What is a Black-Hat hacker Hacking is a business?

Cyber Security
#1

Many Black Hat hackers started as novice “script kiddies” using purchased hacker tools to exploit security lapses. Some were trained to hack by bosses eager to make a fast buck. The upper echelon of Black Hats tends to be skilled hackers who work for sophisticated criminal organizations that sometimes provide collaboration tools for their workers and offer service agreements to customers, just like legitimate businesses. Black Hat malware kits sold on the Dark Web (the part of the internet deliberately hidden from search engines) sometimes even include warranties and customer service.

Not surprisingly, Black Hat hackers often develop specialties, such as phishing or managing remote access tools. Many get their “jobs” through forums and other connections on the Dark Web. Some develop and sell malicious software themselves, but others prefer to work through franchises or through leasing arrangements, just like in the legitimate business world.

Distributing malicious software isn’t difficult, partly because hacking today operates like big business. Organizations boast partners, resellers, vendors, and associates, and they buy and sell licenses for malware to other criminal organizations for use in new regions or markets.

Some Black Hat organizations even have call centers. The phone scam involving a hacker claiming to work for Microsoft who calls to help with a problem is one example of how call centers are used. In this scam, the hacker tries to convince potential victims to allow remote access to their computers or to download software. When the victim grants access or downloads the recommended software, it allows criminals to harvest passwords and banking information or surreptitiously take over the computer and use it to launch attacks on others. To add further insult, the victim is typically charged an exorbitant fee for this “help.”

Many hacks are swift and automated and don’t involve human contact. In these cases, attack bots roam the internet to find unprotected computers to infiltrate. In one experiment, a group of computers put online by the BBC was attacked in 71 minutes. In the same experiment, email accounts for fake employees attracted phishing attacks 21 hours after they were established. Of those attacks, 85 percent included malware attachments, and the remainder had links to compromised websites.