Killing Others' Malicious Processes

Roland Piquepaille writes "This opinion is not mine, but the one of Tim Mullen, from SecurityFocus Online. In this story, he expresses some strong ideas regarding systems infected by worms. "I believe you should have the right to neutralize a worm process running on someone else's infected system, if it's relentlessly attacking your network. I've even written code to demonstrate the process. Though the initial news coverage of the concept was grossly inaccurate in conveying my ideas, it has stirred up a constructive dialog. I knew my idea was controversial, but I was wrong about something -- I figured everyone in the security biz would "get it" and that the hard part would be convincing everyone else that if they can't or won't secure their machines, we as the defenders would have the right to terminate the process attacking us. It has turned out to be the opposite." The author then looks at the criticisms about this strikeback idea raised by some security experts -- to dismiss them of course. Check this column for a summary or read the original story for more details."

Comments

Killing Others' Malicious Processes

[Gyan]

RIAA : Great. Now, who's running Kazaa ?

Re:Killing Others' Malicious Processes

[Anonymous Coward]

We the users run kazaa (i run shareaza and dc++ actually), without the users there is NO kazaa. They should not forget that.

Re:Killing Others' Malicious Processes

[rip42]

Does this guy is part of US gov to give himself the right of killing others' processes ?

Re:Killing Others' Malicious Processes

[DrDebug]

You hit the nail right on the head.

Sure, we want to defend ourselves against malicious attacks. But does that mean going out and destroying the the attacker? Only in a war!

So if the RIAA feels it has to 'defend' itself against something like KAZAA (which is NOT attacking RIAA directly, just it's mass-manufactured, over-hyped, over-priced monopolist property), then RIAA can come into our machines and wipe out KAZAA.

And I don't like where that is going....

Folks, the current state of the Internet and the Web reminds me of the Wild West. Good people and outlaws all over the place. Things got better when the sheriff came to town. Maybe what we need is a sheriff; one that will honor the privacy and uphold the security of each honorable individual; but with the right to gun down the outlaws (or send them to the judge).

So the I think the power to neutralize processes on other peoples machines should be entrusted to those individuals that are in a position of authority; using people that we can actually trust. The RIAA and other corporations are NOT the answer. Is the government? That remains to be seen.

It may come to that. Let's just hope we don't end up with a 'Big Brother' Internet.

Re:Killing Others' Malicious Processes

[j3ss]

what we need is a sheriff; one that will honor the privacy and uphold the security of each honorable individual; but with the right to gun down the outlaws

I would never support such a thing. An internet "sheriff" would end up under the thumb of people like the RIAA, FBI and MPAA. The internet sheriff would probably more resemble the 1990's era LAPD than the good guy on the white horse.

We don't need MORE AUTHORITY, what we need is LESS AUTHORITY.

Re:Killing Others' Malicious Processes

[Anonymous Coward]

Oh, please. This is analogous to tightening a hose on a neighbor's car to prevent leaking coolant from poisoning your pets. The neighbor doesn't want it leaking anymore than you do, and would probably consider it a favor.

The author isn't proposing doing damage to the offending machine, he's just going to shut down the worm or virus. The people who own most of these machines are not malicious, they're just unaware of the problem or too incompetent to deal with it.

Re:Killing Others' Malicious Processes

[Suidae]

I don't want my neighbor messing with my car any more than I want him messing with my processes.

In either case, he'd darn well better identify himself and assume legal liability for any damage he does.

Re:Killing Others' Malicious Processes

[karmawarrior]

When I wrote a proposal for keeping system administrators accountable - ensuring tht if someone puts a machine on the Internet, they take the necessary steps to secure it, it generated howls of outrage from people who clearly felt that there is no onus on admins to keep their machines secured and that blaming them in any way for the damage they cause is wrong.

Jokes about the RIAA aside, which has indeed asked for laws to allow it to do exactly what you deem jokeworthy, the fact is that most people consider their PCs their own property but not their own responsibility. The view appears to be that it's ok for someone to leave a machine on the Internet available for anyone to take over, that the person who puts it there has no responsibility, and that anyone who complains, tries to get it fixed, etc, is in the wrong.

Friends, I know that we all consider those who crack computers to be the ultimate culprits in any situation where a computer is damaged, but that doesn't mean that people shouldn't take responsibility their own parts in allowing this to happen. Someone who quite blatently leaves his or her keys in their car and parks outside bars would not be viewed by most people as completely blameless in the event that a drunk staggers out, takes the car, and drives it into a shop window.

Leaving a machine unsecured and unmonitored on the Internet is a sure-fire way of ensuring it is hacked and used to attack other machines. We know this. Yet people continue to do it. They do not secure their machines once hacked, and they allow their own machines to attack others once hacked. This is negligence, pure and simple.

This quagmire of negligent sysadmins not securing their machines, not allowing their machines to be shut down by victims yet not willing to consider the consequences of their failure to secure their machines and to turn off machines that attack others will not disappear by itself. Unless people are prepared to actually act, not just talk about it on Slashdot, nothing will ever get done. Apathy is not an option.

You can help by getting off your rear and writing to your congressman or senator. Tell them that negligent sysadmins who are happy to keep their computers connected to the Internet all of the time but aren't willing to take basic, simple, security precautions to ensure they play with others are a danger to the security of the Internet, a menace to other 'net users, and cause billions of dollars of damage every year. Tell them that you appreciate the work being done by groups like Security Focus, BugTraq, and even the efforts made by Microsoft to secure their systems and provide easy ways of keeping their products secure, but that if those responsible for computers that are on the Internet do not make use of the tools and features made available to them, you will be forced to use less and less secure and intelligently designed alternatives. Let them know that SMP may make or break whether you can efficiently deploy OpenBSD on your workstations and servers. Explain the concerns you have about freedom, openness, and choice, and how incompetent system administration harms all three. Let them know that this is an issue that effects YOU directly, that YOU vote, and that your vote will be influenced, indeed dependent, on whether or not they are willing to propose laws that provide proper deterents to poor system administratorship and allow those attacked by poorly managed machines to fight back.

You CAN make a difference. Don't treat voting as a right, treat it as a duty. Keep informed, keep your political representatives informed on how you feel. And, most importantly of all, vote.

Re:Killing Others' Malicious Processes

[Moirke]

Man you covered a lot there. Let me just say that the bulk of your comments are common sense, people should take some responsibility and potentially even be accountable for their machines.

The real issue is that some people believe that what we need is a vigilanty approach to forcing users to secure their system. If your system attacks mine then I have the right to attack back. This is not the way any civilized society operates, nor should it.

Re:Killing Others' Malicious Processes

[Narcissus]

That's only a good analogy if you don't have responsibility/knowledge of your car. The thinking is that if you don't know about the worm, then I should be able to kill it off without your retribution.

If you do know about it, then you take responsibility for what it does to my system.

I think this is a fair, two way street. As the article says, if you don't own the process, then you shouldn't care that I kill it. If you do care that I killed it, that means that you must have known that it existed to begin with, and hence you have to be liable for what it did to my machine.

Re:Killing Others' Malicious Processes

[DrDebug]

I understand your concerns. But without authority there will be chaos.

The latest Windows machines have a user named 'admin'. UNIX boxes have a user named 'root'. These are (supposedly) trusted individuals who are in authority. Why not something like that on the Internet? As SUN microsystems used to say, "The network is the computer".

As I stated, if we ever came up with an "Internet sheriff" it would have to be someone (somebody) that EVERYONE could implicitly trust. Given the special interest groups that abound at this point in time, I do not see that happening soon. But I think the idea will have to be addressed. After all, we humans (like it or not) respond well to hierarchy and leadership well.

Re:Killing Others' Malicious Processes

[StillNeedMoreCoffee]

The consequences of decisions about who is accountable and to what extent can have very subtle and far reaching effects. Often times very different from the original spirit or intent. Take for example the 'accountablilty' of medical doctors which has translated to a multi billion dollar (my supposition) for lawyers talking juries into large awards which translates into higher malpractice premiums (as well as stock market problems causing increased premiums, probably the acutal reason for the rise), causing Doctors all over the country to begin to stop offering service altogether. There were no Obie/Gynie docs practicing in Florida as I remember and another group just about a week ago.

This is the result of the idea that they are accountable and that accountability translates to litigation and the eventual colapse of the system. There may be a principle here of the cure being worse than the disease. We don't live in a riskless society nor should we expect to or everything will grind to a halt. We have to moderate that litigious behavior to all get along and have an environment and system that works.

That being said one naturally has the right to defend oneself. If you have a bus and a passenger gets on the bus and that passenger is not identifable as a malicous person. Is the bus driver responsible for that persons maliciousness?

If that person starts firing out the window (with a silencer so the bus driver does not know it is happening, is the bus driver responsible or is the malicous person? If you were on the street and being fired upon, could you fire back in defense? In some States if you have a permit for a gun, maybe. But if in your firing back you hit someone else or damage the bus, you would probably be responsible.

I think it simplistic to place the blame and responsibility on the bus driver entirely as new viruses come up all the time, for each one found new ones that take advantage of new exploits appear. Is it the admin or the system designers fault that the system is exploited? How much protection do you need? How current do your patches and upgrades and lockdowns have to be to not be accountable? You see there is a sliding slope here. From the lawyers point of view, if there is any damage someone with money is accountable, unless there is protection from law or precedence this new fields of litigation could much harm.

The cuprit of course is the one that wrote and/or fielded the virus. They are the one accountable. They are the ones we should identified and held accountable. They are the ones that do the anonyomous damage and as we move networked computers further into our physical life in cars and elevators and microwaves, actual damage and injury will happen because of this insane virus writing behavior. Lets identify where the problem really is and address that.

Re:Killing Others' Malicious Processes

[waferbuster]

"Your Honor, despite repeated warnings as to the inadequacy of the windows in her vehicle to withstand external impacts, the defendant continued to refuse to install more secure windows! It was only a matter of time until the window was shattered by a poor misguided child who innocently threw a rock! Also, the door locks were clearly inadequate, as reaching through the broken window and pulling the door handle allowed free entry to the interior of the car. Simple application of a screwdriver to the ignition switch released full control of the vehicle to the occupant.

"I call for summary judgement against the defendent in that her actions in failing to secure her vehicle were willfully negligent, and ask the maximum penalty be applied, along with punitive to cover the cost of repairs to the storefront damages by her car. Also, we request punitive damages for her contributing to the delinquency of the minor who stole her car.

"We need to send a clear message that failing to take action to fortify windows is intolerable!"

Re:Killing Others' Malicious Processes

[mmdurrant]

If you read the white paper, Mullen makes the excellent point that you can't have your cake and eat it too. Either people are responsible for their computer systems and sofware or they are not. It is this ambiguity that creates the problem.
The issue here is not computer security or ethics, but accountability and responsiblity. The only reason measures like this are necessary is because of irresponsible sys admins.
It comes down to this: if you have ANY doubts about the software you are going to install, regardless if it's from MS or RMS, DO NOT INSTALL IT. I present the metaphor of the cheap front-door lock, from Cheapo Locks Inc. Joe Thief breaks into my home pretty easily because Cheapo Locks makes, well, cheapo locks. It is not the fault of the manufacturer, it is my fault. And just like my home, I am responsible for every thing that goes in and out of my computer.
An interesting point that comes to mind is that if YOU are not responsible for the actions of your computer, then I am certainly not responsible for the actions my computer performs in response. Mullen also makes an excellent point in the white paper that as Code Red, widespread hacking isn't illegal. However, if the same actions is performed as a Perl script by yours truly, it is a felony. Once again, the ambiguity of the situation is a large source of the problem.

Re:Killing Others' Malicious Processes

[Anonymous Coward]

I don't want my neighbor messing with my car any more than I want him messing with my processes.

If your car is on fire and endagering my property, I'm gunna have the fire department come put it out, your leather interior be damned.

Re:Killing Others' Malicious Processes

[Archfeld]

are you certified to decide what is wrong with my radiator ? What if, after you "help" me by fixing my car, the radiator explodes. Do I get to sue you for damages, or are you in jail, do I even KNOW you 'helped' me ?
I can't help as a sysadmin intellectually agree with you, fix your stuff or it will get fixed, but there are many other questions that this brings to the surface.... A veritable pandora's box.

Re:Killing Others' Malicious Processes

[Zzootnik]

First off- "Common Sense" is definitely NOT common. "Jane with a new Dell" who just plugs it in to a cable modem and zips around the met with email, ICQ, and whatever generally isn't even AWARE of anything security related...The thought just doesn't even occurr to her (or him-) that their new Computer could easily be r00+D and used to attack other people... I'm Thinking of something along the lines of an "Awareness Campaign", and I personally endorse taking security measures to everyone I know. (It's important, dammit!)

As to the vigilante and civilised society...heh-heh-heh...Not gonna happen on the net. Not for a while at least. This is, as I've read earlier in this thread, much like the old west before the sheriffs came to town. Right now, there really isn't anyone in authority over the whole net...The only real "authority" is located n a real-world based geographical area. That makes it problematical for things like US enforcement against Chinese hackers (for instance...)

Hate to say it, but it looks like vigilante justice is about the best we can hope for...although be assured, I trust them as far as I can throw my refridgerator. But I've also taken steps to assure my computers presence on the net is all but invisible, so I don't think I really have much personally to worry about.

Re:Killing Others' Malicious Processes

[Anonymous Coward]

I think most will agree that whoever attaches a machine to the internet should be held responsible for it's behavior on the internet.

What you're finding people not agreeing with is that it is NOT the responisiblity of the victim to make restitution for damages.

That's vigilantism and it's not a good idea for oh so many reasons.

Re: Killing Others' Malicious Processes

[themo0c0w]

Leaving a machine unsecured and unmonitored on the Internet is a sure-fire way of ensuring it is hacked and used to attack other machines. We know this. Yet people continue to do it. They do not secure their machines once hacked, and they allow their own machines to attack others once hacked. This is negligence, pure and simple.

So then if I leave my house unlocked and someone enters and robs me, am I negligant? Moreover, is it right that I get robbed? Blaming the victims for "insecure" systems is just as illogical (and silly) as blaming a woman for being a rape victim.

Whether you break into a computer or house makes no difference. You are comitting a crime.

That said, common sense tells you to lock your doors at night in a city. The same should apply to computers on the internet.

Re:Killing Others' Malicious Processes

[joehahn]

If you are a homeowner, and your kids have an underage drinking party while you are on vacation, its the parents paying the fine and the parents' names in the local paper.

Re:Killing Others' Malicious Processes

[mt-biker]

Someone who quite blatently leaves his or her keys in their car and parks outside bars would not be viewed by most people as completely blameless in the event that a drunk staggers out, takes the car, and drives it into a shop window.

I think you chose a controversial example here - I would not hold myself to blame in this case.

Better (IMHO) would have been:

- leaving keys in car, resulting in a child driving the car and causing damage.

- leaving gun cabinet unlocked resulting in another person going on killing rampage.

Re:Killing Others' Malicious Processes

[Anonymous Coward]

First off- "Common Sense" is definitely NOT common. "Jane with a new Dell" who just plugs it in to a cable modem and zips around the met with email, ICQ, and whatever generally isn't even AWARE of anything security related...

First off, knowledge of security and common sense are utterly separate issues. Common sense may not be so common, but not for the reason you stated (like comparing bikes and oranges).

Secondly, if you attack someone else, why shouldn't they attack you back? All it will result in is attack-wars that will flame up across the entire net, and when will it ever end?

You may have common sense, but I believe your conclusions are utterly wrong. You can't "fix" everything in the world, but at least you can defend yourself and make blacklists.

Re:Killing Others' Malicious Processes

[Anonymous Coward]

- leaving keys in car, resulting in a child driving the car and causing damage.

So if this child dies, you should be commited for murder or manslaughter just because you friggin' forgot the keys? Your child example is irrelevant, because children are not accountable by law, a whole different ballgame. Children needs to be protected by adults (because they are both unaccountable and can do crazy things).

- leaving gun cabinet unlocked resulting in another person going on killing rampage.

You are not responsible for another person going on a killing rampage - It is still their decision. According to your analogy, it should then be okay to shoot the person who forgot to lock the gun cabinet (attack "back").

This shows how silly it is to use analogies. Discuss concrete examples instead. That is much more productive and intelligent.

Re: Killing Others' Malicious Processes

[squiggleslash]

So then if I leave my house unlocked and someone enters and robs me, am I negligant?

No, but that wouldn't be comparable to the situation Karmawarrior is describing.

If you quite intentionally, in a high crime area where people regularly steal cars, joyride them, and crash them into shops, left your car unlocked, left your keys in the car, did so all the time, did so after your car had been repeatedly stolen in the same area, and each time your car was stolen failed to report the incident to the police so they can recover the car and failed to make any effort to get the car yourself even when you have the opportunity, that would be comparable.

This isn't about you accidentally forgetting to install the latest patch. This is about morons who connect to the Internet and just ignore the upgrades, and who don't even bother to do anything about it once their machines have been infected and are causing damage to other users.

It happens all the time. Check your web logs. NIMDA and similar worms are still out there. There ARE NO EXCUSES for NIMDA any more. But it's still out there in the wild. Why? Because lazy incompetents who KNOW there's something wrong can't be bothered to even turn the fucking machines off.

That's irresponsible incompetence, and it's absolutely right someone in that situation should be punished. And regardless of the issue of compensation or punishment, any system administrator should feel some degree of personal responsibility for the hardware they put on the Internet. This thread, including your posting, and the fact that NIMDA is still out there, suggests that that sense of personal responsibility is sadly lacking.

Re:Killing Others' Malicious Processes

[karmawarrior]

What you're finding people not agreeing with is that it is NOT the responisiblity of the victim to make restitution for damages.

No, that's not what they were complaining about.

In my original, I made the consequences of (incompetently, I made the thing fair) of not securing your machine very, very, harsh indeed. Only one person actually protested about the method.

I actually, originally, wanted to make people think about vengence and the brutality people are willing to put up with done on their behalf in a supposedly civilized society. Unfortunately, it seemed all but one person - maybe two, a moderator mod'd the thing as troll but as they didn't reply... - were more concerned about the notion that a person who makes no effort to ensure their machine, connected to the public Internet, is secure and makes no effort to ensure that it causes as little disruption to others as possible - should in any way be responsible for what damange it does. Not "fully responsible", just responsible to some degree.

The punishment I was proposing wasn't that a sysadmin pay damages. I proposed that they have their balls cut off. Nobody protested about that aspect of my argument. We live in a society, it seems, where brutality is supported, but personal responsibility isn't. What a world.

