Examining the Explanatory Factors of Malicious Hacking Behaviors

Examining the Explanatory Factors of Malicious Hacking Behaviors

Speakers: Carolina Roque

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=A_4p4Hwvlwk

Overview

In an era increasingly defined by digital interactions, understanding the motivations and profiles of individuals who engage in malicious hacking is paramount for effective cybersecurity. Carolina Roque, a criminologist from Portugal, delivered a compelling talk at Hacktivity, shedding light on the explanatory factors of malicious hacking behaviors. Her research, the first of its kind in Portugal, moves beyond merely defining hacking as a criminal act, delving into the psychological, social, and demographic predictors that can explain why individuals engage in unauthorized computer system access and manipulation.

Roque's presentation outlined a quantitative study that surveyed 680 individuals within Portugal's information and technology sector. The core objective was twofold: to gauge the prevalence of malicious hacking behaviors within this population and to construct a common profile of malicious hackers based on a range of independent variables. The findings are not only significant for Portugal, an under-researched area in this domain, but also resonate with international studies, particularly highlighting the profound influence of social learning on the propensity for malicious digital activities.

This research offers critical insights for both reactive and preventive cybersecurity strategies. By empirically testing theoretical criminological concepts against real-world data, Roque's work provides a foundation for developing targeted interventions, enhancing online security education, and ultimately, building more resilient digital defenses against evolving threats. It underscores the importance of a multidisciplinary approach, blending technical understanding with behavioral science, to address the complex challenge of malicious hacking.

Background

▶ Watch: Introduction: Malicious Hacking Behaviors and Predictors (0:00)

The transition into the 21st century brought with it an unprecedented spread of internet access and personal computing, fundamentally altering notions of privacy, property, and identity—concepts now largely played out in cyberspace. This shift necessitated a re-evaluation of legal frameworks, leading to the criminalization of behaviors that, in earlier contexts, might have been seen as mere curiosity or harmless fun. Hacking, once a niche activity, became a central point of legal debate, evolving into the widely accepted definition of unauthorized access and consequent use of another person's computer system. This criminal notion, however, often oversimplifies the diverse landscape of hacking.

Roque's talk began by delineating the common typology of hackers: black hat, white hat, and gray hat. Black hat hackers are unequivocally malicious, breaking into systems to exploit vulnerabilities with the intent to destroy data or systems, operating outside legal and ethical boundaries. In stark contrast, white hat hackers are ethical security professionals who work to protect systems, identify vulnerabilities, and counter malicious attacks. The gray hat hackers occupy an ambiguous middle ground; they might identify system weaknesses but often demand monetary reward for disclosure, threatening public exposure if their demands are not met. For the purpose of her study, Roque specifically focused on black hat behaviors, aligning with her criminological background and the absence of prior focused research on malicious hacking in Portugal.

The motivation behind this study was rooted in a critical gap in understanding. While the criminalization of hacking is well-established, there was a significant lack of empirical data in Portugal regarding the prevalence of these behaviors and, more importantly, the underlying factors that explain why individuals engage in them. Without this foundational understanding, developing effective preventive measures or even understanding the threat landscape remains challenging. The research sought to fill this void by exploring a combination of sociodemographic, personal, and social variables, aiming to establish a robust, evidence-based profile of the malicious hacker in the Portuguese context.

Key Findings

▶ Watch: Study Design: Methodology, Sample, and Variables (3:50)

Carolina Roque's study yielded several significant findings, painting a detailed picture of malicious hacking behaviors and their predictors within the Portuguese IT sector. The research established both the prevalence of these behaviors and a common profile for individuals who engage in them, while also identifying the most potent explanatory factors.

Firstly, the study revealed a notable prevalence of malicious hacking behaviors. 60% of the surveyed sample reported having committed at least one malicious hacking behavior during their lifetime, indicating that such activities are not as rare as might be assumed. However, the frequency significantly dropped when looking at recent activity, with only 23% reporting engagement in the last 12 months. This suggests that malicious hacking might be more common during earlier stages of an individual's life, potentially decreasing with age.

An interesting correlation emerged regarding the severity of malicious behaviors and their reported frequency. Simpler, less severe actions were far more common: 55% of the sample admitted to guessing or attempting to guess passwords. As the complexity and potential damage of the behaviors increased, the reported incidence decreased sharply. For instance, unauthorized access was reported by 40%, exploiting vulnerabilities by 14%, using tools to cause damage or destroy data by 11%, and creating malware to cause damage or destroy data by only 5%. This gradient highlights that while minor transgressions are widespread, highly sophisticated and destructive acts remain relatively rare.

