New 'ethical' hacking site registered in New Zealand

A screengrab of the Hacker's List website.

A new website promising ethical hacking-for-hire services is registered in Wellington.

Hacker's List matches people with hackers or "freelancers" bidding for a range of mostly low-level hacking jobs.

Current Hacker's List customers are willing to pay for work including the removal of insulting YouTube videos and blog posts, access to email and social media accounts, and in at least one case, changing school grades.

The site, making headlines internationally, is registered to PO Box 11671, Wellington.
Several overseas websites have reported the site is "based in New Zealand" but Hacker's List was established in the United States.

Martin Cocker, Netsafe executive director, said Hacker's List seemed to have a novel business model.

"This is the first one I've heard about that specifically markets itself as a marketplace for and of hacking."

He said the site worked on a similar principle to oDesk - an "online workplace" where companies connected with freelancers to get jobs done.

Hacker's List insisted it did not allow any illegal services and all freelancers needed administrator approval before submitting proposals.

Mr Cocker said it was too soon to tell if the service was totally legitimate but the system's payment method, using an escrow system like Trade Me's SafeTrader option, was reliable.
Mr Cocker said the site's principles were simple.

"You put up a job. People around the world bid for it. And then you pay them at the end."
He said members of the public would have to check the law before hiring a freelancer.

"I would suggest the actual website probably operates within the law. But job for job, you couldn't have any confidence that that was the case," he said. "I could put up a job to hack an old email account. What's to say it's my email account?"

However, Hacker's List said all freelancers had to maintain a minimum three-star rating, and those who over-charged or had "a record of disputes" would be removed from the site.

Some overseas media described Hacker's List as possibly the world's first ethical hacking site.

Mr Cocker said IT security professionals already provided services akin to "ethical hacking" when exposing security loopholes for clients and then securing those networks.

"There's no reason to go to a hacker for that service. It's a professional service."

But exchange rates and lower labour costs abroad meant it was possible Hacker's List freelancers could provide experts to do these jobs cheaply.

"You might get a cheap international operator who does the service for less.

But you don't have a contractual relationship with them within the New Zealand jurisdiction that would give you the confidence that you weren't taking a significant risk."

Hacker's List founders previously contacted The New York Times.

Over several weeks, a founder who identified himself only as 'Jack' said he and two friends had set up Hacker's List, which was based in Colorado.

The New York Times said the "matter-of-fact" nature of job postings on Hacker's List showed how commonplace low-profile hacking had become.

Comment was being sought from Hacker's List on questions including why it chose to register in New Zealand.

In October, Kiwi businessman Gareth Foster said he was horrified to find a website, khilafa.is - linked to the so-called Islamic State - was registered to his company.

The now-defunct site was registered to Private Box, a mail forwarding company in Auckland. Security analyst Dr Paul Buchanan said that case reminded him of earlier cases of criminals using shell companies registered in New Zealand.