Sanjana Srikanth | January 11th, 2025
Picture this: a mysterious, hooded figure typing away in the dark, their eyes reflecting the lines and lines of malicious code growing rapidly on their screen. In the popular imagination, the traditional hacker is almost always the villain up to no good. But what if we zoomed into this picture? What if I told you that this seemingly malicious hacker is our hidden hero working against the clock to ensure our online safety?
Contrary to their ominous title, white hat hackers are cybersecurity experts who use their skills to identify weaknesses and vulnerabilities in digital systems for companies and government agencies. While the connotation of hacking has been historically negative, it is the method by which white hat hackers effectively strengthen our defenses against sneaky data breaches or harmful external hacking. Think of it like a race, with white hat hackers sprinting to find and report vulnerabilities before outside threats can get to them so that they can be fixed.
Types of vulnerabilities
In technology, a vulnerability is a software or hardware flaw that allows hackers to enter a system unauthorized and assume control. They can be characterized into different types of cyberattacks depending on the part of the computer a vulnerability is sourced from. Software cyberattacks target software vulnerabilities. Software vulnerabilities can include incomplete or incorrect authentication, input validation errors, and issues with web services and APIs (pre-made code structures that enable coding for specific functionalities).
Hardware cyber attacks target hardware vulnerabilities, or flaws within a computer’s physical components. Hardware vulnerabilities are harder to identify because they cannot be detected by software debugging tools. Hackers can exploit hardware vulnerabilities through malicious programs like Trojan Horse malware. Trojan Horse malware disguises itself as a standard program and runs in the background, slowly degrading a user’s computer as they continue to use it normally. Such malware can cause many problems for a user’s hardware such as draining a computer’s resources, drastically reducing its working speed, and consuming its power supply at rapid rates. Preventing hardware degradation once a hardware vulnerability is exploited externally is extremely difficult because it involves altering a computer’s integrated circuits. Furthermore, a flaw in one computer circuit affects all surrounding connections, making hardware flaws especially dangerous to a computer’s overall security.
Another major category of cyberattacks involves those caused by vulnerabilities in computer networks. When devices transfer data to each other, they follow network protocols, or a set of rules that standardize how data is transmitted, formatted, and interpreted by electronic devices. Think of protocols like a shared language that allows data to be communicated and understood by two different people, or the devices sending and receiving data. Vulnerabilities in computer protocols leave data exposed and vulnerable to being intercepted, compromising the confidentiality and security of data transmitted. A user may be completely unaware that their data is not only being leaked but potentially never reaching its intended destination when a cyber attack targets their computer network or exploits their protocol vulnerabilities.
Vulnerability scanning
We’ve discussed vulnerabilities, but what do white hat hackers do to combat them? One of the many techniques white hat hackers employ to expose vulnerabilities is vulnerability scanning. Vulnerability scanning examines software from its outermost to innermost layer. A white hat hacker may first scan a software using external tools to identify misconfigurations, for example potentially faulty software updates which may leave a system vulnerable to attack through hidden bugs. They may then take a proactive approach, such as actively applying their own credentials to enter a system and use its interface.
Another approach involves examining data collected from other programmers and working with them by using the system from different access points. After this, a white hat hacker may evaluate the software against a vulnerability database containing thousands of known software security flaws sourced in real time from individuals. The most important part of vulnerability scanning is reporting found vulnerabilities immediately. Upon discovery, vulnerabilities instantly become liabilities, giving companies a small window to resolve issues before harm is done.
Penetration testing
So how exactly do white hat hackers hack? They do so through a popular technique called penetration testing, which involves simulating real cyberattacks on applications to test their durability and discover flaws. To conduct penetration testing, white hat hackers (also commonly referred to as “ethical hackers”) are hired to hack into company systems under different conditions. For example, ethical hackers are given varied degrees of knowledge or no prior debriefing of the system prior to hacking. Before carrying out the attack, an ethical hacker must first gather enough data to understand the system and the line of attack they wish to follow. In the aftermath of the attack, vulnerabilities are to be reported to the company about the system and hackers must cover all of their tracks, ensuring to leave the system exactly as they found it with no trace of their online activity.
Vanderbilt’s cybersecurity involvement
To those interested in learning more about cybersecurity and the world of ethical hacking, these cybersecurity techniques are only a snippet of how coders can approach maintaining online security. Whether you want to go down the path of becoming an ethical hacker or learn more about cybersecurity in general, Vanderbilt’s resources provide the perfect opportunity for students to become involved in this space. Vanderbilt is deeply involved in cybersecurity, evident in the university’s newly established Institute of National Security launched in September 2024 and led by Paul M. Nakasone, former director of the National Security Agency. The institute focuses on tackling national security challenges, including cybersecurity threats, and aims to inspire future leaders by leveraging Vanderbilt’s unique expertise and education. Students at Vanderbilt can take advantage of specialized cybersecurity courses, where they can learn about techniques like vulnerability scanning and reverse engineering, and gain experience using cybersecurity software applications. These resources provide the opportunity to gain hands-on experience and develop the skills needed to address the growing demand for cybersecurity experts. While it is critical for us to all beware of malware, you don’t have to fear it when you can learn to fight it.
References
Aslan, Ö., Aktuğ, S. S., Ozkan-Okay, M., Yilmaz, A. A., & Akin, E. (2023). A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions. Electronics, 12(6), 1–42. https://doi.org/10.3390/electronics12061333
Cloudflare. (2022). What Is Penetration Testing? What Is Pen Testing? | Cloudflare. Cloudflare. https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/
IBM. (2024, August 16). What is cyber hacking? | IBM. Www.ibm.com. https://www.ibm.com/topics/cyber-hacking
Kosinski, M., & Forrest, A. (2023, December 15). What is vulnerability scanning? | IBM. Www.ibm.com. https://www.ibm.com/topics/vulnerability-scanning
Leszczyna, R. (2021). Review of cybersecurity assessment methods: Applicability perspective. Computers & Security, 108, 102376.
Palmer, C. C., and Thomas J. Watson Research Center C. C. PalmerIBM Research Division. “Ethical Hacking.” IBM Systems Journal, 1 Mar. 2001, dl.acm.org/doi/10.1147/sj.403.0769.
What is the Vulnerability Management Lifecycle? | IBM. (2024, August 21). Ibm.com. https://www.ibm.com/think/topics/vulnerability-management-lifecycle
White Hat Hackers: Techniques, Tools, and How to Become One. (n.d.). Www.hackerone.com. https://www.hackerone.com/knowledge-center/white-hat-hacker