Re:Killing Others' Malicious Processes

[RootLoggins]

All Analogies Aside. The reality is a true Systems Administrator does the best he can with the resources at his disposal. His setting is in the real world. Big Brother isn't looking over his shoulder - management is. Appreciation for a job well done, or problem resolved is not the norm -- it is the exception. So.... If it happens that I shutdown or modify your computer, or its processes, because it is affecting my work or the resources under my care .... Too Bad. You probaby wouldn't notice the change anyway.

Re:Killing Others' Malicious Processes

[Rick the Red]

That's not at all the same as putting out the fire yourself. In your example, the fire department assumes responsibility for any damage they may cause to your neighbor's landscaping, driveway, etc. If you put out your neighbor's fire, you assume liablity for any such damage you cause. Same here: If you kill a "malicious" process on someone else's computer, you should assume responsibility for any unintended damage you may cause (such as killing the wrong process, erasing data, etc.). This means you shouldn't do it if you don't know exactly what you're doing.

If there were a "virus fire department" -- government authorized and funded -- that you could call to report a worm/virus on another computer that threatens your computer, then this discussion would be moot.

It's actually a great analogy, if you know the history of the fire department. Fire departments were originally established by insurance companies, and they only served their customers. If your neighbor's house caught fire, you depended on their insurance company's fire department (if they had one) to put out the fire and protect your house. The best you could do was call your insurance company so their fire department could stand by in case the neighbor's fire spread. Benjamin Franklin is the guy who came up with the idea of a (volunteer) fire department that would fight any fire, regardless of whose insurance you had (if any!).

The parallel here is that before we're ready for an official group authorized to fight worms and viruses, we first need the private "fire departments." I smell a business opportunity here -- offer worm/virus insurance, with the conditions that for coverage you must allow the insurance company to inspect your security processes, ensure you're up to code (have the latest patches), and have the authority to go in and kill viruses and worms if you get infected. Then if someone else gets infected and endangers your computers, you can sue their insurance company -- or sue them if they don't have insurance.

Re:Killing Others' Malicious Processes

[Rick the Red]

We don't need MORE AUTHORITY, what we need is LESS AUTHORITY.

What we need is more RESPONSIBILITY. If you get infected and endanger my computers, and you haven't applied the latest OS patches or you've left open a known hole, then you should face criminal charges. We have existing laws -- "attractive nusanse" "reckless endangerment" etc. -- we just need to apply them to this new place called 'cyberspace'.

Re:Killing Others' Malicious Processes

[Anonymous Coward]

So I assume that you are going to get vaccinated for smallpox? After all, leaving your body unsecured might lead to you infecting someone, should you contract smallpox. Nevermind that by getting the vaccine you run the risk of actually contracting smallpox and dying.

This is the issue that I face with being forced to "secure" my box. I can't keep pace with every patch, upgrade, modification out there. I sure as hell can't test each of these on my production systems in time for them to meet whatever latest threat is out there. And who's to blame if I "secure" my system and it crashes. me.

Come to think of it, if a terrorist decided to blow up your house, and shrapnel hit your neighbors, are you to blame? I mean, using your logic, you should have anticipated the attack and secured your home with a high shrapnel proof wall, as to avoid injuring others. Thats the responsible thing to do since you do, after all, leave in a community (internet).

Legalised hacking..

[Anonymous Coward]

yet again under another pretense.

This will be abused like all the other technology laws.

Re:Legalised hacking..

[macdaddy357]

Tim Mullen wants a licence to hack, the entertainment industry want a licence to hack. Here's a rap for them

Yo Yo
Ya say ya wanna have a licence ta hack
That is really whack!
If ya think we're gonna give ya a licence ta hack
You be smokin'crack!
Yo!

Re:Legalised hacking..

[sniggly]

it's not a law. This is an international problem for which a law will most likely never come into being.

Imagine I am your next door neighbour and I have a dead animal on my porch, the stench and health hazard is more than an annoyance to you. You can take action against that by removing the dead animal from my space but you would enter my premises doing so. Instead you can call the police or any other agency that might take the trouble to show up and deal with it.

On the internet there is no 911. There is an uplink admin that might take action but the uplink might have a legal obligation to keep the link up. If the attacks take up a significant portion of your bandwidth you are seriously compromised, you are probably paying for the bandwidth the attacker is using while trying to compromise your system.

Taking out the worm on the attacking system is what one could call a "surgical strike", you deal with it.

It could be illegal to do so and for this you take responsibility.

But is it immoral? Those here who seem to argue from a moral perspective saying it's wrong to try to stop worm attacks by entering and killing the worm on the attacking machine apparently are not server admins themselves. When you are under attack all you want is for it to stop.

Re:Legalised hacking..

[Anonymous Coward]

Is this strikeback code available that he claims
to have written?

Give me a day or two, and I'll write a
strike-strikeback exploit :)

[yes, i'm serious.. show us the code for this]

--
Silvio

Re:Legalised hacking..

[Anonymous Coward]

I think you're a tumbling gaywad.

Re:Legalised hacking..

[GMontag451]

The way I see this is akin to a self defense plea when you are charged with murder. If someone is coming at you with a gun, you have the right to stop him/her with any available force. However, if you are charged with murder, the burden of proof is on you to show that you were acting in self-defense. The same should go for an attack on the internet. If some computer is attacking you, you should be able to react with reasonable force. But the burden of proof should again be on you to show that you were acting with reasonable force.

Re:Legalised hacking..

[GMontag451]

For many of the worms still circulating (nimda, code red, etc.), you could simply use the same hole that the worm got in on. Once you have killed the worm process, you could also patch the hole if you are a kind netizen.

Re:Legalised hacking..

[binner1]

Although I agree with your sentiment, I think that this is where the line is crossed. You've switched from passive to active. Even though your intentions are good, you've _modified_ the machine at that point...

I like the idea, I just think I'd stop at killing the process.

-Ben

Leave them alone !?

[mirko]

You should not interact with other's machines :
Let them fix their worm problems themselves or they may not appreciate it.
It is normal and nice to tell them they have a problem but your work stops here !

Re:Leave them alone !?

[rmadmin]

I agree with this! I work for an ISP, and when we come across a user that we cannot contact to notify of problems, we simple disconnect them untill they can prove they have resolved the problem. Its worked wonders. We see so much less virus activity trying to hit our mail servers, and we've had alot less complains about people having a virus or worm.

Re:Leave them alone !?

[sfled]

That is bsolutely the correct way to go, rmadmin. I report the problem server to abuse@problemserver'sISP and they usually inform the server's sysadmin/dork and disconnect the server until the problem is fixed.

Re:Leave them alone !?

[Anonymous Coward]

..when we come across a user that we cannot contact to notify of problems, we simple disconnect them...

You agree to what? leaving them alone? How is this leaving them alone?

Re:Leave them alone !?

[caseyc]

I'm not sure that this is what the author of the article was talking about. But, I think you're more on track than he is.

Maybe I'm missing the author's point, but it didn't seem like he offered any clear solutions? Who will have authority to kill the said processes? Will the ability for those authorities to do so be implemented in the OS?

It's a noble idea, but certainly not ready for prime time. Holding people legally accountable for their own systems seems like a better solution, although nobody really sees that happening in the near future. For now, shutting the trouble machines out of the network while the user of the machine isolates the problem seems to be the easiest, safest, and most reasonable way to deal with worms and whatnot.

Re:Leave them alone !?

[secolactico]

I used to work for an ISP where the policy was to inform the sysadmin, and if the complains against him/her were too many, disconnect it. However, if the customer was a large one (say... a public entity) and, as usual, had no one clueful enough to fix the problem, the bosses would send someone over from our office to help fix it...

"But sir... I know nothing of exchange!"

"No matter, go over there and run some antivirus or something"

"...sigh..."

I've ever since moved on to greener pastures. Still, my belief is that if there's no one at the offending site that can solve the problem, leave them alone unless they ask for help and pay you for your services.

Re:Leave them alone !?

[Mr_Silver]

I agree with this! I work for an ISP, and when we come across a user that we cannot contact to notify of problems, we simple disconnect them untill they can prove they have resolved the problem. Its worked wonders. We see so much less virus activity trying to hit our mail servers, and we've had alot less complains about people having a virus or worm.

Whilst I'm sure you were agreeing with the parent poster, in fact, what you've actually done is actually pointed out that you do the opposite.

A user is affected and rather than sit there, do nothing and wait for them to fix it (as suggested by the parent), you actually proactivity go out and "kill their processes".

In this case, "killing their processes" means pull the plug on their internet connection.

If you truely did what the parent poster was suggesting then your work stops after informing them and you should "Let them fix their worm problems".

Re:Leave them alone !?

[crazyphilman]

Mirko said: "You should not interact with other's machines : Let them fix their worm problems themselves or they may not appreciate it.
It is normal and nice to tell them they have a problem but your work stops here !"

I agree with you that one should never, ever interfere with the operation of another machine or site. I also agree that the best course of action would be to notify them of the problem, and let them fix their own machines. However, I would take an additional step: I would adjust the firewalls on my own machines so that traffic from the affected machines was completely blocked off until the worm/portscans/whatever stopped completely.

I think this approach is a fair compromise; it protects my machines (my responsibility) and it doesn't interfere with other people's machines (which is probably illegal anyway). And, I've done them the favor of letting them know about the problem, in a gentlemanly, polite way.

One Caveat: if I was working for an ISP, and my machines included routers which their machines depended upon for their internet connection, it would be a little more sticky. In that case, I think I'd prevent traffic from that machine from going TO my machines, but I might allow forwarding on the routers... I'd have to crack open my firewall book, it's been a while -- this would work, wouldn't it? If there was some way of identifying the worm/etc's packets, I could just firewall off the worm, too, maybe.

Re:Leave them alone !?

[tsg]

Um, no. The ISP is disconnecting the service they provide until the customer can fix his equipment. They are not touching anything they do not have direct resposibility for. They aren't modifying anything on the machine at all.

It's analagous to the phone company disconnecting your fax line because your fax machine repeatedly calls the same residential number. They are shutting down the connection they are responsible for, not fixing your fax machine.

Re:Leave them alone !?

[FleshWound]

Whilst I'm sure you were agreeing with the parent poster, in fact, what you've actually done is actually pointed out that you do the opposite.

Glad I wasn't the only one that caught that.

Re:Leave them alone !?

[Anonymous Coward]

I may tell Joe that his fly is down, but I ain't gonna just jump in and zip it up for him.

Re:Leave them alone !?

[rlthomps-1]

A-Men
If parents don't vaccinate their children, the state takes them out of school. If a dog consistently attacks people, the authorities put it down. If someone commits three felonies, they are put away for life. This is because the rights of the many outweigh the rights of the one.

In this case who is deciding when the needs of the many are greater? the state. The parent down the street doesn't decide when your child is not vaccinated enough to attend school, concerned citizens do not decide when to put sparky to sleep, and if someone commits three felonies a statute passed by the state legislature dictates that you get a life sentence. In all three of these cases there is due process and an agency or institution that oversees this process

Allowing you to shutdown processes on another's computer without an overseeing body is vigilate justice. Then what constitutes a "malicious process"

If someone pings me 100 times and I don't like it, can I go in and stop their ping process?

There are plenty of solutions that network admins can employ. If you have enough time to kill a process on a rogue machine, then you have enough time to firewall their IP, secure your own machine, or contact their ISP.

This country is not about vigilante justice and neither should the internet.

Re:Leave them alone !?

[DancingSword]

And if the opponent-machine is committing a DoS/flood-attack against my connection/machine?

Dropping the packets isn't going to save me from paying for the bandwidth, or unclog my connection ( this IS assault, we're talking about ), and no matter how I makebelieve that "they aren't touching my machine, therefore I have no right to touch theirs", it isn't that clear/simple ( they are obliterating my resources, for starters ):

If A PROCESS among their machine is attacking me & costing me, then have I the right to kill that process's action..?

If not, then assaulting/damaging others' ( by losing them their ISP/connection, or costing them thousands of dollars in bandwidth, or obliterating their livelihood's function ) is a right, and neither one's-own-resources, nor defensive-action is *equal* a right.

This *is not* the same as the "gun rights" discussion, though similar, because what I'm talking about is the right to kill their gun, not to kill them, see...

Re:Leave them alone !?

[Anonymous Coward]

WoW this is the Solution! Instead of desactivating the worm, just desactivate the server itself by switching it off the internet, I am sure your user prefer that solution!

Re:Leave them alone !?

[walt-sjc]

Um, and what about the guy who has to wait for days, his network being hammered, piling up and network usage charges, while you take you sweet time in the disconnect process? Do you cut your customers off if you can't reach them in 10 minutes or do you give them a while?

Of course then you also have ISP's that are so backlogged that they don't respond to a security issue for days to begin with, or the ISP's in China that can't read english so just ignore you.

Though rose-colored glasses this is fine. In the real world it fails.

A good example was code-red. It wasn't just one server once in a while trying to infect your server, it was HUNDREDS. Simultaniously. How the fuck do you handle that though notification? How long are you willing to let your business be offline?

Code-red was just another wake-up call. The next worm might be MUCH more malicious and do MUCH more harm to the internet.

Re:Leave them alone !?

[jorleif]

Who will have authority to kill the said processes? Will the ability for those authorities to do so be implemented in the OS?

I thought the same thing. Having this type of infrastructure in the OS would probably create a lot more problems than it would solve. The OS of the compromised system can't possibly know which of its processes are hostile, so it must allow remote sysadmins to kill all processes. That can't possibly work in practice so some kind of filtering of what processes may be killed remotely is needed. The only sensible way of filtering, that I can think of from the top of my head, would be to allow remote users to kill only processes that interact with their machine, for instance the web-server box could kill web-client processes that connect to it. Now this would make sense to a point but still sounds like something that could be abused in a hostile environment by spoofing etc.

The author might of course also mean that the processes should be killed by attacking the infected computer through the same security hole that the original worm/virus used. Using this security hole the infected computer could be cleaned, and even patched. Now this scheme just might work, but it's probably illegal and perhaps immoral as well. I at least wouldn't like it if my machine would be patched remotely without notifying me. It might of course inspire worm writers to have the worm fix the security hole it uses by itself, which would be kind of amusing

Re:Leave them alone !?

[crazyphilman]

DancingSword said: "Dropping the packets isn't going to save me from paying for the bandwidth, or unclog my connection ( this IS assault, we're talking about ), and no matter how I makebelieve that they aren't touching my machine, therefore I have no right to touch theirs, it isn't that clear/simple ( they are obliterating my resources, for starters ):"

Yes, but the correct approach is to complain to your ISP and have them firewall the offending packets off upstream, without making you pay for them. If you're a business customer this shouldn't be a problem for the ISP.

Then he said: "If A PROCESS among their machine is attacking me & costing me, then have I the right to kill that process's action..?"

No; you're not killing an action by firewalling their traffic. You are blocking it, just as you have the right to put a lock on your front door to block a thief from entering your house. You're not tying the thief to a telephone pole; he still has his liberty -- you're just keeping him out of YOUR house, which is YOUR right. See? Your rights end where the thief's rights begin, and vice versa.

Then he said: "If not, then assaulting/damaging others' ( by losing them their ISP/connection, or costing them thousands of dollars in bandwidth, or obliterating their livelihood's function ) is a right, and neither one's-own-resources, nor defensive-action is *equal* a right."

Now, you're using a non sequitur. You cannot proceed from the other proposition to this conclusion; it just doesn't work. Here is what I think the "rights" situation is (just to be clear):

I have the right to take action on MY OWN MACHINE, to prevent your machine from interfering with me. Thus, I can firewall your machine off from me, and I can ask my ISP to put in an upstream firewall to protect my business. This only affects MY machine, so it doesn't impact any legitimate rights of the attacker.

Even if an attacker is DOS'ing your server, you do not have the right to attempt to counter-hack him. Your rights end where his begin, you see: he has the right to expect privacy and noninterference on his system just as YOU do on yours.

The only appropriate action is to involve your ISP and the authorities. They can then take LEGAL action against the source of the attacks.

Re:Leave them alone !?

[poisoneleven]

That's exactly what I thought when I read the post.

Re:Leave them alone !?

[MrResistor]

The only appropriate action is to involve your ISP and the authorities. They can then take LEGAL action against the source of the attacks.

And if they don't?

Let me point out that if that always worked we wouldn't be having this discussion at all.

The hole in your arguement is self defense. Killing people is illegal, but if I can prove it was self defense I won't be punished for it.

Re:Leave them alone !?

[crazyphilman]

MrResistor said: "The hole in your arguement is self defense. Killing people is illegal, but if I can prove it was self defense I won't be punished for it."

This is not a hole. While it may be true that IF someone is trying to kill me, and therefore is presenting an immediate threat to my life, THEN I am permitted to use appropriate force and possibly even kill him without getting in trouble, this has nothing whatsoever to do with some hacker kid flooding my network. A DOS attack is simply not a direct threat to your life or limb and so you cannot use self defense as a defense. This is a false analogy.

A better analogy would be the case where someone was committing libel against you. You are entitled to get a lawyer, seek an injunction against the person, obtain a court order forcing them to stop... But (for example) If they're talking trash about you on a radio station, you're not entitled to break in at 4AM and use a baseball bat on the transmitter, or sneak up on the roof and cut down the antenna with an acetylene torch. Trying a stunt like that goes right over the line into criminal activity. Just as trying to hack a hacker is criminal activity, whether you tell yourself it's self defense or not.

It sucks, but if your ISP won't help you find another ISP. Or get a lawyer, and get a court order. Sue the hacker's ISP. Sue the hacker. Basically, DO SOMETHING (LEGAL) ABOUT IT. Running around like a villager with a coil of rope, a torch and a pitchfork isn't going to get you any satisfaction. It might get you put in jail for a while though.

Re:Leave them alone !?

[msim]

about 2 isp's ago (as a user) i had run into some arrogant little bastard on irc (as typical, undernet) that didn't like me or my friends cause we refused to give him oper status. He DOS'sed my ISP with a pingflood, and the same with a friend, all in retaliation to being banned.

He took out the entire ISP for the better part fo 2-3 hours. Once the attack stopped, I reported it to any and all ISP's along the path, Worldcom, Optus, my ISP.

Funny enough, my isp and Optus were unhelpful, but amazingly Worldcom (the provider of the service to DOSboy) replied back to me a week later & informed me that some $cr!p+ |!DD!3 had used a rootkit and taken over someones solaris boxern on a multi meg link.

