Why Do People Hack?

A question I see asked frequently after a site is hacked is "why?" Why was this site targeted, why are sites in general hacked, what are the hacker's motivations? In my experience, people who attack web sites and servers tend to fall into three distinct groups.

For Profit

The first group compromises systems for profit. Their goal may be to steal information and ransom it back to the site owner, or to sell the information to other parties. They may instead use the mail systems on a compromised server to send spam, or as part of a network of compromised computers to spread malware. This is the most dangerous group because their activities have a financial cost to the owners of the compromised system, and attacks can often go undetected until it is too late.

For Recognition

The second group of attackers are the ones who compromise sites to gain recognition with other hackers. Their attacks are more obvious than those of for-profit attackers, because they want their attacks to be noticed. This is the group that defaces web sites, and frequently shares pirated software and media, which can also be used to build a reputation.

For Knowledge

The final group of attackers is the group that explores systems for the purpose of gaining knowledge and expanding their skills. Some find avenues to persue this as a hobby, either compromising sites to test their security with the permission of the owner of the site, or analyzing how different applications work and how they might be abused. This is the group that finds and reports many of the vulnerabilities that lead to patches and help keep information secure.