The research successfully constructed a common profile of a malicious hacker based on the analyzed variables. This profile suggests that a typical malicious hacker is a young man with less than a bachelor's degree but possessing high self-identified computer knowledge. Critically, these individuals tend to exhibit lower levels of self-control (indicating higher impulsivity) and hold pro-criminal definitions (ideals and beliefs favorable to committing crimes). Furthermore, a strong social component was identified: malicious hackers are more likely to have deviant friendships and be reinforced or influenced by others to act anti-ethically when using computers or the internet.

Perhaps the most crucial finding stemmed from the logistic regression analysis, which identified the strongest predictors of malicious hacking. While being male and having low self-control significantly increased the likelihood of engagement (almost twice as much), the "association" variable – having friends who engage in malicious hacking – stood out as the most powerful predictor. Individuals with such friendships were seven times more likely to engage in malicious hacking themselves compared to those without. This underscores the profound role of social learning and peer influence in the adoption of these behaviors. Overall, the statistical model developed by Roque was able to explain approximately 53% of malicious hacking behaviors, a statistically robust finding that provides a solid foundation for future research and intervention strategies.

Technical Deep Dive

▶ Watch: Common Profile of a Malicious Hacker (9:00)

Carolina Roque's study employed a rigorous quantitative research methodology to explore the explanatory factors of malicious hacking behaviors. The core of her approach involved administering an online survey to a targeted population in Portugal.

The sample for the study comprised 680 individuals from the information and technology (IT) sector in Portugal. This included a diverse group of students, teachers, and professionals, ensuring a broad representation of individuals with varying levels of exposure and expertise in computing. The average age of the participants was 28 years old, and the sample was predominantly male, with 61.1% identifying as men. These demographic characteristics are crucial for contextualizing the findings, as age and gender often emerge as significant variables in criminological studies.

The study focused on a dependent variable: malicious hacking behaviors. Since no standardized scales existed for measuring this in the Portuguese context, Roque's team compiled a set of five specific behaviors, categorized by their severity and ease of execution. Participants were asked to self-report their engagement in these behaviors over two distinct periods: lifetime and the last 12 months. The five behaviors, ordered from least to most severe, were:

1. Guessing or attempting to guess passwords: Reported by 55% of the sample over their lifetime.
2. Unauthorized access to another person's computer system: Reported by 40% over their lifetime.
3. Exploiting vulnerabilities in computer systems: Reported by 14% over their lifetime.
4. Using tools to cause damage or destroy data: Reported by 11% over their lifetime.
5. Creating malware to cause damage or destroy data: Reported by 5% over their lifetime.

This graduated scale allowed for a nuanced understanding of behavioral patterns, demonstrating that less severe actions are far more common than highly destructive ones. These behaviors were then combined into an index or scale for statistical analysis, based on international scientific guidelines.

To explain these behaviors, Roque investigated three main groups of independent variables:

1. Sociodemographic aspects: This group included sex, age, education level, and self-identified informatical knowledge.
2. Personal features: This encompassed self-control, measured as impulsivity (higher average scores indicating lower self-control), and definitions, referring to an individual's ideals and beliefs favorable to committing crimes or going against the law.
3. Social variables: This group explored association, defined as the nature of one's friendships (specifically, having friends who engage in deviant behaviors), and reinforcement, which measured the extent to which individuals are reinforced or influenced by others' ideas to act anti-ethically online.

The statistical analysis employed a logistic regression model to determine the predictive power of these independent variables on malicious hacking behaviors. Logistic regression is particularly suitable for predicting a binary outcome (e.g., engaging in malicious hacking vs. not engaging). The model's overall explanatory power was quantified by its R-squared value, which indicated that the variables combined could explain approximately 53% of the variance in malicious hacking behaviors. This is considered a substantial explanatory capability in social science research.

Individual variables' significance and impact were assessed using P-values and Odds Ratios (OR). A P-value below 0.05 typically indicates statistical significance. The Odds Ratio quantifies how much the odds of the outcome (malicious hacking) increase or decrease for a one-unit change in the predictor variable.

• Sex: Being male (the condition "1" in the model) increased the likelihood of committing these acts by almost twice (OR = 1.98).
• Self-control: Lower levels of self-control (higher impulsivity scores) also doubled the likelihood of engaging in malicious hacking (OR ≈ 2).
• Age: The OR for age was 0.95, indicating that being younger (rather than older) increased the likelihood of malicious hacking, aligning with the observed trend of decreased activity in later life.
• Association (deviant friendships): This variable emerged as the most powerful predictor, with an OR of approximately 7. This means that individuals who reported having friends engaged in malicious hacking were seven times more likely to engage in such behaviors themselves, highlighting the profound impact of social circles.

Further analysis broke down the explanatory power of the different variable groups:

• Social variables (Association and Reinforcement) collectively explained around 47% of malicious hacking behaviors, making them the most significant group.
• Sociodemographic variables explained approximately 25%.
• Self-control alone explained about 12%, which was noted as being lower than findings from some international studies, suggesting contextual differences.