It took a freaking age, but i do believe they nailed the little fucker.

So tighten that security, the less opportunity these little assholes have to do this, the freaking better.

Re:Leave them alone !?

[DickBreath]

I may tell Joe that his fly is down, but I ain't gonna just jump in and zip it up for him.

Hey, some of us would not only zip it up for him, but would also have unzipped it, and then performed other services first.

actually

[Anonymous Coward]

I'd rather see a set of worms released that infected machines on the scale of say code red or nimbda - but actually patched security holes, and or closed all the ports on the host machine. If the ports already closed by the machine were in actual use, the user would have the option to open the ones needed manually.

Re:actually

[greechneb]

I seem to remember such a thing for unix/linux systems a while back, a search on google would probably find it.

I'm pretty sure no one liked it.(I think the creator got bashed for it actually.) Mainly for the reason that changing something to fix a worm might break another process running on your machine if not done the correct way.

If you are so worried about another machine trying to break into your own, I'd be securing yours better so you wouldn't have to worry...

Re:actually

[bpfinn]

I'm pretty sure no one liked it.(I think the creator got bashed for it actually.)

That's probably because the author, "Max Vision", programmed his worm to leave a backdoor open on your system - after it patched BIND to a safe version. He's in jail now.

Re:actually

[Gerry Gleason]

It's not so much that the fix might break something, but anytime someone changes something without your knowledge, there is cause for concern. Whenever you detect that something has changed with one of the systems you manage, you have to try to understand how and why. If someone is going around fixing things and not telling anyone, even if it is someone in the organization, you (or your monitoring tools) may notice something strange. When you try to follow up and understand how and why, you are missing information about what happened.

Re:actually

[patter]

If you are so worried about another machine trying to break into your own, I'd be securing yours better so you wouldn't have to worry...

Hmm. not sure how such blatant ignorance gets modded up by four moderators.. ;). Hopefully the actually interesting part (all but this sentence) is where they stopped reading... :P

The problem isn't security, it's the dos attack that code red was. Even with perfect (theoretical) security, code red caused harm. Code Red didn't affect *nix machines, it went through a hole in IIS's indexing service.

The problem wasn't that the machines were getting *infected* with code red, it's that the worm was idiotically crafted by someone who didn't have a vague clue. It would attempt to infect a whole subnet of computers, using an algorithm something like this:

while (computers in subnet)
{
if (host has server on port 80)
{
while (computer_not_infected)
{
request 'default.ida';
if (get told of successful infection)
host++;
}
}
host++;
}

So the target's security doesn't even enter into the picture -- not for a second. The problem is that the target keeps getting FLOODED by requests from one host or several in a subnet continuously, for days.

There's no security against that, maybe upstream firewalling, but then the upstream routers are still getting pounded by packets from the malicious computers.

We can still keep moving upstream, but the basic fact of the matter is, that not all ISPs are as responsible as the one that took people offline if they couldn't get a hold of them. Most staff their abuse desks with $5 an hour flunkies who don't know what a DOS attack is, much less a web server. They'll typically spend about 6 days denying that a problem exists, before acting on complaints if at all.

Some ISPs just route abuse@host to dev/null, so there's no solution but the one that is proposed here, to be able to attack the worm itself (not the host system).

Everyone here is getting excited because we can't fathom the idea of someone touching our precious little linux box who isn't ourselves.

THAT'S not the problem. We're likely all responsible and the first sign of trouble (if we didn't catch it ourselves), and we'd race to correct it -- certainly killing the damn errant process ourselves, and removing it.

The problem isn't the worm's ability to infect any but the most ignorant of sysadmins, the problem is the Internet wide DOS attack that was enacted against every other SECURE host by this poorly written worm.

That's what we're actually talking about, not being broken into, but being taken off the net because we CAN'T be broken into.

Re:actually

[Anonymous Coward]

"shutdown -h now"

Striking back at US federal computers ...

[Anonymous Coward]

... will land you in jail real fast ... will have you labeled as a terrorist ... will give you lots of time to think your actions over ... will make you very old before you see the light again

Vigilante justice?

[grub]

Exactly who decides what constitutes "relentlessly attacking your network"?
A simple NMAP scan? What about Netbios scans? @Home scans for open NNTP servers... etc etc..

Re:Vigilante justice?

[grub]

If you're killed because you've killed it's the government doing it, not a lynch mob. Which leads back to my initial question..

Re:Vigilante justice?

[elfkicker]

Obviously being linked to from slashdot would be one.

Re:Vigilante justice?

[Anonymous Coward]

Oh, so you're saying you've never killed anyone?! Not even your high school gym teacher or the guy who stuck a firecracker in your dog's ass and then your dog died on the way to the vet? Or that guy who cut you off in traffic?

Sheesh, some people.

Re:Vigilante justice?

[Doc Hopper]

In the US, "The Government" is another word for a body representing the collective will of the people. In other words, a 350-million-person lynch mob generally agrees (or fails to disagree much that) somebody should die, and paid a few people to do it for them.

Justice from "the government" is simply institutionalized vigilantism. We hire people who are interested in pursuing justice and pay them decent money to carry out justice on our behalfs. As a side benefit, we decided to pay for training programs so that these hired guns won't kill the wrong people or treat them unfairly (which doesn't always work, but we try).

If you're killed because you've killed, it's because a bunch of people want you dead for doing what you've done. Is it really more civilized to murder someone collectively as a "government" because all of one's friends (fellow voters) say to do it rather than because one is angry?

Not completely disagreeing, but just food for thought. Perhaps government == vigilantism with rules...

Re:Vigilante justice?

[Frank T. Lofaro Jr.]

Exactly who decides what constitutes "relentlessly attacking your network"?

That depends on how much money the attacker has.

Re:Vigilante justice?

[William Tanksley]

What you're saying is pretty much standard political theory, nothing particularly new. The standard way of saying it is that "Govenment is a monopoly on violence."

Your post applies that only to the death penalty, but it really applies exactly the same to every other punitive action gov't takes -- and in the long run, all actions by gov't are punitive, since the only way to make them happen is to threaten punishment.

Is it really more civilized to murder someone collectively as a "government" because all of one's friends (fellow voters) say to do it rather than because one is angry?

Of course not -- but mass votes aren't supposed to be a part of the death penalty, anyhow. Interestingly, they are considered a part of warfare, which is an interesting distinction.

-Billy

Re:Vigilante justice?

[Doc Hopper]

What you're saying is pretty much standard political theory, nothing particularly new. The standard way of saying it is that "Govenment is a monopoly on violence."

I didn't have that phrase, "Government is a monopoly on violence" in my vernacular until this moment. I appreciate the quip!

I think not enough people understand the origins of government, though, and in cases like this rail and rant against "vigilante justice", failing to realize that organized justice systems spring from vigilante justice! Communities reach a certain size, and with it grows crime. Against the crime springs up vigilantes to pursue the "bad guys". The non-vigilantes/non-criminals grow concerned about vigilante justice and seek to organize vigilante forces so that they can feel that justice is "ordered". Seems like we're following the same pattern on the Internet, but it will still take another 2-5 years to iron out a lot of the order so that we can have an organized Internet justice system...

More discussion at Counterpane

[Sheridan]

Bruce Schneier has more discussion of this in the latest Crypto-Gram issue, both in the main section and in the letters (including a letter from Tim Mullen).

There is a good justification in Mullen's letter as to why this proposal is different from the RIAA's proposed attacks on computers that they suspect of hosting unauthorised copyrighted material.

Re:More discussion at Counterpane

[JPawloski]

"Since the owner of a system has no responsibility for the actions of a worm, or any malicious process, that runs without their knowledge, I submit that they also have no rights to the process. No responsibility means no rights.

So, if they have no rights to the process, there is no infringement against them when we neutralize it. If someone wants to claim that their rights were violated by our taking out the attacking process, then they should be held accountable for the actions of the process from its inception. They can't have it both ways. "

That, I think, is a good point. The solution, however, is not to make the counterattack legal, thus continuing to absolve people of responsibility, but to make the owners of the systems legally responsible for their failure to secure their systems. If your system is 0wn3d and used to launch a DDoS attack on AOL (or Slashdot, Kuro5hin, whoever), then AOL should have the right to sue you for damages. Your incompetence caused their loss.

You say you can't afford to pay? Tough. Should have thought of that before you put your insecure system online. You say it's the fault of the manufacturer for selling the insecure system in the first place? Take them to court. Too expensive? Well, if their system is too expensive to use, then people won't use it.

Re:More discussion at Counterpane

[Cally]

SchneierZilla vs MegaMullen? No contest!

Re:More discussion at Counterpane

[Omicron]

His idea of responsibility is a good one - I definitely would have to agree with it. In any other realm, people are responsible for whatever they do. If someone is trespassing on my property and they trip and break their leg, I could indeed be held responsible for whatever was on my land that they tripped on. It's ridiculous. Why don't the same things apply here in the computing world? Why isn't the admin/owner of a system that is trying to attack me with a worm held responsible?

Yes, there is potential for abuse. Yes, I could just block their IP's. I'm not talking entirely about the ability to be able to kill the processes though - just the issue of responsibility. I feel that people should be held responsible for what they do. I administer my machines diligently - patches, virus updates, firewalls - to ensure that I don't spread the harm so to speak.

To me, it seems perfectly reasonable that people should be held responsible for the processes on their machines. Now, if the fact that they aren't held responsible allows me to kill that process, that is a whole 'nother debate.

Re:More discussion at Counterpane

[Anonymous Coward]

"I submit that they also have no rights to the process. No responsibility means no rights

Does the average (l)user know each and every process on their machines? Spooler32? What's that? MPREXE.EXE? NETFBASE.EXE? Huh?

Does this mean anyone can kill any of these prosesses 'because the user doesn't know about it'?

Re:More discussion at Counterpane

[Anonymous Coward]

If someone is trespassing on my property and they trip and break their leg, I could indeed be held responsible for whatever was on my land that they tripped on. It's ridiculous. Why don't the same things apply here in the computing world? Why isn't the admin/owner of a system that is trying to attack me with a worm held responsible?

you are responsbiel for the worm attacks coming from my computer and attacking your computer. why? because you made your computer available; you should have taken it down once my computer was infected. instead, you are causing my computer to send yours packets. since i am too obtuse to have realised that my machine was compromised, and you are smart enough to notice, then it is your responsibility to get out of my way.

Re:More discussion at Counterpane

[jdreed1024]

If your system is 0wn3d and used to launch a DDoS attack on AOL (or Slashdot, Kuro5hin, whoever), then AOL should have the right to sue you for damages. Your incompetence caused their loss.

You say you can't afford to pay? Tough. Should have thought of that before you put your insecure system online. You say it's the fault of the manufacturer for selling the insecure system in the first place?

Dude, I'm so glad you're not a lawmaker. Please tell me you're being sarcastic or cynical or something. Let me offer an analogy. I have some fertilizer locker in my garden shed. If someone breaks in, steals it, uses it to build a bomb, and blows up some people, am I responsible? No. No court in the world would convict me. I took reasonable precautions, but the unforseen happened. If I happen to drop some change in the street, and a wino finds it, and that gives him enough money to buy a bottle of booze, and that bottle of booze is one bottle too many and kills him, am I responsible? Of course not.

Now let me offer an example. Suppose I was running OpenBSD a while back. You know, that ueber-secure operating system. Suddenly, it's discovered that there's a remote hole in the default install for the first time ever. And, after the exploit is discovered, but before the patch is released, someone gets in to my system, and uses it to coordinate a DDoS attach on AOL. Am I responsible? Hell no - no patch was available yet.

All right, another example: Suppose I run Linux. I am subscribed to every single security mailing list. I audit my system by hand daily, and by a cron job every hour. I run as few services as possible (say, sshd, and that's it). I apply patches within in minutes of them coming out. Then, I decide to go to the Carribean for a few days for a much needed vacation. While I'm on vacation, with no Internet access, a hole is discovered in OpenSSH. My system is one of the first to be 0wnz0red, and I can't do anything about it. My system is then used as part of a DDoS attach on openbsd.org. Am I responsible because I decided to go on vacation? I hope not.

Even the most responsible of people can have their machines 0wnz0red by pure bad luck. It's called life. Shit happens. You deal with it, and move on. Yes, it's unfortunate. Yes, it's aggravating. But you fucking deal with it. You worry about your systems, and let me worry about mine. I have no problem if my ISP cuts off my service because there was a hole I hadn't patched. I deserve that, and they're protecting their customers. But to say that I'm responsible for anything done with my machine just because I happened to be asleep when a vulnerability was discovered is ridiculous.

Re:More discussion at Counterpane

[costas]

"Since the owner of a system has no responsibility for the actions of a worm [...]"

I disagree right there. The owner of the system does have responsibility for the instance of that worm: it uses his/her computing facilities, connectivity, etc, and it instantiated due to his/her negligence. Therefore another operator doesnot have the right, unpriviliged, to terminate that instance. Sad and inconvenient, but that's ethics :-)...

Re:More discussion at Counterpane

[Cyclometh]

While I may agree with some of this, I think it should be pointed out that securing your systems is not a binary operation; you can be a competent sysadmin and still get owned by the latest exploit if you didn't find out about it quickly enough. You can also get nailed by some obscure exploit that a duly diligent admin might not have known about.

You might also get nailed if you run an insecure application or allow users to run code on your system. My concern is that if you have a precedent like this, no one who can't afford an army of lawyers could afford to take the risk of being online, because the risk of getting sued into penury is too great.

Do we want to foster a system where only the very wealthy or highly-connected can afford to run a server on the Internet?

Re:More discussion at Counterpane

[zilly]

If someone breaks in, steals it, uses it to build a bomb, and blows up some people, am I responsible? No. No court in the world would convict me. I took reasonable precautions, but the unforseen happened.

That's fine. As long as you take reasonable precautions, obviously you should not be held liable if someone manages to break into your box and uses it to launch a DDoS. On the other hand, if you've got a machine on the Internet that, due to your egregious and repeated neglect, has more holes than a hobo's underpants, and someone uses it in at attack, then there need to be consequences for your irresponsible negligence.

Correct me if I'm wrong, but in some (U.S.) states it's illegal to store loaded guns, if you have any, in unlocked toolsheds, and with good reason if you ask me. Mightn't this be a better analogy?

While I'm on vacation, with no Internet access, a hole is discovered in OpenSSH. My system is one of the first to be 0wnz0red, and I can't do anything about it. My system is then used as part of a DDoS attach on openbsd.org. Am I responsible because I decided to go on vacation? I hope not.

Any proposed law would have to be enforced by the courts. The situation you describe is unlucky, I'll agree, but fortunately for you, judges and juries have brains. I believe it's called "discretion."

Good day. :-)

kk

Re:More discussion at Counterpane

[stanmann]

All right, another example: Suppose I run Linux. I am subscribed to every single security mailing list. I audit my system by hand daily, and by a cron job every hour. I run as few services as possible (say, sshd, and that's it). I apply patches within in minutes of them coming out. Then, I decide to go to the Carribean for a few days for a much needed vacation. While I'm on vacation, with no Internet access, a hole is discovered in OpenSSH. My system is one of the first to be 0wnz0red, and I can't do anything about it. My system is then used as part of a DDoS attach on openbsd.org. Am I responsible because I decided to go on vacation? I hope not.

Ok, either
1. Your computer needs to be connected to the internet while you are on vacation, and thusly you should have an always available administrator. OR,
2. You should have unplugged. esp since there are other scenarios, ie multiple lightning strikes, power surge, fan motor, etc.

Re:More discussion at Counterpane

[FurryFeet]

If your system is 0wn3d and used to launch a DDoS attack on AOL (or Slashdot, Kuro5hin, whoever), then AOL should have the right to sue you for damages. Your incompetence caused their loss.

Slashdot wouldn't be attacked, it would be among the attackers (and, in your scenario, defendants).
Really, a slashdotting should get them in hot water (at the very least, aiding and abetting) right) ;)

loss of business

[KDan]

The only problem with this strikeback thing is what if the machine which is infected is business-critical?

If you're going to take it on yourself to fix other people's machines, what if this causes them loss of business? And there's also varying definitions of what "strikeback" or "fixing" could mean. What if someone decides to "fix" your database server by shutting it down? Shouldn't they be held liable for the damages caused, just as someone who does that maliciously can be held liable?

There's just too many holes in this strikeback philosophy. It opens the door to tons of abuse too: "I only broke into this machine to fix it, I swear, gov'nor!"

I think it would also result in pretty dire situations when a machine equipped for strikeback mistakenly decides another machine (also strike-back-enabled) needs to be "fixed", and starts attempting to hack into it - and then the other one detects it as well, and they start concurrently trying to hack into each other... probably saturating the network with crap on the way...

Daniel

Re:loss of business

[theDEFT]

the key point is that the machine this guy is attempting to fix is attacking his network, possibly causing him loss of business...I don't necessarily agree with it, but to play devil's advocate, if the bully takes your lunch money every day, and no one will help you do anything about it, maybe it's time you popped him one.

Re:loss of business

[bpfinn]

This first thing I though of was if I was "Mr. Evil Hacker", I would attack company A's server with spoofed packets from company B. Then company A strikes back at company B. Company B responds, and there's your loop.

Re:loss of business

[Anonymous Coward]

Ah then by the same logic, the owner of infected systems should be liable for damage inflicted on other systems in other networks.

Re:loss of business

[tantech]

If it is indeed a business critical machine, then they should have secured it better in the first place. Imagine Microsoft's "Security Experts Team" neglected to secure their machines, which ended up bring down Apple.com, thus causing them to lose business. (Bill: Oops. Sorry Steve, I didn't mean it. Honest.) Or, Apple strikes back, killing the process, and Microsoft uses the "You caused me to lose business" excuse to sue Apple for millions in damages. (Bill: How dare you hack into my machines, Steve. You're going down! *evil grin*

Re:loss of business

[Anonymous Coward]

Excuse me for not agreeing with you on this one.
If the machine is business-critical it should have been secured properly in the first place. If the machine is compromised/owned/whatever (regardless of the fact that it had been secured or not) it is causing trouble to others by scanning and/or propagating the worm *and* to the clients of their business. Shutting down their database server would actually be beneficial to their clients. You would be glad if this (shutdown) would prevent you from entering your cc. into a compromised machine, don't you think?

Re:loss of business

[KDan]

Yes, they should be (within reason). There's a difference between making people liable for damages and promoting a vigilante-type "citizens take the law into their own hands" spirit.

Yes, if you recklessly cause loss of business, you should be liable for it.

