Are hackers for hire a real thing?

Question

I came across many people offering me hacking services and they offered to hack social network accounts like Facebook and Instagram. Are these guys for real? Are there any reasonable ways to break into such accounts?

Answer 1

Hackers for hire are real. Occasionally, they will even interview with established journalists if they feel they can maintain their anonymity.

That said, anyone approaching you over the internet is probably a scammer.

Note that in the US, conspiring to hack is illegal per 18 USC 1030 B:

(b) Whoever conspires to commit or attempts to commit an offense under subsection (a) shall be punished as provided in subsection (c) of this section.

Even if the offer is legitimate, paying someone to hack on your behalf is still a federal crime (and probably a local one, too).

You should walk away from such offers, given that they are likely fraudulent and definitely illegal.

Answer 2

First, if the hackers for hire came to you offering services, they are more likely to be in the business of scamming than in the business of hacking.

Second, there are definitely individuals out there who may have a business in exploiting an individuals' accounts, but as @schroeder pointed out that type of hacking would fall into the realm of social engineering.

Here is a Social Engineering Lesson that I found that might interest you.

At the end of the day, the best advice is to stay away from such solicits as they will just cause a financial loss or a seat in front of the judge.

Answer 3

Do they exist? Yes, it's often called red teaming, though there are both legal and illegal red teams. Legal red teams are pentesters who you pay to attack your company. You have a carefully written contract which tells them what they are and are not allowed to do. There are also illegal red teams which use the name as a euphemism. These come from companies that are large, full of unethical practices, and often have government affiliation, such as Raytheon or Leidos. They advertise it as offensive security or red teaming. They do not sell to random people who email them, only to governments or major companies interested in corporate espionage intelligence.

Now, are the ones that are advertising to you legit? No, most certainly not. While individuals that hack for hire do exist, they tend not to openly advertise this, and they do not hack social media so you can spy on your ex. Many times, they do not even consider themselves as such and do not regularly hack on behalf of others, but will not turn down an offer for money.

There are many red flags to look out for:

• Does the service advertise hacking for personal gain, e.g. spying on personal media?

• Does the service offer ridiculously low prices, lower than around 100 USD an hour?

• Is the service proactively being advertised to you?

• Is it a generic service that claims to be able to "hack" any electronics or sites?

Any of these should send you running. Of course, this effectively includes all hackers for hire you are likely to ever see. Now, what kinds of services that could be classified as hackers for hire would be legit, given a loose definition of hacker? Excluding government contractors, you may run into:

• Groups that hack video games by developing cheats and selling them.

• Groups that design and sell customized malware or sell botnet resources.^*

• Companies that sell exploit kits with 0days, sometimes for millions (e.g. Core Impact).

• Individuals or groups which perform legal penetration testing.

These are clearly not the stereotypical and rather mythical "hacker for hire" where you pay to get someone's Facebook password, but they can still be described as offensive security services.

_{* While these may be legit services in that it is not downright fraud, they usually sell pre-designed malware for a high price, making it a huge rip-off. The kind of malware sold is the kind you could design if you learned some C.}

Answer 4

Yes, they are absolutely real. Obviously white hat pen-testers are "hackers for hire", but I think you mean "are criminal hackers for hire real" and the answer is also yes. Below is a map of dark web landing pages. It is obviously NSFW, and has many disturbing sites (disclaimer). If you dig around you will find lots of services for hire that would fall into "hacking."

https://www.hyperiongray.com/dark-web-map/

That said there are grey areas here too. Charlie Miller, a famous Sec. Prof. has talked repeated about how the US does not buy bug bounties from hackers but other countries like Russia and China will. There are multiple famous hackers who hunt bugs and sell them maliciously, as in to companies or govts other those with the bugs. There are even some companies that ride a fine line on this. Vupen being one.

Big question, -how- did they approach you? I would be more concerned about that, or I would be careful what your online footprint looks like if you're getting attention from folks like that.