Not all hacking is bad. In fact, ethical hacking can reveal vulnerabilities before they’re exploited.

If you don’t believe a vulnerability exists, sometimes you need proof. Ethical hacking is a way to prove your system has a vulnerability that can be exploited. Once you have the proof, you may be more motivated to obtain funding for your security project and/or it may be easier for you to convince management to do so. Let’s take a look at what ethical hacking is.

Ethical hacking happens when an organization allows a known person or organization to attempt to break into or attack their system. This type of testing usually takes the form of a penetration test, or “pen test.” More on pen testing in a minute.

Hacking comes in three flavors: black hat, white hat, and gray hat—and these are the “actors” or people who do the hacking.

• Black hat hackers are the individuals (or countries) that capture the headlines. These hackers attempt to gain access to networks and computers without permission and usually with the intent to do harm (such as to cause outages or Distributed Denial of Service (DDoS) attacks), or to steal data and sell it for financial gain (such as financial or healthcare information), or to steal information for their own use (such as intellectual property or military intelligence). The term “black hat” came from the old Western movies in which the villains wore black cowboy hats, according to Westley McDuffie, security evangelist for IBM and a member of the IBM X-Force team.
• White hat hackers also attempt to gain access to networks and computers, but they do it for the purpose of finding vulnerabilities prior to those vulnerabilities being exploited by a black hat hacker. And once again, the Western movie analogy holds because it was the good guys in the movies who wore white hats!
• Gray hat hackers straddle the line. Sometimes they act as a white hat hacker, but they are not always pure at heart. While they don’t have the malicious intent of a black hat hacker, they may break laws or act unethically.

Ethical hacking is performed by white hat hackers. Organizations perform ethical hacking, or penetration testing, to discover weaknesses or vulnerabilities in their security configuration. The most well-known penetration tests occur at the network. Vulnerability scanners identify open ports, services with known weaknesses, etc. and run against all servers in the network—including IBM i. More recently, penetration testing has been performed against the databases residing on the servers, again including IBM i. One of the reasons for this new focus is that, while understanding weaknesses associated with the network is important, it’s only one aspect of security configuration that needs to be tested. Testing to determine whether someone can gain access to key database files is a very different type of testing than the vulnerability scans performed against the network.

Most pen testing against a database uses either the whitebox or graybox testing method but rarely employs blackbox testing. Note: Although the terms sound similar, these types of testing methods are not indicative of or equivalent to the white, gray, and black types of hacker “hats.”

• In whitebox testing, the tester (typically a white hat hacker) has access to architecture and implementation documents. In other words, they have knowledge of or are given documentation to show how the server and database are configured. Using this information, they attempt to gain access to data using as many access methods as possible—FTP, ODBC, 5250 signon, etc. Testing is often performed as a regular user (rather than a super user) to ensure the tester finds the configuration vulnerabilities that can be exploited by a typical user.

• Graybox testing uses both whitebox and blackbox techniques (blackbox explained below). The tester has access to configuration documentation but also uses some random-testing techniques or attempts to exploit a well-known vulnerability.

• With blackbox testing (remember: don’t confuse blackbox testing with black hat hacker), the tester has no formal documentation of the systems’ or databases’ configuration, and attempts access by exploiting well-known vulnerabilities or newly documented zero-day defects by performing random access attempts. (A zero-day defect is defined as a new vulnerability not previously known or documented and for which there may be no fix or the fix has very recently been released.) While blackbox tests uncover weakness to these well-known vulnerabilities, they are rarely effective in uncovering the vulnerabilities that are unique to the organization’s specific database configuration and often require a great deal of trial and error to show whether the organization has vulnerabilities.

In no case is it ever the intent of whitebox, graybox, or blackbox penetration testing to be evil, unethical, or destructive. Remember, penetration testing is performed by the good guys (or gals)! The point of penetration testing is to help an organization discover vulnerabilities so they can be remediated before they are exploited by someone with malicious intent, a black hat hacker. For this reason, numerous laws and regulations are now requiring penetration tests—not only at the network level, but also against the database. The Payment Card Industry’s Data Security Standard (PCI DSS), the New York State Cybersecurity Law, and the 2018 Singapore Cybersecurity Act (to name a few) all require database penetration testing.

The Professional Security Services team at HelpSystems has been performing penetration testing for IBM i for several years. It’s an effective means of showing our clients how the vulnerabilities documented in our Risk Assessment can actually be exploited. And it’s been rare that we haven’t been able to gain access to IBM i and to data in ways that were not expected. These clients now have the opportunity to resolve their issues rather than having those vulnerabilities exploited.

If you’d like more information on IBM i penetration testing, click here.