Daniel

Re:loss of business

[Anonymous Coward]

If the machine in question is business-critical, how did it get infected in the first place? Rather than suing the person who shuts it down, the company with lost business should fire and sue the sysadmin who ignored recommended patches. Or the suit who told him to concentrate on that snazzy new project instead (which is more often the case).

Re:loss of business

[Sylver Dragon]

If it is indeed a business critical machine, then they should have secured it better in the first place.

That still begs the question about two very possible scenarios.
1. The vendor has not released a patch yet.
So, since I run progran XYZ on my server and it has a hole, but there is not a patch out for it yet, you can come in and shut down my business? Sorry to burst your bubble, but its not always (if ever) possible to have a 100% secure system (short of unplugging it and burying it in concrete).
2. A previously unknown vulerabilty is used.
Time to burst another bubble. No, you don't know everything. No matter how good you think you are, there will always be someone out there that is either lucky enough, or good enough to find a hole in your system.
I agree that in a perfect world, this would be a great solution, you would actually be doing the affected system's admin a favor. But this isn't a perfect world.
Consider for a moment the following idea. A hacker with some times on his hands sets up a script, which sends requests to your system, which look like Code Red or Nimda. Now, to add a bit of fun to this, he does some basic IP spoofing and makes the requests appear to come from another system entriely. And, to add to the fire, your system is only one of 100 that the requests are being sent to.
Now in the spirit of the strikeback idea you and 50 of the other admins attack the source of the requests. Oops, you went after the wrong IP, and just killed someone's online store, which had nothing to do with the attack. In short, its a kind of reverse DOS attack.
There's too many holes in this idea. for it to be truly workable. You'd end up with people forging logs to validate them killing a competitor's online store.

Fully support his idea

[itallushrt]

I fully agree with his idea of stopping an attacking process if the admin/owner of the machine is unwilling to do anything about it.

However, like anything else someone is going to push this to limit and abuse it.

Re:Malicious Processes in Windows?

[Anonymous Coward]

No no no, you have it all wrong! This proposition could see all Windows boxes out of action, as Windows is malicious code!

ISP can sorta do this

[EvilAlien]

At least they can act to contain the spread of a virus, but not by killing processes on customer PCs. they can, however, disable service, whether it be a cable, *dsl, or dialup modem account. Shutting off service and forcing customers to take measures to clean their infected computers is allows by the acceptable use, terms of service, and other policies which protect the ISPs rights to take action.

Re:ISP can sorta do this

[Dunkirk]

But they don't. That's one of the basic foundations of Mullen's whole argument. Furthermore, as someone who's running his own servers on a DSL connection - and therefore someone who keeps watch of blocked connection attempts - I know only too well how true his other point on this topic is: most of the time, you can't look up the IP address and find who's responsible for it. Furthermore, even when it's resolvable, only a fraction of those IP's will have an "abuse" email address to which to submit complaints. I use "psad" for watching these things. It makes it a lot easier to keep track of these events than the collection of scripts I had to munge the logs. I investigate real scans, and save all the emails in case (God forbid) I need them to help with a forensic investigation.

Re:ISP can sorta do this

[Anonymous Coward]

Pissing off your customers (by shutting down their internet connection) is not a good way of running a business. Sure, ISP's have the power, but do they really have the guts to use it?

Re:ISP can sorta do this

[zeugma-amp]

Every ISP needs an easy method for the submittal of zombie addresses. We could clean up all of our networks pretty quickly if we could just scan our logs for worm traffic and sumbit it to an ISP by email in an agreed upon structured format.

I wouldn't think it would be too terribly difficult for an ISP to have a process that checks the network traffic for the submitted addresses to verify that they are spewing and take appropriate measures.

When the lUsers call to complain that their connections are down, the ISP can inform them it was shut down for cause and that once their system is patched, they will be automatically turned back on as the ISP periodically re-checks blocked IPs.

Speaking specifically on the topic at hand, I'd have to say that I can understand the guy wanting to attack back. I'd like to have a script to physically shut down the zombie boxes after a certain threshold of attacks was reached. I'm still getting nimda/codered attacks on my boxes more than a year after there should be no excuse for this. At this point, anyone who gets infected by either of these programs needs to be just shut down by the attackees... I'd pretty much be willing to go so far as say that they deserve a quick fdisk as well. They've had plenty of time to protect themselves. It is equivalent to

The rights of the many and the few

[katre]

If parents don't vaccinate their children, the state takes them out of school. If a dog consistently attacks people, the authorities put it down. If someone commits three felonies, they are put away for life. This is because the rights of the many outweigh the rights of the one.

This is an interesting point, because it shows the essential flaw in this logic. In all of these examples, who is acting? "The authorities", namely, the government. In this absurb "strikeback" proposal, who is acting? Vigilante sysadmins. If anything, his examples prove that we need a national cybersecurity enforcement agency, which is responsible for taking machines offline when they get virus-infected. Clearly, this is a bad idea, and that's why strikeback will never work.

Re:The rights of the many and the few

[Anonymous Coward]

Do you use SPEWS? You have no right to talk about "vigilante sysadmins" if you do.

Re:The rights of the many and the few

[LostCluster]

Strikeback's just slightly misplaced. It's clear attacking computers need to be stopped, but it's much easier to have DCMA-style takedown process where legal notice is served on an ISP to takedown the offender, and filing a false report opens the false reporter to legal liability.

Re:The rights of the many and the few

[Anonymous Coward]

In all of these examples, who is acting? "The authorities", namely, the government.

Yes, in those cases, the government is "the authorities".

Why can't sysadmins be "the authorities" in these cases??

Re:The rights of the many and the few

[Rich0]

Do you use SPEWS? You have no right to talk about "vigilante sysadmins" if you do.

I think there is a difference between blocking access to your system by a renegade computer, and mounting an attack on a renegade computer.

Suppose the radio says some nut just escaped from the asylum down the street. Prudence dictates that you call your children inside and lock the door. Maybe you even grab your gun out of the closet just in case he breaks down your door. On the other hand, the solution to the problem isn't to form an armed possee with your neighbors and go out looking for the guy. Self-defense is just being prudent. And it is always prudent to use the minimal force necessary to do so. That might be a gun in the case of a nut breaking into your house - but sysadmins can just block traffic at the router.

SPEWS is a voluntary system which is passive in nature (communications from a suspicious site are blocked). It doesn't involve hacking into suspected spammer's computers and hosing their mail processes.

If admins want to develop a system for blacklisting suspected DNS zombies at the router level I'm all for that. If they want to actually hack into the zombie itself that is a problem. Keep in mind that the only act of wrongdoing by the owner of the zombie was probably to not apply the latest weekly security patch by Microsoft.

Re:The rights of the many and the few

[sean.m.bober]

If anything, his examples prove that we need a national cybersecurity enforcement agency, which is responsible for taking machines offline when they get virus-infected.

IMHO, the last thing that we need is ANOTHER government agency. Better yet, we do not need another government agency with the citizen granted authority to act like Big Brother. Personally, I would rather have some rogue sysadmin (who probably has some real world skills)messing with my system than some under qualified goverment suit. Hell, I would rather have somoe script kiddie messing with my system than Big Brother.

My 2 cents,

Sean

Re:The rights of the many and the few

[katre]

If you read my next sentence, you'll see I agree with you that this is a horrible idea. I was merely pointing out the logical conclusion from these types of arguments.

Re:The rights of the many and the few

[Sylver Dragon]

Why can't sysadmins be "the authorities" in these cases??

Acountability.
With the govenment authorities we have a few layers of oversight and control which makes the "the authorites" accountable to the people they serve.
The sysadmins would be acting completly without oversight, and it would be difficult to hold them accountable if thier actions cause unintended harm.
To use a comparitive analogy:
If a police officer is involved in a shooting, there is a set of rules he must follow, or he will be fired or jailed. For example, he's not allowed to shoot if there is a good chance he will injure an innocent bystander in the process. This is why its only in the movies that a police office will shoot at the car of a fleeing suspect on a crowded street. If an officer were to fire randomly like that and hit a bystander, the officer would end up in jail. Even if every shot misses, or he hits the suspect, he is likely to end up with a repremand. We can be fairly sure that a police office is going to be more responsible in the use of his weapon, due to training and oversight. Not to mention that there are even rules about the types of rounds an officer uses. Most of your police issue weapons are loaded with low velocity rounds, so as to prevent a bullet from passing through the target and hitting someone on the other side.
Now on the other end we have a private citizen. To begin with, there is no oversight. There is no group making sure that a private person is following the rules, or even keeping a list of who is performing these sorts of actions. Further, the private citizens don't have the training in how to handle these types of situations, and how to minimize incedental damage. And there is no control of what tools are given to the private citizen.
The sysadmins can't be "the authorities" in this case because there is no one looking over their sholder, making sure that they are doing things the way they are supposed to do them. This situation is likely to lead to lots of incendental damage to a system, or worse a wonton disreguard for the damage done to the attacking system, and any associated functions.

All your process are now belong to us...

[EvilTwinSkippy]

He send us the bomb!

Next you will be telling us that it's ok for government A to overthrow government B if it thinks B is destabilizing to it.

HHOS

Re:All your process are now belong to us...

[Golthar]

Doesn't the USA allready do this? ;)

Re:All your process are now belong to us...

[Anonymous Coward]

I was going to respond to that with a very witty rewording, but then the PATRIOT act caught my mind....

Re:All your process are now belong to us...

[Doc Hopper]

Next you will be telling us that it's ok for government A to overthrow government B if it thinks B is destabilizing to it.

It is OK for gov't A to overthrow gov't B if gov't B is doing things gov't A doesn't like. Humanity has been doing this since we were cave men drawing pictures on the walls. We're a bunch of kids in a world-sized sandbox, and the only referee is the one that can enforce his rules. Every so often, that balance of power shifts.

The question of whether it's ethical to make war is a personal one, but on a global scale, war is simply another tool for a government to enforce the collective wishes of their populace. We're all cogs in that machine, and large, wholesale change is only realized once people come to understand what impact their role plays in the overall scheme of things. Or once a sufficient number of the aggressors/defenders are dead so that they are no longer a threat.

Don't submit to authority if what you're doing feels wrong to you. Do that much, and I think you're halfway there to being an enlightened human being. I'm about a quarter of the way there, I'm cowed by authority way too much still. I'm trying to figure out what the other half of enlightenment is :)

(Oh, yeah, right, it's on the second head of my video card, dangit where'd I leave that monitor.)

The money quote

[wiredog]

Since the owner of a system has no responsibility for the actions of a worm, or any malicious process, that runs without their knowledge, I submit that they also have no rights to the process. No responsibility means no rights.

So, if they have no rights to the process, there is no infringement against them when we neutralize it. If someone wants to claim that their rights were violated by our taking out the attacking process, then they should be held accountable for the actions of the process from its inception. They can't have it both ways.

That, I think, is a good point. The solution, however, is not to make the counterattack legal, thus continuing to absolve people of responsibility, but to make the owners of the systems legally responsible for their failure to secure their systems. If your system is 0wn3d and used to launch a DDoS attack on AOL (or Slashdot, Kuro5hin, whoever), then AOL should have the right to sue you for damages. Your incompetence caused their loss.

You say you can't afford to pay? Tough. Should have thought of that before you put your insecure system online. You say it's the fault of the manufacturer for selling the insecure system in the first place? Take them to court. Too expensive? Well, if their system is too expensive to use, then people won't use it.

Re:The money quote

[EvilTwinSkippy]

Auto insurance is like that. My liability insurance covers whoever is harmed by my car, because ultimately I am the one who will be sued because my name is on the registration. At least in Pennsylvania, that also includes if some numbnuts steals my car.

Re:The money quote

[Anonymous Coward]

exactly. If I had mod points I'd mod this up.

I think there should be a legal requirement to make a "resonable" attempt at security - I don't think someone should be held responsible if a determined hacker gets in, but only if through their negligence, a year old script kiddie exploit breaks their unpatched machine.

Re:The money quote

[SlamMan]

Right. So you're going to sue somebody's grandmother because she got DSL to play scrabble online? Thats not going to get very far.

Re:The money quote

[larva]

If your system is 0wn3d and used to launch a DDoS attack on AOL (or Slashdot, Kuro5hin, whoever), then AOL should have the right to sue you for damages. Your incompetence caused their loss.

So, if i break into your car and smash through the window at a 7-11 thats _your_ responsibility right. That makes sense.

G

Re:The money quote

[Anonymous Coward]

Yes, I would. If someone knew that they could get sued for security negligence - they would:

1. learn enough about security so they could get online safely.

2. Insist on buying systems from vendors that were made secure - and by extension, get a guarantee from the manufacturer that it was.

3. Stay off the internet

4. Buy liability insurance?

I think what would happen, is many regular people would be scared off the internet. This would drive down computer sales. Not wanting to lose money, hardware and software vendors would be FORCED to make secure products... Fixing our problem. I believe the parent poster is correct.

Re:The money quote

[Tall Rob Mc]

I think you make a very good point, but I don't believe it follows the right course. The best way to attack a problem is at its root. As much as we would all like to have 100% of online computers running completely securely, we cannot expect such a large user base to do this.

If your car is stolen because you left it unlocked in a parking lot and used in a hit-and-run accident, the car owner should not be held responsible. Yes, it is his fault that he didn't lock his car, but it shouldn't be illegal for him to leave his car unlocked. The crime committed here was by the thief.

Likewise, if your computer is used in a DDoS attack on a commercial website, you should not be held responsible unless you intentionally left it vulnerable specifically for use in an attack. The insecure computer has done nothing wrong, the blame is in the hands of the person who used the computer for a malicious attack.

Blaming the owner of the insecure computer is simply cutting one head off of a hydra.

Re:The money quote

[Whispers_in_the_dark]

Sounds like a great scam to me. Here's how the dance could go:

1) Create a worm that will at some point perform a DDOS attack on my machine. Make sure it's nice and quiet so that it isn't detected until attack day.

2) Wait until my site is attacked by the worm. Whine and moan about the lack of security on the other machines.

3) Pick from among the richest "attackers" and sue their pants off...

(Oh yeah, ... profit!)

A friend of mine once said, "The only secure system is one that's not connected to the wall outlet." The hackers will always find something new to break into and everyone else will diligently (sometimes) try to stop them. The problem is that everyone's idea of diligence is different and someone with an itchy trigger finger killing off my processes at the drop of the hat isn't my idea of better security.

Plus, whatever means the security patrol uses to shutdown the offending processes will likely be exploitable in itself. If ssh is getting hacked then certainly this little back-door will too.

Re:The money quote

[ekephart]

Does this mean I can sue Microsoft everytime Outlook puts a virus on my computer or network? Or can I sue Sun when a bug compromises my system? I may be acting optimally to prevent things like this, but they can still happen. Who's responsible then?

If software makers can put disclaimers (no warranty, you can't sue me, etc.) then I should be able to do the same for my network.

Re:The money quote

[SlamMan]

But as we all know, security is a process. I just can't see your typical blue haried granny updating the firmware on her firewall because somebody found a flaw in it. I'd say it should be automated or something, but automated processes are just one more thing to hack.

Re:The money quote

[rnelsonee]

If your system is 0wn3d and used to launch a DDoS attack on AOL (or Slashdot, Kuro5hin, whoever), then AOL should have the right to sue you for damages. Your incompetence caused their loss.

I don't usually agrue against accountability, but this doens't make sense. What if I leave my house poorly locked (heck, even unlocked) when I leave for work, and someone breaks into it and then uses my house as a shelter as he starts sniping people in the streets. Should I be held accountable because he used my property to commit a crime? Heck no. The one commiting the crime is the one who should be punished. Same thing if someone steals my car and uses it to mow down some pedestrians. Under current law, I could be held accountable if the motorist was drinking, and I was aware of it, and I let him have the car on my own free will. And even then, I don't agree with the law.

Anywho, I just wanted to throw in my 2 cents. Failure to implement an adequate security system is an option, people. A stupid one 99% of the time, sure. And that's why network admins are (and should be) held accountable by their employers if they lose business due to the admin's negligence. But if another network gets DOS'd from that network, the victim should go after the perp, not the people the perp used along the way...

Re:The money quote

[Anonymous Coward]

Unfortunately accidents happen. It's nearly impossible to win a lawsuit for someone for incompetence unless they knew they were incompetent. How do you go about proving what's incompetent and what's not? Can you be !000% sure your own system is unhackable? have you audited the source of all your systems line by line? Have you checked the hardware for flaws? Did yopu look at the microprocessor VHDL code?

You can sue for negligence, but again, it'll be really tough to win unless you can prove they had some idea that their (in)action would result in financial loss to you.

Re:The money quote

[Anonymous Coward]

well maybe I'm a bit of an elitist, but if you don't know enough about security, maybe you shouldn't be on the internet. It's not like using the internet is nesscesary for maintaining life. We don't let people who can't drive on our roads, we have a minimumn requirement that you must have the ability to safely operate your vehicle.

I'm not suggesting liscensing for the internet - but people need to be responsible for actions. (or lack thereof)

Re:The money quote

[Animaether]

So basically you're putting liability with a victim ?

[Gross exaggeration warning]

A woman (worm-target) gets mugged by a young punk (script kiddie). Although she resisted with her bare hands (default security), he could easily overpower her (she's been infected by the worm).

She goes to the police station, reports the incident, and the police spends time, officers, money on the case (worm's cost to 3rd party.)

But, according to your description, rather than the police baring the cost and the young punk paying punitive damages/going to jail, the woman will have to bear all costs of the police department.

Reason ? She could've bought mace or a gun (better security) to defend herself more securely with.

Then you argue - "can't afford to pay ? Tough. Should have thought of that before you" ... walk out on the street ?
Not even a dark alleyway - but plain broad daylight just as any vulnerable computer could be attacked, doesn't always need to be Outlook (dark alleyway)

The (legal) liability should lie with the script kiddies/crackers, not with those who fall victim to them.

Re:The money quote

[sckienle]

Ah, but an ISP could.

Just because having your own firewall is the "best" solution, doesn't mean that it has to be in your own home. The ISP could, and probably does, provide a firewall at their end. The ISP could require a software firewall to provide intra-ISP coverage.

Let's also not forget that many OS vendors, including MS and Linux ones, provide an automated upgrade process, or could. This means that the OS providers can help the "blue haired granny" keep their system's security up to date automatically. Of course, the manufacturer would need to accept the burden of providing effective patches in a timely fashion, and the monetary responsibility to do so.

