses that have the most clearly thought out positive morals, and distribute them to the class. That would likely get the point across better then you saying "cracking is bad, don't do it" when they see their peers don't think it's acceptable. And you might even get a few pearls in, like someone writing about how an identity thief stole money from them and how violated they felt. Behind every successful crack there is a victim and if you can get them to empathize with the victim rather than the cracker, you have done the best you can do.

Answer 3

I would go about detailing how much profit a white hacker can get, seeing as many security companies hire them as test attackers.

If any of the kids are tempted be unethical things, then explain that far greater profit can be achieved with greater ease if one chooses to use their learning for good. So that's that (for any student saying "But I can make a lot of money from hacking")

Now, appeal to their sentiment. Ask them how they'd feel if someone could simply type some stuff in some place, and then gain access to ALL their personal information. This includes but is most certainly not limited to:

• Address
• phone numbers
• photos, which includes any private photos they might have anywhere that is accessible from the internet.
• their parents' credit cards
• any gamers there: their steam account (that'll scare some of them)

After this shock, explain that each one of those has a security measure taken to protect that information. So if they want to hack that stuff, explain that there are people more or less like themselves on the other side. Hacking is never attacking a computer, it's attacking a person on the other side.

So this can be in addition to what you already plan to say to them. I think that most, if not all, would get the message of the ethics. They'll understand that those protective measures are there for a reason.

Answer 4

This seems insufficient to me, because of the following example at a minimum:

In small towns, people do not lock their doors, or at least they did in bygone days of yore, or so the story goes. If you steal from a house where the door is unlocked, is that suddenly somehow not unethical? What if there was no door on the house at all? If the stuff was just lying around out in the open at a campground?

What I'm getting at is, you said

if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it.

but I would posit that it is generally accepted to be unethical to intrude upon even systems with no security features.

In my own cybersecurity training, I have also been made to sign documents at the beginnings of classes saying that violations of ethical guidelines would be severely punished, by course failure, institutional sanctions and/or legal action. I don't remember the exact terms but they were along the lines of using any systems to hack any systems without explicit permission of the targeted systems' owners. Nor do I know how enforceable they really were, but they made good symbolic points, after the end of the ethics discussions and before the start of any practical security material.

Answer 5

If students are learning penetration tools and techniques, they should first be required to learn, at a minimum:

• What is illegal and the civil, criminal, and professional penalties (I have students sign a statement that they have been told that any attempt to achieve unauthorized access to computing resources can result in felony conviction with penalties exceeding $10,000 and 5 years in prison, even for a novice failure. The statement includes the fact that a "victim" can count as "damages" any costs to investigate the incident and improve their own readiness and defense-- at the crackers' expense. The statement acknowledges that attempts are highly likely to be caught and may result in lifelong exclusion from professional careers including plumbing, electrical, and teaching -- and certainly cyber work.)

• A handful of true stories about people who have been prosecuted, including at least one person from each category:

  • A person intending to break the law (e.g. Kevin Mitnick)
  • A person not intending to break the law (at times, Masters of Deception)
  • A person whose action slid from innocent to less than innocent (e.g. Daniel Spitler and Andrew Auerheimer)
  • A person who caused real damage without intending to do so (perhaps a person already described in the previous three cases)

• Ethics education should include teacher presentation, student discussion, and student writing.

I believe that it is typical for a first semester in cybersecurity at the post-secondary level to include 2+ weeks of law and ethics prior to covering tools or techniques. The consensus of professionals at the NICE cyber conference was that extensive ethics education should precede any instruction on penetration and that ethics education should be ongoing through the course, integrated into exercises and instruction.

Answer 6

Talking about ethics in hacking is very different than talking about ethics in any other field.

In hacking, when you talking about ethics, they will listen but when they learn how to keep anonymity, they become curious I know how to stay anon. No one can me or touch me. Then why should I still follow the ethics? Let's use our power.

the about e is not applicable for all students but many of them

I recall a thing happened in my college life,

One of my friend asked my another friend how to get Facebook password, at that time, there was a small vulnerability existed. He didn't teach him. He requested many times and promised that he want it to hack someone's account because of there was a small issue.

He taught the trick and later, the new person, hacked his account :P

So, just telling about ethics is not enough.

You should say, at what extend you are trying to protect your anonymity, you can be caught if you do something wrong. Even if you are in TOR network, they can still catch you.

Try to make some fear in the mind of students that doing such things in wrong purpose is a crime and once caught, they have to pay a huge amount fine plus may get jail.

Ethics + fear can make it.

But ethics alone, not in the case of hacking.