Psychological Profiling of Hacking Potential

Abstract

This paper investigates the psychological traits of individuals' attraction to engaging in hacking behaviors (both ethical and illegal/unethical) upon entering the workforce. We examine the role of the Dark Triad, Opposition to Authority and Thrill-Seeking traits as regards the propensity of an individual to be interested in White Hat, Black Hat, and Grey Hat hacking. A new set of scales were developed to assist in the delineation of the three hat categories. We also developed a scale to measure each subject's perception of the probability of being apprehended for violating privacy laws. Engaging in criminal activity involves a choice where there are consequences and opportunities, and individuals perceive them differently, but they can be deterred if there is a likelihood of punishment, and the punishment is severe. The results suggest that individuals that are White Hat, Grey Hat and Black Hat hackers score high on the Machiavellian and Psychopathy scales. We also found evidence that Grey Hatters oppose authority, Black Hatters score high on the thrill-seeking dimension and White Hatters, the good guys, tend to be Narcissists. Thrill-seeking was moderately important for White Hat hacking and Black hat hacking. Opposition to Authority was important for Grey Hat hacking. Narcissism was not statistically significant in any of the models. The probability of being apprehended had a negative effect on Grey Hat and Black Hat hacking.

Heroes and Hooligans: The Heterogeneity of Video Game Modders

“…This mirrors the distinctions found between hackers in later stages of the proposed pathway to cybercrime. The literature demonstrates the difference between black-, white-and grey-hat hackers defined by varying motivations to attain different goals, but these classes of hacker also exhibit differing psychological profiles and factors attracting them to their respective hacking activities (Gaia et al, 2020). Recent literature suggests that more modern hackers may be classified more accurately according to a combination of four categories: (i) their expertise; (ii) their values and moral principles; (iii) the modus operandi and (iv) the tools and information they have at their disposal (Jaquet-Chiffelle & Loi, 2020).…”

Cybersecurity Methodology for Specialized Behavior Analysis

“…These studies are not technical in nature but directed towards technical participants [5,7]. Most models developed from these studies are built from answers to hypothetical questions in an attempt to characterize participants [1]. Nonetheless, hypothetical answers may not capture participant actions when interacting with real computer systems.…”

“…With these questionnaires, researchers can inquire about psychological, demographic, and similar characteristics. This facilitates capturing participant inherent features to build robust participants' profiles [1]. This is not intended to inquire about any hypothetical actions an attacker or defender might carry out.…”

“…Prevailing literature on cybersecurity behavioral analysis is limited to basic psychological profiles. Although there is an abundance of work related to behavioral analysis and personality profiling in psychology, these works mainly focus on profiling attackers using the results of surveys taken by non-technical participants [1]. Most of these studies originate from speculative actions and responses to questions.…”

“…Most of these studies originate from speculative actions and responses to questions. Participants are typically drawn from Amazon Mechanical Turk (AMT), in which the target population does not possess technical or cybersecurity training and qualifications [1][2][3]. The resulting datasets and models built from these studies fail to capture interactions of attackers and defenders with real systems and networks.…”