The solution becomes more complex when you realize that all software will need to have this "security update" built into them. Here is where I think the OSS world has a huge advantage. They could, if they were willing to truly get behind this, provide a single package update location for all OSS packages. I know there are a handful of them now, but there really should only be one location.

Oh, and this may actually get the software world to the point that digitally signing and verifying code is common place. I don't believe in Palladium or any other DRM use of this, but I would really appreciate it if everyone signed their binaries and code so I can be assured that it hasn't been changed. Today we do that by only accepting code by going to the developer's website. This isn't a problem, of course, but it hinders the one-location-for-all update process.

So the process could happen, even for the non-computer literate. As the prior post suggests, though, there really isn't any business reason required to do this. It really won't be cheap, in either money terms or just development time.

Re:The money quote

[Anonymous Coward]

So, if i break into your car and smash through the window at a 7-11 thats _your_ responsibility right.

It is if you then drive that car around and run someone over because you couldn't see them through the broken windshield.

If your system is not secure, you shouldn't be using it. It's that simple.

Re:The money quote

[Anonymous Coward]

If your car is stolen because you left it unlocked in a parking lot and used in a hit-and-run accident, the car owner should not be held responsible. Yes, it is his fault that he didn't lock his car, but it shouldn't be illegal for him to leave his car unlocked. The crime committed here was by the thief.

Yes, it should be illegal to leave your car unlocked. Everyone has the ability to lock their cars, and locking it increases security by a certain amount. Car owners should be obligated to make a "best attempt" at securing their cars, just like computer owners should make a best attempt at securing their systems.

If people are negligent, and their negligence results in damages, they should be responsible for (at least part of) those damages.

Re:The money quote

[Tom]

If your car is stolen because you left it unlocked in a parking lot and used in a hit-and-run accident, the car owner should not be held responsible. Yes, it is his fault that he didn't lock his car, but it shouldn't be illegal for him to leave his car unlocked. The crime committed here was by the thief.

But Mullen isn't talking about the thief - he's talking about the guy with the pickup who rams your car during the hit-and-run, stopping the crime and catching the thief.

Did that guy commit a crime? Would you have a claim against him for the damage he did?

Re:The money quote

[Anonymous Coward]

Let me give a counter-example:

Someone buys a car, and lets it fall into disrepair because they can't afford to keep it in working order (network owner doesn't patch their systems to match the latest security threats). Yet they still drive it (network owner still puts the system on the internet). At some point, the engine fails in the middle of the highway and as a direct result they hit another car (attack causes damages). Now, according to you that owner of the car shouldn't be required to keep their car in working order, and shouldn't be responsible when a failure of their car leads to damages to a third party. Somehow that doesn't sound right to me.

I agree you shouldn't be required to make your system unhackable, just that you should make a reasonable attempt at securing it. Just like you have to make a reasonable attempt at keeping your car in working order.

Re:The money quote

[Xugumad]

I maintain a small number of servers, for a research project. All of these run the minimum of services for our purposes, have their own firewalls (in addition to the main organisational firewall), and once I apply the new packages for RHSA-2003:001, they will be up to date with all available patches.

This does not mean that they are unhackable. While it may be unlikely that someone will write a worm that uses a previously unknown bug, it could happen. By what you're saying, I'd still be liable. Should I have checked every single line of code my box runs?

As much as it may frustrate people when they get DDOS by wormed systems, this is not the solution. Better arrangements for having ISPs disconnect wormed systems, in my opinion, is the solution.

Re:The money quote

[tsg]

If your car is stolen because you left it unlocked in a parking lot and used in a hit-and-run accident, the car owner should not be held responsible. Yes, it is his fault that he didn't lock his car, but it shouldn't be illegal for him to leave his car unlocked. The crime committed here was by the thief.

Likewise, if your computer is used in a DDoS attack on a commercial website, you should not be held responsible unless you intentionally left it vulnerable specifically for use in an attack. The insecure computer has done nothing wrong, the blame is in the hands of the person who used the computer for a malicious attack.

Just to pick a nit, the difference is that, in the case of a DDOS attack, once the owner of the system becomes aware of the problem, he has the power, and therefore the responsibility, to correct it. If someone allows his system to continue attacking someone elses, even if he didn't cause the problem, he should be held responsible.

Once the car is stolen, the car is no longer under the owner's control. Once the system is compromised, the sysadmin can still control it, even if it means pulling the plug.

That said, I still don't think it gives the victim of an attack the right to go in and muck about in someone else's machine.

Re:The money quote

[ChristTrekker]

I completely agree. Blame the person who is committing the crime, not innocent bystanders who, through unrelated (in)action, created conditions that made the crime possible. However, the trend in the legal system today is to blame the bystanders.

For example, it's already happening with guns - if you don't lock up your gun and someone steals it from you to use it in a crime, you are liable. (Would it be the same if they stole a steak knife instead of a gun?) If you made or sold the gun that was used in a crime, you could be held liable. (Would Ginsu be liable also?) Etc. It's like a cartoon I once saw where a lawyer was saying to the man in the witness box, "So it's true! You are the farmer who grew the corn that was bought by the distillery to be made into the alcohol that was shipped by the distributor to the bar who served it to my client, which caused him to get into an accident while driving home drunk!" It's utterly ridiculous. What's next? Do we convict the grandparents of the actual criminal since they "contributed" to the conditions (the criminal's very existence) that made the crime possible?

Leaving your computer unsecured is not a crime. It's stupid, but stupidity is not a crime. You may take defensive actions under agreed terms, such as denying service to the infected party, as someone mentioned in the ISP example.

Re:The money quote

[Rich0]

My liability insurance covers whoever is harmed by my car, because ultimately I am the one who will be sued because my name is on the registration.

Trust me - if somebody is run over by your car and it is because the steering wheel popped off due to a manufacturer's defect nobody is going to bother suing you - they'd go after the manufacturer. First, a jury is going to be sympathetic to you - you didn't do anything wrong. Second, why go after somebody's $100k liability coverage when you can go after a major automaker with a billion dollars in the bank?

There are better solutions to the zombie problem than suing every grandma who dials into the Internet.

Maybe a suit against an ISP for not requiring users to secure their systems would be a better approach. In my opinion the ISP is probably more culpable because:

1. They have technical knowledge and would be expected to actually appreciate the problem of zombie machines (unlike grandma).

2. If they filtered bogus IP source addresses at their routers victims of DDOS attacks wouldn't have half the headaches they do in blocking them.

3. They could easily run a vulnerability scanner on all their users once a month while they're online and require users to address problems. This could even be automated (user gets email with list of security vulnerabilities and URLS for associated patches).

None of these steps would cost that much money. #3 would cost a little, but some private company would probably step in to fill the void with an inexpensive software product that automates the process. ISPs who don't do #2 deserve to get in trouble for it. It takes one line in a router config table and saves everyone on the net a lot of trouble.

Re:The money quote

[Garin]

Are you SERIOUS? It's my fault if someone else breaks into my computer? Holy cow is that ever ridiculous. How about if we made it YOUR fault if someone breaks into your house whie you're away on holidays, breaks a gas line or something, and then the house explodes and devastates the neighbourhood? After all, why didn't you secure your home?

Yes, you have to secure your computer. But it's really no different at -all- from securing your home. Security is never going to be perfect, and now you're saying that unless their security is perfect, they're responsible? Remember, folks, that security is NEVER perfect, and that there will always be a possibility of a break-in. So, then, it's always possible that anyone's computer will be rooted. Thus, you have zero chance of ever being completely safe from being sued from these damages.

Sorry, but that's ridiculous.

Re:The money quote

[Shalda]

Since the owner of a system has no responsibility for the actions of a worm, or any malicious process, that runs without their knowledge, I submit that they also have no rights to the process. No responsibility means no rights.

So, if they have no rights to the process, there is no infringement against them when we neutralize it. If someone wants to claim that their rights were violated by our taking out the attacking process, then they should be held accountable for the actions of the process from its inception. They can't have it both ways.

That, actually, is quite wrong. In English common law, there is a concept called an "Attractive Nusiance." Meaning that if you hook up a system to the Internet and fail to take reasonable precautions to secure that system, it is reasonable and likely to expect the system will be compromised and you can be held accountable for damages caused once you are "owned". The pickle here is that in most cases it's far too difficult to prove resonable precautions were/weren't taken. There's a wide gulf between incompetence and negligance. But let the lawyers figure that one out. A good lawsuit, win or lose, will scare the amatures into learning how to protect their systems.

On the other hand, if you deliberately hack-back then you've gone and comitted a criminal act, and you can be held liable for any incidental damages. And that's an open and shut case.

Re:The money quote

[mashx]

"We don't let people who can't drive on our roads, we have a minimumn requirement that you must have the ability to safely operate your vehicle"

They might have to take a test, but it doesn't mean that they are good drivers, wherever they drive. Those same people might be able to recite the Highway Code: doesn't mean they understand the idea of 'thinking ahead'.

How are people ever going to learn unless they are educated? Would you stop a five year old from going in a library because he can't read well enough?

Re:The money quote

[sqlrob]

So, if i break into your car and smash through the window at a 7-11 thats _your_ responsibility right. That makes sense.

If you opened the unlocked car door, yes.

Re:The money quote

[Rich0]

Yes, it should be illegal to leave your car unlocked.

Keep in mind that until fairly recently folks used to sleep at night with their doors unlocked. The use of locks is indicitive of the problem - crime - not a solution to the problem. Ideally nobody should even have to think about security.

The police should go after the crackers who commit DDOS crimes. If you start catching script kiddies and publicising their sentences, the rest will fall in line. Sure, it won't stop hardened criminals, but neither will just downloading the latest MS security patch.

Re:The money quote

[Otto]

Uh huh. And yet Nimda continues to spread.

What about those boxes that are essentially never updated? These are the *vast* majority of machines on the network, causing all the problems and eating all the bandwidth.

It's fine and great that you keep your box patched and up to date, but at some point, failure to do so should be considered negligent. You put a box on the network, don't keep it up to date, eventually it gets rooted, and starts attacking everyone else. Everyone else is justifiably pissed off at you now for not taking care of your own shit.

Either they need to have a legal recourse for your negligence, in order to force you to stop being so negligent, or they need to have a legal means of self defense. You won't fix your box, they should be able to.

The key is not is this right or not, it most certainly is right. The key is where is the line drawn? How up to date with patches and fixes should be required to keep it? Exactly at what point does stupidity become negligence?

Re:The money quote

[Anonymous Coward]

A friend of mine once said, "The only secure system is one that's not connected to the wall outlet."

Oh, he's talking about Windows systems.

Re:The money quote

[Tall Rob Mc]

You make a good point. The hard question posed here is whether such vigilante actions are legal (or even obligatory).

I was simply replying to the comments of the first poster where he claimed that the owners of compromised computers should be held liable for the actions of the intruder. I disagree with that.

I have not yet put a lot of thought into the harder question, and thus I haven't even formed an opinion on it yet.

Re:The money quote

[Desert Raven]

Second, why go after somebody's $100k liability coverage when you can go after a major automaker with a billion dollars in the bank?

Um, you've never been involved in a situation like this, have you? They most certainly will go for both of you.

First, no lawyer is going to leave so much as a penny behind as long as he gets a percentage of it. Second, they'll get your insurance money a lot faster than a settlement from the manufacturer, making you an attractive target for the short-term, while they go for the manufacturer in the long-term.

Re:The money quote

[Anonymous Coward]

This isn't a question of blame, however. It's a question of reasonable counter-response to an attack in progress. Are you saying that the victim of the hit-and-run (to use your metaphor) attack using the unsecured car is not entitled to protect himself?

I don't know about you, but if someone drives a car straight at me at high speed, I'll either dodge (if possible) or fire bullets into the windshield until the driver modifes his behaviour.

So yes, the car will be damaged. Tough.

Re:The money quote

[Reziac]

Not only that, but blaming the insecure computer (or its owner/admin) doesn't take into account those cases where a new exploit has just been discovered and for which no patch yet exists. What happens then -- attack Sun or M$ or Apache or whoever wrote the code with the hole in it?? That may sound just dandy to some, but wait til it's some independent programmer who wrote the insecure code, or a GPL'd program that's passed thru many hands during its lifetime. I can see such a chain of logic being used to sue independent coders entirely out of business.

Re:The money quote

[demented]

I maintain a small number of servers, for a research project. All of these run the minimum of services for our purposes, have their own firewalls (in addition to the main organisational firewall), and once I apply the new packages for RHSA-2003:001, they will be up to date with all available patches.

This does not mean that they are unhackable. While it may be unlikely that someone will write a worm that uses a previously unknown bug, it could happen. By what you're saying, I'd still be liable. Should I have checked every single line of code my box runs?

In the case you presented, you should not be held responsible.

IMHO, several parties can be held responsible for the machine that is misbehaving on the network and endangering other systems:

• first of all, the attacker --- he must always be held responsible because he (or she) has instigated the attack in the first place!
• the owner of the compromised system --- the owner can be held responsible if he didn't applied all the reasonable measures to prevent the attack. This means tight security policy and applying all the security bugfixes and patches issued by the vendor. The owner cannot be responsible for security breaches on his system caused by exploiting previously unknown bugs (or bugs that have not been fixed by the vendor or some third party).
• the vendor of the software containing the bug that has been exploited --- vendor can be held responsible if the offending bug in its software has been publically uncovered some reasonable time before the attack happened (publically means that someone has posted an information regarding the bug in question on some publically accessable mean of information (mailing list, website, etc.)). The reasonable time must be defined in such a way that the vendor has enough time to fix the bug and issue the security patch, or to publically proclaims that the bug cannot be fixed. However, the vendor cannot be held responsible if it publically posted the security patch for the incriminated bug.

Disconnecting the misbehaving system by the owner's ISP should also be taken seriously and incorporated in the service agreements between ISPs and their clients.

Too stupid to think the sig.

Re:The money quote

[frankie]

"The only secure system is one that's not connected to the wall outlet."

With so many laptops on 802.11 these days, that old saw isn't wide enough any more.

Re:The money quote

[Animaether]

I was thinking about the car analogy myself when I wrote my piece...

Here's the problem, though...

If you don't keep maintenance on your car, it will slowly but surely deteriorate with normal use.. doesn't need you driving it over rough terrain, or parking it in salty water.. it'll deteriorate, whether you like it or not.

So the accident there is indeed caused by your own inactions.

My computer, however, will be very unlikely to deteriorate on its own - if I take a default Windows95 install with internet, and put it online, it should be able to stick around for years (assuming constant power supply, internet connection, etc.)

So whether I patch it or not... my computer isn't about to start attacking others' computers.
IF it ever deteriorates, it would most likely catch fire first ;)

But if somebody attacks my computer with a worm, or cracks into it and uses it to attack other people, then that's something entirely different.

To put it back to the car analogy...
Say you keep your car running around on the highway just fine... sunny afternoon, blabla.. normal operating parameters.

But then some joker decides it would be fun to put tyre-piercing nails on the highway.
You run the car over the nails, and blam.. you hit somebody else.

Are you then responsible for the accident ? No...
Who is ? The person who put the nails on the highway.

You could say "well, You should've bought thicker tyres - you didn't, so we'll hold you responsible" - but I hope you'll agree that's rather insane.

So perhaps what it boils down to is to keep system maintenance up to a certain level, as you mentioned. And I'll agree with that.

But what is that certain level ?
Are we just to accept that "hey, there's nasty script kiddies out there... That's an accepted annoyance in life, and thus I have to protect myself ?"

Of course I'm not saying that people shouldn't protect their machines... but I think it's a sad state of collective minds if everybody feels we should just put up with script kiddies, rather than find out who they are, and put the responsibility with them.

This has already happened with homes (we all need locks nowadays to keep bad guys out, or we won't get any insurance) - but this doesn't particularly -have- to happen with the internet.

Just my view :)

Re:The money quote

[PCGod]

There are laws on the books in which the owner of an object is held accountable for crimes committed using those objects. The one I specifically in mind is the one in which the the owner of a firearm is responsable if others gain access to it. Suppose for a moment I have two kids in my house. One of them picks up a gun, points it at his friend in play, assumes it is unloaded, and pulls the trigger. There has been more than one case in California in which the owner of the gun was put in jail. There is precident for criminal negligance laws.

Re:The money quote

[Darth_Burrito]

How many of these people know their systems have been compromised? How many of the people in charge of these systems are even sys admins?

Re:The money quote

[tsg]

How many of these people know their systems have been compromised?

Not knowing what your system is doing doesn't relieve you of the responsibility for it anymore than not knowing your four-year-old is making random phone calls relieves you of having to pay the phone bill.

How many of the people in charge of these systems are even sys admins?

By definition, all of them. If they are in charge of the systems, they are the system administrators, regardless of if it's someone who is responsible for 100 servers or Aunt Tilly with her "email machine". Whether or not they are competent system administrators is a different question but it doesn't matter. Incompetence doesn't relieve you of the responsibility for what your system is doing any more than being a bad driver relieves you of the responsibility for the accident you caused.

Re:The money quote

[Darth_Burrito]

If they are in charge of the systems, they are the system administrators, regardless of if it's someone who is responsible for 100 servers or Aunt Tilly with her "email machine".

Aunt Tilly will never be a competent system administrator. You can spend $10,000 a person training everyone in the world about computer security, spend 60 trillion dollars, and Aunt Tilly will still not be a competent system administrator. Why even pursue this line of thought?

Incompetence doesn't relieve you of the responsibility for what your system is doing any more than being a bad driver relieves you of the responsibility for the accident you caused.

Bad analogy. You can be an expert and still be rooted and have your computer used in an attack. The complexity of software is such that one person often can't even understand the complete functionality of a single program. Anyway's in your analogy you are the one driving, when your computer is taken over and used in an attack, you are not the one in control. It's more like if someone steals my car using a flaw in the locking/starting mechanism then runs over a cop. Except that's not a good analogy either because often with a computer you have no obvious evidence that your machine is compromised.

Re:The money quote

[tsg]

Aunt Tilly will never be a competent system administrator. You can spend $10,000 a person training everyone in the world about computer security, spend 60 trillion dollars, and Aunt Tilly will still not be a competent system administrator. Why even pursue this line of thought?

The line of thought is not that everyone who owns a computer should be a fully trained system administrator, only that the person who owns the computer should be responsible for what it does.

You can be an expert and still be rooted and have your computer used in an attack.

Yes, but it would still be my responsibility to clean up the mess or turn the machine off until I can get someone who can.

Anyway's in your analogy you are the one driving, when your computer is taken over and used in an attack, you are not the one in control.

