It depends. If you're not applying to a security company, then I would leave them off or reference them in an innocent way - "security consultant" or some highly spun version of the truth.
If you are applying to a security company, it still depends. If you are outside of the statute of limitations or you've been tried for the illegal activity, just list it (with some spin to provide the right tone). People with practical experience breaking security are invaluable to security companies.
If you've done things that people don't know about, and are within the statute of limitations I suggest listing something inbetween. You've done something shady, but unspecific enough to be useless as evidence (by itself).