The comprehensive statistical approach allowed Roque to not only identify correlations but also to establish predictive relationships, offering a robust, evidence-based understanding of the drivers behind malicious hacking in Portugal.

Demo / Proof of Concept

▶ Watch: Key Predictive Factors for Hacking Behaviors (11:00)

As this research focused on a quantitative criminological study exploring the explanatory factors of human behavior, there was no technical demonstration or proof of concept in the traditional cybersecurity sense. The presentation centered on the methodology, data collection, and statistical analysis of survey responses, rather than showcasing code, tools, or exploit techniques.

Defensive Implications

▶ Watch: Practical Applications and Future Research (15:30)

The findings from Carolina Roque's groundbreaking study offer critical insights for cybersecurity defenders, enabling a shift from purely technical responses to more holistic and human-centric defensive strategies. Understanding who malicious hackers are and why they act provides a powerful foundation for both preventive and reactive measures.

Firstly, the common profile of a malicious hacker—a young man with high computer knowledge, impulsivity, pro-criminal beliefs, and deviant friendships—can be leveraged for early identification and intervention. This profile is not about profiling individuals for suspicion, but rather for understanding risk factors. Educational institutions, especially those with strong IT programs, could be instrumental in identifying students who exhibit a combination of these characteristics. Targeted mentorship programs or ethical hacking clubs could channel their high computer knowledge and potential impulsivity towards constructive, legal pursuits, effectively nurturing future white hat talent.

The overwhelming influence of social learning variables, particularly association (deviant friendships), suggests that defensive strategies must extend beyond technical controls to address social environments. Programs aimed at promoting online security in schools should not only teach technical safeguards but also incorporate modules on digital ethics, peer influence, and the legal consequences of malicious hacking. Fostering positive peer groups and offering alternatives to deviant online communities could significantly reduce the likelihood of individuals engaging in malicious activities. This involves engaging parents, teachers, and community leaders to create a supportive environment that reinforces ethical digital behavior.

Furthermore, the study's distinction between lifetime prevalence (60%) and recent activity (23%) suggests that many individuals experiment with malicious hacking in their youth but may desist later. This highlights the importance of early intervention programs that can steer young individuals away from a path of persistent malicious activity. By understanding that these behaviors might peak at a younger age, resources can be strategically allocated to educational and awareness campaigns targeting adolescents and young adults.

From a reactive standpoint, understanding the profile can inform threat intelligence efforts. While not directly providing technical indicators, knowing the behavioral predispositions can help security teams anticipate types of attacks or motivations behind them. For instance, if a significant portion of attacks originate from individuals driven by social reinforcement, messaging around ethical responsibility and community impact might be more effective in deterrence than solely punitive warnings.

Finally, Roque's mention of potentially employing individuals to fight back the malicious acts, turning them into white hat attackers, directly aligns with the study's implications. By understanding the underlying motivations and skill sets of potential black hats, companies and governments can develop better recruitment and training programs for cybersecurity professionals, effectively converting high-risk individuals into valuable assets for defense. This proactive approach not only bolsters security but also addresses the talent gap in the cybersecurity industry.

Key Takeaways

• Prevalence of Malicious Hacking: A significant portion of the Portuguese IT sector (60% lifetime, 23% in the last 12 months) has engaged in at least one malicious hacking behavior, highlighting the widespread nature of these activities.
• Severity Correlates with Frequency: Simpler, less severe behaviors like password guessing are far more common (55%) than complex, destructive acts like creating malware (5%), indicating a gradient of engagement.
• Common Hacker Profile: Malicious hackers are typically young men with high self-identified computer knowledge, who exhibit impulsivity, hold pro-criminal beliefs, and are influenced by deviant social circles.
• Social Learning is the Strongest Predictor: Having friends who engage in malicious hacking increases an individual's likelihood of participation by seven times, underscoring the critical role of peer influence and social reinforcement.
• Robust Explanatory Model: The study's logistic regression model successfully explains 53% of malicious hacking behaviors, providing a strong empirical foundation for understanding these complex actions.
• Foundation for Intervention: The research offers actionable insights for developing targeted preventive measures, such as early education in digital ethics, promoting positive peer groups, and potentially channeling high-risk individuals into white hat roles.

About the Speaker(s)

Carolina Roque is a criminologist from Portugal, holding a Master's degree in Criminology from the Faculty of Law. Her research focuses on understanding the human element behind cybercrime, specifically investigating the profiles and motivations of malicious hackers. Her work aims to bridge the gap between criminological theory and practical cybersecurity applications, providing data-driven insights to inform preventive and reactive strategies against digital threats. This presentation at Hacktivity represents a significant contribution to the nascent field of cybercriminology in Portugal.