The owner of the machine should still be in control, even if he has to turn it off to get it to stop doing what someone else caused it to be doing.

Except that's not a good analogy either because often with a computer you have no obvious evidence that your machine is compromised.

There are dozens of situations in real life where ignorance of the problem doesn't relieve you of the responsibility for it. Now, I am not suggesting that every person whose computer gets compromised be held financially responsible for every lost packet on the internet, but the owner of the compromised machine is still responsible for correcting the problem. Regardless of how it got that way, it's still their machine causing the problem. They need to fix it.

Re:The money quote

[Darth_Burrito]

The owner of the machine should still be in control

How? A computer can be in many states where the only real absolute control a system admin has is pulling the plug. And when you pull a plug you need a reason to do it. What if you aren't aware of one?

There are dozens of situations in real life where ignorance of the problem doesn't relieve you of the responsibility for it.

But there are an infinite number of situations in real life where ignorance of a problem does prevent you from being held responsible for it. Let's say I'm driving down the freeway and my car's wheels simultaneously fall off due to an unpublished design flaw in a headlight which somehow causes a piston to misfire which somehow causes the rear and front axels to break in half. I crash causing a fifteen car pile up that claims 30 lives. The conditions that lead up to this accident were evident in my car had I possessed the expertise and vigilence to identify them. In a very esoteric sense I am responsible for the accident, but in a practical sense I can not be held responsible.

Practically speaking, what needs to be done before we can hold Aunt Tillie responsible for the security of her PC? We can't afford to train all the Aunt Tille's of the world. Even if we could, the black hats would be ahead of that training anyway. We might be able to hold them responsible after they have been duly informed of the problem, but simply trying to explain these things to Aunt Tillie can be an extraordinarily daunting task. We could attempt to explain it and send her a patch, but if my Aunt Tillie received an email she didn't understand with instructions to run some executible and she actually did run it, I would have to spend the next several days beating her with a baseball bat.

Re:The money quote

[tsg]

A computer can be in many states where the only real absolute control a system admin has is pulling the plug.

That's still control. And it's the ultimate control. There isn't a damned thing a remote cracker can do to your system if it's turned off or the network wire is cut or the modem is turned off.

And when you pull a plug you need a reason to do it.

Well, obviously. I'm not asking anyone to take action on a problem they don't know exists. What I am asking is that they exercise what the law calls "due diligence", meaning that they take reasonable care to prevent problems from happening and respond promptly when they do. If they don't do these things, they should be held responsible.

Practically speaking, what needs to be done before we can hold Aunt Tillie responsible for the security of her PC?

Who should be responsible for her PC? Me? You? It's her machine, she bought it, she turned it on, she uses it, she can turn it off if something goes wrong.

Bad idea...

[LostCluster]

It's next to impossible to determine what defines an attack or not... and I don't want people other than me shutting down my webserver thank you very much.

Wouldn't it be nice if there were programs that could automatically determine what's a worm or virus, and then attack the process from within the machine? No need for an outside user, just have the system kill its own rogue process as soon as it starts. Oh, it does exist. It's called Anti-Virus...

Re:Bad idea...

[jafiwam]

The article clearly states that only the process running the worm is shut down. Though there is a reboot to replace the process, the web server, web services and anything else you might be running would come up when the machine comes back up.

Schneier calls this "vigilantism"

[tbmaddux]

In his Dec 15th Cryptogram Bruce Schneier provides his argument against counter-attack, and there are some interesting reader responses to this in today's issue.

Hell no

[Reality Master 101]

I think this guy lives in the world of theory, where everything works "in theory".

I don't want some idiot out in the world thinking he knows more about my system than I do going in and thinking he's doing everyone a favor -- when he's actually doing damage to my system. Intentions don't mean a crock of dog doo.

If my system is spewing garbage, then it should be the right of the ISP to pull the plug until I get it fixed. That's the way these things should work.

But there's no way I want fools poking into my computer, no matter what.

Re:Hell no

[LostCluster]

Nah, he works in "the real world" and is upset that the "theory" guys haven't adopted this idea, which would make life oh, so easy for him. What he forgets is that rogue machines are not going to honor "stop the attack" requests, as by definiton they are not playing nice with the rest of the world. Furthermore, how is he going to feel when it's his machines feeling a strikeback... and who or what will decide if a strikeback is fair or unfair? This is what happens when people start pushing theories without thinking about the other people's viewpoints.

Re:Hell no

[Tom]

Your idea is a good alternative. Probably the better one. However, it won't happen, because it requires worldwide cooperation. There are good graphics on dshield.org about the spread of Code Red. Even if every IIS server in the US would have been unplugged within an hour, it wouldn't have made much of a difference.

Re:Hell no

[Darth_Burrito]

That's exactly what I was thinking. On the other hand, as someone writing a program designed to disable attacks on infected machines, there's no way in hell I want to assume liability for any damages my program causes to infected systems. Even if another company wrote the thing, I'd still be worried about the liability of simply executing it against attackers.

Re:Hell no

[juhaz]

You've already got some fools AUTOMATED WORM poking in your computer, if you are too stupid or too lazy to fix it yourself, then by all means, other fools are welcome to try to do it for you.

I wouldn't mind if they, in doing so, "accidentally" formatted your drives. Might teach a lesson.

Trying to close open windows

[EkiM in De]

I read this the other day when it was posted on "The Register" and I didn't like it then and I don't like it now.
Why?

Well it all boils down to an attempt to legitimise hacking. If it was allowed that we could "strikeback" ( which is just a cute word for hack ) and disable the attacking process, then where do we draw the line. I think we can all agree on the extremes, but lets consider another example.

What if a website was posted on slashdot, would all of the rampaging geeks be classed as attacking processes and therefore be liable to be struckback and eliminated. I am certain that the website administrator would consider the massive increase in traffic to be an "attack" as their poor server disappears in smoke.

Personally if you are likely to be attacked get better security. You can't enter somebody's house just to close an open window.

Re:Trying to close open windows

[Croaker]

Hmm... I smell an interesting scam here. Under strikeback rules, I could legally hack. Let's say I go out and create a virus or a worm that is designed to intentionally go out and attack one of my own sites, then anonomously release it into the wild. Why would I do this? Because then, I'd have legal authority to hack any infected system. And, while I was in there fixing things, perhaps some interesting and useful data could turn up.

Re:Trying to close open windows

[krinsh]

"You can't enter somebody's house just to close an open window." EXACTLY. So, what happens when you enter someone's house to close that window? You've entered without their permission; without their supervision, etc. If they blow your head off with their home security device because you have entered their home; then they have not violated any law themselves because *you* have broken laws yourself by violating their personal property. Law Enforcement, privacy, court-granted warrants - these are in place to prevent a vicious cycle that something like this would cause.

cheese, the friendly worm

[greechneb]

Ok, I found it. The one I was thinking of was Cheese, the friendly worm

Read about it here, including a nice set of pros and cons here

Two idependent issues

[vaidhy]

There are two independent issues:One is a ethical issue. Is it morally right to attack (it is attacking, irrespective of defensive or offensive reasons) somebody else's machine?

The second one is a legal issue. Does the attacked person(both sides) has any legal recourse? Do they have any credible claims for damage?

Vigilante justice, at best is stupid and at worst, can lead to a more dangerous society than one without.

Re:Two idependent issues

[phil reed]

Is it morally right to attack (it is attacking, irrespective of defensive or offensive reasons) somebody else's machine?Depends. Is it in self-defense?

Vigilante justice, at best is stupid and at worst, can lead to a more dangerous society than one without.

True. But you are allowed to shoot somebody who attacks you in your own home. You're not allowed to chase them away and hunt them down later. That's the difference between self-defense and vigilante justice.

Re:Two idependent issues

[Sloppy]

Is it morally right to attack .. somebody else's machine?

I think this is similar to the question, "Is it morally right to deadly force against another human being?" At first kneejerk impulse, the obvious answer is "No, of course not!" But then you'll probably realize the real answer is, "It depends." If someone shoots at you, most people think you're justified in shooting back.

But if we're willing to concede that it depends, when talking about killing people, then why not also concede it in situations where the stakes are much lower? If I can kill a person who is attacking me, why can't I attack a computer that is attacking mine?

Errant Machines

[Anonymous Coward]

What we have here is no accountability and no responsibility. A ship's Master (Captian) is responsible and accountable for the ship in his charge and the actions of his crew. The owners, or administrators should also be responsible and accountable for the machines network in their charge. Hold them to account for their malicous machines - otherwise the problem will just get worse. Who then determines a malicious process on my network? The RIAA and other large political contributors? Remember, in the U.S. at least, money controls everything. Those with it get what they want and those without it suffer.

well...

[bonovoxpsu]

if you're that "good" and can kill a process on someone else's network, how about you use that excellent knowledge and contact the owner of the machine?

hacking (don't paint it any other way, you're breaking into someone's system) someone else's machine is not the answer. the system is not any more secure after you've killed it's process, it is still wormed, and the most important thing is that the admin of that machine hasn't learned a thing!

but then what do i know, i'm not a security expert...

Re:well...

[jandrese]

The other question nobody is asking is: What happens when you contact the remote admin and they do nothing, or they reinstall the machine and leave it wide open for the same vulnerabilities. Worse, what do you do when their ISP doesn't seem to care that DDOS attacks are being launched from their network? Worse, what do you do when neither of you speak the same language?

This is the "real world" the author was talking about.

no trespassing!

[Anonymous Hack]

I'm sure some people could draw a vague parallel with protecting your home using lethal force here... but i don't buy it. I certainly believe if a hacker is inside your system you have every right to st0mp his ass out of there by whatever means necessary, but if your neighbor is coming round ten times a day knocking on your door you call the cops and get a restraining order taken out - you don't go over there and shoot him.

I don't think it's ever right to trespass, whether it's for the "common good" or not. If it's not yours, stay clear. If a worm is hammering your system, call the offending ISP. If they don't reply call their upstream provider. If they don't reply call your ISP and tell them to block it before it gets to you. If they don't reply - tough shit, get a new ISP. It's the same thing as the spam blacklists - ISPs will never learn to provide better service if people don't start voting with their wallets.

Re:no trespassing!

[Rick.C]

The severity of the response must be appropriate for the severity of the attack.

If your neighbor is merely annoying you by knocking in your door, you only have the right to call the police.

If he is punching you in the face, you have the right to punch back, but not to shoot him.

If he has a gun, knife or other lethal weapon, you have the right to shoot him.

So translate this into degrees of severity and/or urgency of a system attack and maybe we can come up with some appropriate responses. Maybe notifying an attacker's ISP and waiting several hours or days is OK for a "nuisance" attack, but not for an attack that keeps taking down your mission-critical system.

Rick.C

I've done it before.

[GoNINzo]

I had a botnet using my irc server as their jumping off point. I wasn't too happy with it cause I saw an attack happen. So I went through and removed them all. I wrote up the story here if anyone wants to know how to take down a subseven network.

People don't like this

[Branc0]

Having runned a small defacement archive for the past year, one thing I learned is that people don't like you mess with their computers. In fact they don't even want to know that you know they have a problem. I once found a portuguese .gov site that was defaced for over a month in a sub-directory, even if i warned them just few days after it happened.

I also find out that what people think is "if you know someone hacked into my server, then it must have been you that hacked my server". And this brings up the next point, if you start hacking people's computers to stop the worms, they are going to think that it was you who unleashed the worm, it is logical, they just don't know better.

What must happen is not System Administrators "hacking" every computer in the internet infected by code red or nimbda. What must happen is legislation that makes every person running a computer personably responsible for the security of that same computer. If people don't secure their server they must be penalized, instead of letting us fix the problem... even if they want us to.

Re:People don't like this

[mccalli]

What must happen is legislation that makes every person running a computer personably responsible for the security of that same computer.

And in which country would that legislation be enacted?

I prefer the idea of handling with ISP peering agreements, in a similar fashion to how spam is handled today. Too many virus requests from an ISP's IP range results in that ISP being refused backbone peering rights.

Cheers,
Ian

Re:People don't like this

[Anonymous Coward]

"if you know someone hacked into my server, then it must have been you that hacked my server"

And after that, it gets even better! You have dolts who somehow had your address in their LookOut! Address Book (or possibly cached from IE) sending out SirCam and other viruses like mad.

When you tell them about it, even taking the time to grab URLs detailing the virus(es) and cleaning methods from, say, CERT, they go nuts and insist you've send them viruses.

Oy. *sigh*

Now, as for securing computers and legislation, it'll never happen for desktops. People see them as appliances, and there's no regulation detailing the number of breadcrumbs your toaster can contain. :p

Not to mention the blow it would be to Dell/etc. and Microsoft. If people are afraid to use their computers because they're going to get fined when they're infected, manufacturers lose out. Microsoft loses as well, as they'd undoubtedly have to spend money to make their operating systems sufficiently secure or face legal action.

Hell, even if they did make their systems sufficiently secure, they'd still probably face legal action. Remember, kids, Joe Q. Public doesn't give a damn about monopolies, but he does care when he receives fines in the mail because his computer's been asking people for their advice!!!!! :p

Servers, I could see that happening, but what constitutes a server? Technical definitions can be warped (If I ping a Win 9X box, it responds! It's a ping server!). Can't go by connection speed, or we'll never see broadband covering the entire country.

Re:People don't like this

[swordgeek]

I was with you right up until the point where you talk about legislation and licensing. This is, a Bad Idea, in my mind.

First of all, legislation is country-specific, and because we're talking about network attacks, that's a fairly pointless endeavor.

Secondly, computers aren't guns! Computers aren't even cars! They're household appliances. You can start a fire with a toaster oven that takes out an entire row of condos, but nobody legislates that you have to clean your toaster oven every 30 hours of use. Making the software manufacturers more responsible might help, but I'm not convinced that that's a valid solution either.

Ultimately, the systems that really NEED security, and the people that really WANT security will get it--and maintain it against attacks from the attack-of-the-day.

Re:People don't like this

[Anonymous Coward]

Actually you mean Nimda.
It's Admin spelled backwards.

Just correcting the spelling for two reasons.
First, so you can find it when you search the virus encyclopedias.
Second, lot's of admins don't how to spell or pronounce it. (But those admins probably aren't smart enough to read Slashdot anyhow.)

(I really despise Nimda. It's not even a well made program. It's just a duct-taped together octopus of already done ideas.)

Re:People don't like this

[Anonymous Coward]

Legislation isn't the answer. That's like saying you're responsible if someone steals your car and gets into a high-speed chase with the cops. If a gun is stolen and used to kill someone, the owener of the gun is not charged with murder. (They may be charged with a minor crime, but a failure to secure a computer is not the same as failure to secure a deadly weapon.)

Blocking the offending computer (a la ORBS) is the only workable solution.

Re:Deja vu

[nmg196]

How is this a repeat? I can't find any article like this on slashdot.

Post the link to the previous thread if you're going to state it's a repeat... That way people can actually find more relevant content if they want to...

Nick...

So everybody gets to do this?

[telstar]

This guy wants to give the power to kill remote processes to everybody. Everybody includes the people that he's saying can't secure their systems to begin with. Do you want them touching your box? Didn't think so.

Re:So everybody gets to do this?

[Tom]

Guess what, the incompetent won't be able to, even if they had the right.

There's something called self-defense in virtually every law on the planet. It usually reads something like: "You are allowed to stop or prevent an illegal assault on you or someone else by using any means necessary and adequate."
Key points:
- the assault must be illegal
- if it is, you have the right to stop or prevent it (no need to wait until you've been killed, you know)
- the means must be reasonable, i.e. you can't kill someone because he grabbed your butt. However, if someone tries to kill you, then killing him first is acceptable.

The strikeback idea was developed against Code Red infections. It uses the same attack vector that Code Red uses. That leaves you with two options:

a) Code Red is not an illegal assault. In that case, neither is my counterattack, since it uses the same method
b) Code Red is an illegal assault. In that case, using the same means to stop it is entirely within my rights.

I have strikeback code running on my webserver. If you can't defend your machine from a 2 year old worm, then you don't belong on the Internet.

Re:So everybody gets to do this?

[telstar]

"Guess what, the incompetent won't be able to, even if they had the right."

• You don't think somebody would write a one-button clickable script-kiddie tool to do this? Yes, they
• would be able to do this.

Re:So everybody gets to do this?

[Tom]

You're right. They could do it to each other. I'm happy with that. :-)

Yes, and

[Anonymous Coward]

We should also have the right to spank other people's children if they misbehave in public.

moron killing troll's processIEs...

[Anonymous Coward]

buy using the pateNTdead PostBlock(tm, va lairIE et AL) device.

va.msn.?net? forget about it.

don't bet yOUR .asp on the frauduleNT stock markup "bull" again today J., as everything they're peddling, has been given to US, buy those freedom fighters over at hobbyistwhiners.org.

over at va.FUDge.controll, we call 'em freedumb fairIEs. they're all on yOUR foems list buy default.

Could this fall under Good Samaritan protection?

[Jesterr]

Standard Disclaimer: IANAL

Could fixing someone else's critically broken system fall under this? Especially if instead of fixing, you break it worse?

Counter attack is dangerous

[funkman]

How do you get counter attack software and whose to say that software is safe?

What if the counterattack software has its own buffer overflow? Then we get a cat and mouse game of one machine simulating an attack and when the counter attack is made the attacker could send a response to force a buffer overflow making the counter attack ... the attack itself.

cyberpunk

[fallen1]

Is this the beginning of (or maybe the continual evolution towards) Intrusion Countermeasures Electronics - aka ICE as proposed by Gibson and others? Not to mention this idea would fall under a reactive ICE that would sense the attack and not only deny it access to your system but actively seek it out and shut down the attack (what could be called Black ICE). IMHO this is the future arms race.

Re:cyberpunk

[SScorpio]

Thanks for bringing back all the funny and sometimes disturbing memories of battles in Shadow Run with my wacked out GM.

If ICE is now here when can I get a jack implanted in my head.

Harboring Processes

[Anonymous Coward]

We won't differentiate between malicious processes and the computers that harbor them

Whose rights??

[Ratface]

If parents don't vaccinate their children, the state takes them out of school. If a dog consistently attacks people, the authorities put it down. If someone commits three felonies, they are put away for life. This is because the rights of the many outweigh the rights of the one.

In your country perhaps, but where I live not all of those suppositions are true. And here one sees an inherent problem that such a system would create - you may be operating within the legal framework of (for instance) the US, but does that give you the rights to close down a process on a machine in Iraq, or North Korea, or any other country for that mattter?

Re:Whose rights??

[TrueJim]

Indeed, one of the fundamental underpinnings of any democratic society is that the rights of the many do NOT outweight the rights of the one. A person's rights are not predicated on the number of people with common interests. For example, I still have a right to free speech even if what I'm saying is something that nobody else wants to hear. I can congregate, worship (or not), read whatever I like, or put up tacky holiday ornaments over the protest of all my neighbors even though any of these or a thousand other activities may infringe on rights they percieve as their own -- and the number of neighbors is irrelevant. The democratic principle of "majority rule" does not imply that "majority rights" outweigh the rights of individuals...no matter religious fundamentalists (or Tim Mullen) claim. One of the great things about democracy is that the rights of an individual are precisely equal in weight to the rights of a legion.

Re:Whose rights??

[Herkum01]

you may be operating within the legal framework of (for instance) the US, but does that give you the rights to close down a process on a machine in Iraq, or North Korea, or any other country for that mattter?

Only if your name is George Bush

Simple fix

[BoomerSooner]

block that IP in your firewall.

I'm constantly getting hit from taiwan and SE Asia so I block the whole class C if it gets worse I go up from there. Seems to solve 99% of my problems.

Re:Simple fix

[bernywork]

The only problem with this, and it was in the article, is that it wastes bandwidth. For some people with low speed links, virus attacks can take out their whole link. Blocking it at the router is no use, and it still has to get to their router in the first place for it to be dropped. The bandwidth damage is already done.

Re:Simple fix

[Tom]

Seems to solve 99% of my problems

Yours, yes. Lots of people, and almost all companies, pay for their internet access, often by traffic. Blocking the crap at the firewall doesn't take care of that problem. In many cases, it makes it worse (due to retries).

Re:Simple fix

[Arjuna Theban]

Once you start doing that, eventually you get to a point where you don't block certain IP's but you start only allowing certain ones. And that's where the fun begins.. When I'm on a machine not explicitly allowed through my home firewall I sometimes have to hop through 2-3 machines to get to a machine that my home network knows and allows.

Then there is the fact that not most networks don't have the freedom to go to a whitelist from a blacklist.

*utopian vision* a world without script kiddies *utopian vision*

Re:Simple fix

[nullard]

block that IP in your firewall.

I do this already. A better system would be to have software on the sending machine that scans all outgoing traffic and auto-blocks it and notifies the admin. It won't remove the worm, but it will stop it from spreading.

Flawed logic

[StormReaver]

"Logic dictates that anyone who opposes a bill allowing corporate entities to attack our systems should support a technique to stop worm-ridden systems from doing the same."

This is flawed logic. The correct logic flows like so: Anyone who opposes a bill allowing corporate entities to attack our systems should oppose any technique that allows any other organization or individual to do the same.

Mr. Mullen's proposal is almost identical to the proposal made by the RIAA: let someone legally crack into a computer that is being used to do inconvenient things.

While I sympathize with Mr. Mullen's intent, this approach was wrong when suggested by the RIAA and it is wrong when suggested by Mr. Mullen.

Unfortunately, the best approach I can suggest that both contains the problem (eventually) and protects everyone's privacy to the largest possible extent is to isolate the offending computer from the rest of the Internet (possibly shutting down the user's outgoing Internet feed) until that user fixes the problematic system.

Of course, the details are the killer. How is something like this accomplished quickly enough to minimize the damage done to systems receiving the barrage of data? And does a Slashdotting result in Slashdot's Internet feed being cut?

This type of problem definitely needs a solution, but vigilante attacks are not the solution.

Re:Flawed logic

[AnotherBlackHat]

This type of problem definitely needs a solution, but vigilante attacks are not the solution.

One man's "vigilante" is another man's "concerned citizen".

When a store detective handcuffs a suspected shoplifter that's not the same as shooting one,
but in both cases the detective is a "vigilante".

The issue isn't one of who is doing it, but what they are doing, and is that an appropriate response?

I might accept strikeback as a reasonable response to a worm attack, but only after you've tried and failed to get the owner of the attacking system to stop the worm. And even then, the strikeback would need to be limited to the minimum amount needed to prevent the worm from attacking. Formatting the attackers hard drive is unacceptable. (handcuffs, not bullets.)

It would be a lot better if there was a proper procedure for isolating an attacker, but right now there isn't.

-- this is not a .sig

This is net vigilante-ism at the worst.

[fudgefactor7]

Mullen has been stoned since day one. This wacked out idea is just another bit of proof of that.

The real problem.

[jellomizer]

Becideds the blaten privicy issues etc. Lets assume computer A is attacking computer B with Worm1 which uses uses application X as its transport. The person who sees the worm attack his system he imeadeatly thinks it is work2 which uses application Y as its transport. So he gaines access of computer A and kills application Y. So he hasent killed the worm and he also killed an inocent application that may have been dooing something very important.
It is stupid to think a random person will be able to properly fix your system. Even if he is "Skilled" enough to break in he may not undertand what the system is for or what it is used for. Just because he thinks he is smart it dosent nessarly mean he is.

was Mullen dropped on his head as a child?

[MrJerryNormandinSir]

You can't kill a remote process on a host you do not have access to. What is this guy a newbie?

Ahhh but you can, block by ip address / port number.
You can filter this out.
You can kill processes on your own host that
are connected to a remote socket.

Re:was Mullen dropped on his head as a child?

[tweek]

have you not read anything?

He is proposing using a strikeback system that exploits the remote hosts' vulnerability (the same one that allowed it to become infected in the first place) to render the attacker dead.

So yes, Virginia, you can kill a remote process. it was started remotely in the first place.

the courts

[DrSkwid]

they would decide over time a set of precedents just like for defending oneself from physical attack.

If you slap me I can't just shoot you, but if you stab me: you'd better be ready.

strikeback

[ic3scrap3r]

Initially this seemed to be a good idea. I am rather aggressive in defense of my business and home networks. However, the potential for abuse is quite strong. Now a hacker could quietly infect your network, and then under the pretense of striking back, make further intrustions. This would provide a legal grey area that I don't want when it comes to penetration of my network.

hubris...

[vurtigo]

Is it just me, or does Mr. Mullen's email address:

• Tim Mullen <Thor@HammerofGod.com>

make you think "insightful security professional" or 1/2(swaggering red neck cop + 31334 haxor dooood)?

Passive Strikeback

[The Famous Brett Wat]

I've often longed for a good "passive strikeback" tool. Every time I look at the tons of IIS-worm-crud in my Apache logs, or see spammers scanning for open proxies/relays, I yearn for such a tool.

By "passive strikeback", I mean a tool that does nothing more than respond to an active attacker in such a way that it turns the tables. I assume that most worms and spammer-tools are as poorly written as the buffer overruns and other assorted security holes they exploit. That being so, I would love some respectable white-hats to write open source tools which target weaknesses in the offending malware, so that when said malware comes a-knocking at my server, I might gently rip out its intestines and strangle it with its own entrails.

I'll settle for strikeback tools that do nothing more than neutralise the malware, although I'd be sorely tempted to do more in the case of spammer tools. Sending the malware into a flat spin, hang, or deadlock may be preferable to simple termination in many cases.

This guy's logic just doesn't make sense...

[telstar]

"Since the owner of a system has no responsibility for the actions of a worm, or any malicious process, that runs without their knowledge, I submit that they also have no rights to the process. No responsibility means no rights."

• How does he make the leap from the system owner having no rights, to somebody ELSE having rights to that process. He's claiming that HE should have rights, yet by his logic ... the only person that really should have a right to kill the process is the person that is responsible for its existence or the person that initiated the worm. That means that the only person that should have that right is either the worm writer, or the person that launched the process. In many cases, this actually IS the user, since they executed a piece of malicious code on their system.

"If parents don't vaccinate their children, the state takes them out of school. If a dog consistently attacks people, the authorities put it down. If someone commits three felonies, they are put away for life. This is because the rights of the many outweigh the rights of the one."

• He fails to mention what the punishment is for electronic system intrusion. Whether his motives are nobile or not, laws regarding kids and dogs have absolutely no bearing on laws addressing electronic worms.

Re:This guy's logic just doesn't make sense...

[Anonymous Coward]

the only person that really should have a right to kill the process is the person that is responsible for its existence

Hey! New scam!

1) Write virus and allow it to spread.

2) Sue anti-virus software companies when their software kills my virus.

3) Profit!

Re:This guy's logic just doesn't make sense...

[Anonymous Coward]

In Soviet Russia, Worm Profits from You!

Timing is Everything

[AppHack]

So much of the decision as to what constitutes "relentlessly attacking your network" comes down to timing. I see probes and scans hit my network 24x7. Most of the time, I just shake my head at the futility. I figure this is similar to spam, try enough times and you'll find someone who'll buy or in this case does not have proper security. A week or so ago, I had an important task I was trying to do while I was being scanned hard. I had just a couple of minutes to finish the task before leaving and the scan was eating up bandwidth to the extent that it was eating up part of my two minutes. This had an impact on my ability to perform my task. Does that mean I was "relentlessly attacked"? Even though most of the time I would only find it annoying and not give it much attention? I hope not. I'm not sure I'm the best person to make those decisions, and I certainly don't trust the rest of you. :-)

His picture!

[Anonymous Coward]

What a moron. Look at his picture! This must be a moron. And then his ideas! It would give basically anybody a pretense for wrecking havoc under the guise of "protection"! Amazing. What a moron. And that picture!

Security people are idiots...

[duffbeer703]

The same holier-than-thou attitude that exists in Police and Intelligence services towards the public exists in the so-called security professional community.

Let's say my next-door neighbor and I live in a old neighborhood with big trees. If my neighbors tree has a disease that is affecting my tree, I do not have the right to trespass on my neighbors property and chop down or treat his tree.

The interests of security do not give someone the right to trespass on my property without due process. If Mr. Mullen wants to get some sort of court order, fine, but he does not have the right to screw with other people's computers for some perceived security problem.

If Tim Mullen can be identified hacking into any computer I am responsible for, he will be arrested and sued for computer crimes. Whether he is wearing a "white" hat or a "black" hat is irrelevant.

homeland security

[burninginside]

didnt the homeland security acts make it a terrorist act to hack? so if you get caught hacking a machine, although it's attacking your network, you're screwed.....

well...

[Meeble]

someone should just tell him not to worry so much....... the internet is just a fad anyway.

You should not have the right

[Anonymous Coward]

That's a job for law enforcement, isnt it?

If somebody robs you, you dont have the right to break into his home and beat him up etc.

You are allowed to defend your "person" if you are being attacked, and you have the right to protect your property. But, I dont think you have the right to exert revenge.

The reason for this is simple, you are not the judge & jury to know whether the worm that's attacking you was placed there deliberately by the system owner. Unless there's a pressing safety issue, by attacking his system you may be causing unjust damage to it. It goes back to vigilantism, and why that's illegal.

you sue me : I sue GNU

[DrSkwid]

who's competence is at stake did you say?

I'm sorry but my brain comes with a EULA :

This brain is supplied "as is" without warranty of any kind, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose and the accuracy of the information contained within it

Gray Areas

[JSkills]

Is the use of "strikeback" ever warranted - this is a difficult topic to render a definitive decision on.

Having been the victim of the effects of Code Red (our Linux boxes we not affected, but the hosting facility we were in was overwhelmed with traffic from all of it's unpatched IIS servers), I can certainly see the reason as to why this software was developed. Our site was inaccessible for close to half a day, because of other people's inability to keep security at the forefront of their minds. We were powerless to do anthing but wait for our hosting providers to track down all of the offending servers at our location and fix them.

I remember being so angry at the time and I would have welcomed the scenario where a "strikeback" type of application would have put a stop to this problem in an automated fashion. I'm sure part of the creator's reasoning is that if people's systems are left vulnerable to various worms, then there should be no problem allowing his software to "fix" the problem. Perhaps an applicable anaolgy would be a fire spreading from house to house on your block and "strikeback" acting as the firemen putting a stop to it. Firemen often make a huge mess of buildings when putting out fires (cutting through walls and roofs, dousing everything with water, etc), but the ends justify the means.

On the other hand, the "strikeback" process could almost be considered like a vigilante mob, having the best of intentions, but essentially operating outside the bounds of the law. Secretly, we might root for them, but in essence we really need the police to do the job, thereby obviating the need for the vigilante mob.

In regards to the world of crimes committed against servers, I just don't who the actual police are. So many of these attacks happen without anyone being punished. The FBI has a policy of not even spending any time investigating any computer crimes where the damages cannot be proven to exceed US $20,000. That leaves a great deal of smaller businesses / websites essentially unprotected by anything except for their own ability to manage their security efficently.

Strikeback is just a reaction to the frustration of having to deal with all of these continuously spawning worms / attacks without anything being done to counteract them other that react after the carnage is already done. I'm not saying it's the right solution, but I certain can see why it is here ...

Re:Gray Areas

[duffbeer703]

If there is to be any retaliatory action it should be performed by the offenders ISP or hosting provider, and noted in their contract.

This whole notion of "strikeback" is the dream of some security lunatic who is serverely lacking in the clue department.

My body my choice...

[Anonymous Coward]

...my process my choice??

That works both ways...

[lynx_user_abroad]

That works both ways, and as such, goes the wrong direction.

The author proposes support for the concept of "no right without responsibility", a noble gesture at least. But that also means "no responsibility without right". He inadvertently offers me (as a malicious hacker) absolute indemnity from responsibility simply by abdicating my rights to the process. This would, for example, allow me to SPAM with impunity, and if anyone ever called me on it, I could just say "well, it's not my process, go ahead and kill it if you want to..."

How does an assaulted system owner know if the remote assult is coming from unauthorized worm-spawn or from an approved process actively trying to assault a remote system?

Wouldn't it be better to hold system owners responsible for the actions their system takes, with the presumption that any activity a host undertakes is either actively authorized or passively authorized through complicity?

My personal opinion, which I don't expect to carry much weight: I accept full responsibility for any action my system undertakes. You will never catch one of my systems granting a request to act as the base for a remote attack. If you do, you are welcome to ask my system to kill the process, and since I accept all responsibility for any actions my system undertakes, you can assume that my machine would not grant your request to kill the process unless it had my authorization to do so.

Incorrect and a solution already exists.

[juuri]

This is just a guy out looking for kicks and fun. If someone is "probing/attacking" your network thanks to a worm and you can't contact them, the solution is simple:

You simply block off their traffic.

Close your blinds, your door, or whatever real world analogy you would like to try and apply. You have the right to send the same traffic back to them, monkeyseemonkeydo, but in no way is it possible to justify altering the running of their machine. Doing so, is no better than the malicious process already causing the damage.

Re:Incorrect and a solution already exists.

[Tom]

You didn't read the article, did you? Maybe you should. He addressed your point, and made short work of it.

Re:Incorrect and a solution already exists.

[juuri]

It is a valid solution.

His "short work" is as flawed as his initial logic.

i do this every day

[painehope]

for i in $(ps -eaf |egrep cc awk '{print $2}' ) ; do
kill -9 $i
done

Re:i do this every day

[Anonymous Coward]

Im sure you do ;-)

At least it causes a brainstorm of sorts

[MoThugz]

Well when I read the article the first time around, I was quite amazed than someone came up with such a nonsensical idea. However, I reread the article just for good measure.

The idea proposed was actually quite intruiging... it's like an analytical discussion of forward-defense of networked computer systems. Which, I finally conclude as worthy of further discussion.

Many sysadmins fail to patch their machines not mainly due to ignorance, but failing to keep abreast of the latest security news. This is where the proposed idea could actually come in handy.

A minor modification of this idea that would benefit most people would be if somehow a signed permission can be generated when a remote patch is to occur. The admin of the machine could request contact info of the fixer as well as logging the IP address and other important info.

To tell you the truth I'd rather computers under my administration be patched this way rather than defaced with shoutouts and then getting the fix via email or written on the defaced page itself.

If you really want to help...

[s88]

First secure your own machine (which seems to be the primary concern for wanting to allow something like this)... Then, send the infected machine a note with instructions on how they can fix the problem.

Just because my car makes a funny klunking noise, doesn't mean I want Joe Mechanic sticking his head under my head when I'm in the grocery store.

Scott

Yes

[wiredog]

It would mean you could sue them. You can sue makers of any other type of product if it turns out that product is defective, why not software manufacturers?

Not only viruses consume bandwidth

[wilhelm9]

One of the major arguments mr Mullen has for striking back is that the virus attackas are eating his bandwith. Bandwidth is something most people can use more of.

BUT!

When I browse my tcpdumps it is evident to me that it is not only viruses that consume my precious bandwidth. These figures aren't scientific but I would guess that 40% of the attacks on my system is through netbios (I suspect these are most often real virus attacks) and another 40% are "attacks" from various distributed file-sharing services. Most commonly used port appears to be 4662.

Now I am fucking mad about that these file-sharing-kiddies are using my bandwidth to locate other file-sharing-islands. Time to strike back...! :-)

It's not a personal right...

[rvcx]

Mullen tries to draw a few parallels:

"If parents don't vaccinate their children, the state takes them out of school. If a dog consistently attacks people, the authorities put it down. If someone commits three felonies, they are put away for life."

These are all good examples, and it's worth pointing out that in *none* of these cases does the "victim" get any special rights. One student can't kick another out of school even if the other hasn't been vaccinated. Someone who has been bitten by a dog does not have the right to shoot the dog. If a repeat offender steals your car stereo, you have no right to lock him in your basement for the rest of his life. The government-- both executive and judicial branches, each with many oversight systems in place-- is the *only* entity with a right to do any of these things.

Why should computer worms be any different?

It shoudln't be any different than "real" world

[batkiwi]

If someone eggs my house, I can't shoot out their tires to keep them from coming back. I report them to the police, and it's taken care of from there.

OR, if I'm in a gated neighborhood, they install a guard, and only allow residents and invited guests in.

Either you contact authorities, or you get your ISP to block the traffic (and if your ISP won't, it's time for a new one). Vigilante justice never works out in the long run.

Re:It shoudln't be any different than "real" world

[fuzzybunny]

"can't" is such a strong word, young jedi.

Corollary 1: Depending on where you live, some forms of self-defence are not necessarily as frowned upon as they are in other places. Cops telling people who catch an inept burglar or mugger that "it might take us a while to arrive, and people have been known to break legs while running away" do exist.

On the other hand, all this assumes a degree of common sense that most people who'd practice this sort of vigilante pre-emptive strike/defense/retribution can't necessarily be assumed to possess...

Corollary 2: A swift beating is sometimes the best lesson. Why do so many sysadmins have hammers, pliers, and baseball bats in their offices? To fix servers? Hm?

Corollary 3: Bitch-slapping a script kiddie in another continent does have a certain je-ne-sais-quoi to it.

Not that I'd ever advocate anything like that, of course. Hm.

Re:It shoudln't be any different than "real" world

[swordgeek]

Regardless of your points and his, you're both missing an important point. This article wasn't about the ones deliberately attacking you, it's the ones who through negligence or laziness are letting their machines be used.

In the 'shooting out the tires' scenario, it would be a stolen car used. Where's the justice in that?

Re:It shoudln't be any different than "real" world

[fuzzybunny]

Good point, well spotted, I missed that.

But, taking this ad absurdum, what if an out-of-control airliner threatens to drop on a major city? Are you allowed to shoot it down?

I can draw a (very vague) parallel between that, and a server farm full of zombie IIS taking out the nuclear power plant control computer or something equally silly.

Arthur Haley, eat your heart out.

Do not kill.. warn

[gmuslera]

let the remote user to do this. But warn him that he is vulnerable or have that worm or have the potential to became infected, and give some hints on how be secure with his actual configuration (is very easy to say "use linux" :)

In the codered times, there was perl/php/etc scripts to put a note in remote user desktop that warns about being infected. Also there are scripts that sends a message to the IP block owner to warn his user or take appropiate measures.

What about vulnerabilities? Killing worms is not so different to the idea of killing vulnerabilities that make that worms succeed. Think in the thousands of clueless Windows users that share his hard drive and connect to the net, beign vulnerable to a lot of worms that spread thru open shares. Probably there are several scripts that put a note in the remote desktop (like the codered warner did before) if the user is vulnerable, but is a bad idea to use this vulnerability to close the share, install a firewall or delete his C drive until he learns.

Analogy

[Anonymous Coward]

I'm sorry but if I am playing loud music at 1:00 in the morning, even if this is against the law, if you break into my house to turn the music off, you _will_ be charged with break and enter.

The appropriate course of action would be to complain to an upstream provider, not to hack into their systems.

Re:Analogy

[martinmcc]

Heres a better analogy: You see someone walking around with a disease, do you have the right to treat this disease, thus protecting yourself? I know what I would do (i.e. tell him to go see a doctor, and keep my distance).

I certainly wouldn't want every man and his dog attacking my machine because they decide it is up to anti-social behaiviour (who defines what a 'worm' is?). It is up to the Network administrator to sort out his on problems, and if he doesn't it is up to his upstream provider to cut him off, not some internet 'bounty hunter' looking to earn kudos.

Re:Analogy

[nmg196]

That *isn't* a better analogy though. If you don't like the man with the disease, you can walk past him. You don't have to let him persistantly spit in your mouth 6 times a day or rape you, while you just stand back and take it (the equivalent of a worm trying to infect your system using known vulnerabilities).

These viruses are attempting to infiltrate your systems *maliciously*. The unfortunate sick man from your analogy is just minding his own business and trying to survive. He's probably already seen a doctor, because it's *HIS* problem, not yours.

It doesn't matter if it has been defined as a worm or not - you have the right to protect yourself or your own property from theft/damage/rape/disease by a 3rd party and use reasonable force to do so (in the UK anyway).

Nick...

Re:Analogy

[martinmcc]

The analogy still stands - I can walk away from the disiesed guy, which will affect the width I can travel. If I feel he is maliciously folowing me a report him to the authorities (Police). A worm attacks me so I block that machine at my firewall, so only my bandwidth is affected, and if I feel they are maliciously attacking me, a report him to the authorities (ISP).

Re:Analogy

[nmg196]

This is getting a little silly, but the diseased guy knows where you live and is standing in your doorway with an infected needle. Are you really going let him keep stabbing you with it, even if you know you are immune to his disease?

I get your point and respect your opinion but I think I would still want to prevent someone from using up my DSL line to try and hurt my machine and if the guy upstairs left his tap on, I'd have no guilt over turning it off.

Nick...

Re:Analogy

[martinmcc]

Yeah, there are always limits to any analogy - Certainly if I couldn't take resonable action to avoid him I would them try to stop him by any means possible (the least destructive that worked). This would be action to save my own life. And on the network side, if my machine was being beaten by a rogue machine, and no defences measures where working, and I felt that the machine was critical enough, I would take action against it (whether it is take out the process or take out the whole machine, again the least destructive that worked). Its all just a matter of justification and how weighing up the individual circumstances, which is pretty much how it happends at the minute, with a mandate or not. If there was a announcement that granted specific permission to defend yourself from disiese carriers, you'll find rampent mobs out looking for the nearest lepers, likewise on the 'net.

Re:Analogy

[Alsee]

This is getting a little silly...

but the diseased guy has been geneticly engineered by Dr. Evil and he used his bloodhound nose to track you to your home. He also pterodactyl wings sprouting out of his head and he's hovering outside your bedroom window with a metaphasic subspace infection ray. Are you really going let him keep shooting you with it, even if you know you are immune to his disease because you're a vampire from galactic cluster M-31?

chuckle :)

-

Re:Analogy

[TekPolitik]

A guy in the apartment above you has left his door unlocked and then gone away. A malicous child walks in and turns the tap on for a laugh and then leaves. A while later the apartment is flooded and water is pouring though the ceiling into your property. Do you have the right to walk in though his unlocked door and turn off the tap?

This is easily answered - the answer is unequivocally "yes". This would be clearly within the right of abatement, and no action would lie against you for anything. Even if he'd left the door locked and left the tap on himself, you could bust down the door to turn off the tap (although you'd have to then take steps to make sure he was not more vulnerable to burlary as a result).

Opens You To Claims of Damage, Liability

[reallocate]

Questions:

1. How would you protect yourself from damage claims coming from the owner of the attacking machine?

2. Who will determine that the process running on that other machine is, beyond doubt, malicous code? Can you make that call independent of others? If so, see the first question.

Crazy people everywhere!

[SignalFreq]

The sad part is that some people actual think this is a good idea.

What part of strikeback is going to prevent the offending system from being re-infected and attacking you again?

My two cents:

If you THINK a system is attacking you, then you report it to your ISP. Your ISP does it's job and contacts the "attacker's" ISP, who then checks to see if the offending box is violating the terms of service. If so, the system should be removed from the network and the owner properly notified.

If the issue doesn't get resolved to your satisfaction, then you SUE your ISP for not holding up their end of the contract to provide you with the bandwidth and service that you paid for.

You will probably lose because your own terms of service provide no guarantee on bandwidth or service. So now you complain to the BBB and switch to a new ISP.

Tim Mullen obviously has no clue. Let us draw an analogy with the public phone system.

Your telephone constantly gets calls from one particular number. All hours of the day and night. What do you do (other than turn off the ringer)? You call the phone company and report the problem. The phone company resolves the issue.

-SignalFreq

My Friend's Strikeback

[jfsather]

Back in the Nimda/CodeRed days, a friend of mine was getting really sick of all the hits on his Apache server. He wrote a program to parse the log every few hours and then use the information to connect back to the attacker. He didn't do anything like stopping the process, but he did upload an app that would notify the user of what was wrong with their system and how to fix it. I think he managed to deliver the message to over a hundred machines on his first try.

This also shows the problem with these strike back programs--sure you can stop the process, but you only provided a temporary fix. I like my friend's version better in that you at least let the user know what they need to do to clean things up. After he started doing this the attacks on his cable modem subnet dropped to almost zero.

Nimda

[CmdrWass]

Back when I first set up my webserver, I was getting hundreds of hits from nimda a day... I've built up quite a blacklist over the past several months.

When I first set up my server, I was interested in this virus as it was cluttering up my logs. Of course I was running apache, so I was immune, but nonetheless it was annoying.

So I used a few of the URL requests and reverted them back to the calling host just to see what would happen. I was amazed at how easy it was to get into their box. So after about two trials, I stopped, didn't want to get into trouble, but I was discussing this with collegues and fellow sys-admins. Based on my reasearch (two attempts reflected back on the attacking host) I determined it would be VERY VERY easy to write a little program that monitored my apache log, as soon as it saw a nimda hit, it would automatically attack the calling machine, only with the intent of irradicating the nimda virus on that machine.

(ok, so now that I've built up this story)...

So anyway, I chickened out... even though they were attacking me, I was afraid of the rammifications that might come back onto me if I were to "cleanse" these attacking machines.

My point is that this concept has some merit. I think we should consider whether or not this should be an allowable practice. And what would the penalty be for wrongly "cleansing" a computer?

I donno, this is becoming too complicated and it is too early in the morning. Forget I suggested it.

Hackback

[watchful.babbler]

So, to summarize, the author thinks that we should have the right to assault others' systems on suspicion of compromise. Mullen's presentation notes describe a process in which an automated hackback system uses Nimda vulnerabilities to attack a system, "escalates [its shell] process privileges," and sets up an IPSEC filter to "[b]lock outbound-only traffic at the port level."

This is simply vigilante hacking, supported by selective quotes from Black's Dictionary (the finest source of misleading legal information anywhere). It is telling that Mullen simply discards admin notification as a step; his software doesn't do so much as fire a warning shot across the bow before mounting its own attack. Some obvious problems:

1. Mullen's thesis essentially comes down to the idea that a compromised system is like a rabid dog. But this is a misleading, and emotional, simile; a worm does not pose the health dangers described by Mullen. Its threat is one to property, not safety, and thus the threshold to action is correspondingly higher.

2. The idea that private individuals should have the right to attack and compromise the systems of others is remarkable, not least because he doesn't suggest that those individuals should be subject to tortious responsibilities for their hacks: he does not himself accept the legal responsibility he insists others take.

3. In the world of the author, all systems are evidently equal: if my home workstation is being tagged by a worm from an American Express server, I would be able to hack AmEx (or the government!) with impunity. This is obviously an insupportable doctrine; if someone is lobbing water balloons at me, I don't have the right to trespass on a government installation to stop him.

4. Finally, Mullen argues for active attacks against compromised systems because passive defenses are, well, just too much trouble. But they are certainly no less trouble to create and maintain, and much less disruptive, than a horde of automated systems hacking their way through the Internet and claiming self-defense as a justification. Where a passive defense is available, one should provide convinicing reasons why not to use them. Mullen could build a fence; instead, he prefers to use firearms.

Somewhere I have a hornbook on tort law that contains an article by Judge Posner on a similar topic: that of tripwire defenses used to secure property. He convincingly demonstrates, through case law and economic analysis, why such weapons are a Bad Idea in law and society. Perhaps Mullen should take off his smoke-colored glasses and look at the issue as something other than a technical problem.

Re:Hackback

[Lord Bitman]

If a rabid dog were attacking not you, but your bushes, and you recognized it to be rabid, and also possessed a magical muzzel-gun which would prevent the dog from attacking, I don't think the law would have a problem with you using it.

I've seen a lot of posts saying "He's just to lazy to block the IPs on his firewall", posted by people who didnt actually read the article. He said right at the beginning that this isnt about his system being secure, it's about bandwidth. Do you have some amazing service plan in which incomming traffic is free and only outgoing traffic is paid for? I think there are plenty of home users who would love such a plan.

Re:Hackback

[fuzzybunny]

1. Mullen's thesis essentially comes down to the idea that a compromised system is like a rabid dog. But this is a misleading, and emotional, simile; a worm does not pose the health dangers described by Mullen. Its threat is one to property, not safety, and thus the threshold to action is correspondingly higher.

In #3, you bring up an interesting counterpoint to this: "In the world of the author, all systems are evidently equal". I'm just nitpicking here, but what about hospital infrastructure? Fire department and emergency response computers? Military systems and communications satellites?

Don't get me wrong, I don't advocate letting an organization or government agency unleash 'Black Ice' on some hapless fool cracker based on the severity of a potential impact on it's IT systems, but under certain circumstances, a compromised system can, indeed, create a danger to health and safety.

Re:Hackback

[watchful.babbler]

And that is a very good point, directly related to ongoing efforts to normalize the Net. I don't think you're nitpicking at all.

The easy way out, of course, would be for me to say, "Those sysstems shouldn't be red/black at all," but that's not really a sufficient answer; the question is what if a critical system were connected to an open network.

One note is that the government, not private individuals, has the primary role in responding to critical infrastructure attacks. I don't think law enforcement hackbacks are a suitable response, but certainly even the most recalcitrant sysadmin would respond to a phone call from the feds telling him to isolate a worm-infected system -- or a visit from a response team ready to do it themselves.

One issue that I didn't bring up before: if I am to be justified in hacking a system that is hacking me, what's to stop the system that I'm hacking because it's hacking me from hacking me because I'm hacking it? (And so on.) Automatic hackbacks and low thresholds of proof lead to a whole parade of horribles.

Another answer, I think, is to simply attack the legal foundation of the problem. Mullen argues from the basis that systems owners do not have the legal responsibility to police their systems; I would argue that they do, under the application of both "industry custom" and the Learned Hand formulae (e.g., that of United States v. Carroll Towing, 159 F.2d 169 (2d Cir. 1947)). AFAIK, this hasn't been tested in open court, but any organization that does not undertake sufficient measures to protect its systems is asking for trouble. (There are contributory negligence issues, too, but they probably aren't germane at this point.) After all, if the problem is so serious as to justify hacking other organizations' computers, surely it's important enough to justify a lawsuit, right?

Happened to me

[octalgirl]

I can't remember the name of the company, but last year I had just installed IIS, then ran to the store. By the time I got back, around 45min later, I had already been hit by CodeRed. There was a message on my screen saying 'You have been infected by CodeRed. We did not infect you. Your server is trying to infect us. Please look on your hard drive to prove how open your system is. You can click here for more help. Again, we did not infect you.' (something like that anyway.) They left a small folder in my WINNT/system folder that had a link to them. Once I clicked their link they had other links on how to remove it, you could download the script they wrote so you to could load it and detect other people infecting you. And they had stats on how many servers had tried to infect them already (around 2000), and they explained more how they were only trying inform those that were attempting to infect them to be more aware about codered. I have the link and script at home, not with me here. Sorry.

Gray area

[FearUncertaintyDoubt]

Let's say a gas line on my neighbor's property breaks and ignites, spewing a torch which is threatening to set my house on fire. If he's not home, I wouldn't have a problem breaking his window in order to get in a shut off the gas. But I would also be prepared to pay for the window -- the protection of my own home is worth it. And I'd be willing to stand before a judge and say, yes, I broke in, because there was a twenty-foot flame shooting across to my home.

If my neighbor leaves and his stereo kicks on at a loud volume, which annoys me, I don't think I have a right to break in to shut off the stereo. The "right" to do something like that has to really match the threat posed. If someone else's network is threatening yours, you should first do everything you can on your own system to block them. If you can't block them, then consider the real severity of the threat. And if you break in, be prepared to have to justify yourself.

Two wrongs don't make a right.

[IGnatius T Foobar]

You don't have the right to trespass on someone else's network. Ever. You can contact them and discuss the problem; if that does not produce satisfactory results, you contact their ISP (and so on, up the chain, until you eventually talk to a Tier-1 ISP).

There is always a way to take care of the situation. Nobody wants to have their Internet service cancelled by an upstream provider because they violated their TOS by ignoring reports of a DoS attack originating on their network.

And your immediate reaction shouldn't be to launch an attack back at them. It should be to block the offending network at your own firewall. Come on people, this is Network Administration 101. I can't believe it's even being discussed.

some logic problems

[Lovejoy]

Yes, and.. one point I haven't seen made yet: The government can't vaccinate your children without your permission. They can kick them out of school, isolate them and make your life pretty miserable, but they can't invade their bodies without due process of law, which is missing in this equation.

And now DUCK, because here comes the straw man:
I think the main reason for the knee-jerk criticism from the likes of Schultz is that they work largely in a theoretical rose-colored world of security, where all problems are solved after a cup of coffee and a bit of pontification

While it's valid to argue that Shultz is responding knee-jerkedly (somebody have a better adverb?) It's not valid to attack him by virtue of the fact that he's an academic and to denigrate him with the cheap-shot coffee comment.

Academics study things like unintended consequences, the big picture, etc.. These are things most geeks can't be bothered to consider. While stupid academics tend to rise to the top in the media, very few are actually addle-headed theoretical bloviators. These smart people can contribute a lot to our discussions.

As for the actual argument about killing others' rogue processes, I don't have anything original to say, but in the "real world" it would be called vigilantism and trespassing.

Liability . . .

[Sam Nitzberg]

You might have the right to attack ("strike back") a site. You probably (in almost all cases) do not.

What if you do your analysis work, pick the site to strikeback against, and are totally wrong ? What if that site also supports innocent clients / subscribers to its services?

What if it supports large numbers of financial transactions?

What if it belongs to a charity?

What if it supports military operations?

What if the "innocent" site then counter-strikes you? This would be (by the presented logic), justified. Are you then justified to commit a counter-counter-counter strike?

I see fantastic liability for an individual or organization if they attack a system and are wrong about the source of the attack the are retaliating against.

Sam Nitzberg
sam@iamsam.com
http://www.iamsam.com

ugh!

[Faddim]

This is seriously flawed. It has way too many possibilities for misuse. If someone is hammering your network the appropriate place to take care of it is in the firewall of your router, and the courts.

Tools can be misused

[Anonymous Coward]

If such a method of counterattack is used whats to stop people from using said programs in others ways eg to attack systems with. Or imagine if the RIAA/MPAA were given the green light to attack systems to stop piracy, could not a third party direct an attack aginst someone by making it look as if they are using pirated software (like painting a target laser for a bomb to drop). One thing we should have learnt by now is that any weapon can be put to bad use, no matter how noble the initial cause for use.

very different from RIAA

[Tom]

Mullen's proposal is very different from the RIAAs.

The RIAA wants the right to hack your computer because they suspect you copied CDs. Metaphorically, they want the right to break into your home because you sneaked into the disco without paying.

Mullen wants to shut you down if you attack him. Metaphorically, he wants the right to knock you out if you try to rob him.

Guess what, in the real world, one of these rights already exists. It's called self-defense. The point is that the two things are not only related, they also depend on each other. The RIAA hacking your machine will not stop you from copying CDs. Shutting down your machine will stop the virus from spreading, at least temporarily.

Re:very different from RIAA

[StormReaver]

"Mullen wants to shut you down if you attack him. Metaphorically, he wants the right to knock you out if you try to rob him."

Mullen wants to be able to break into your house (enter your computer uninvited), root through all your belongings to find objectionable material (search your system for the offending program[s]), and destroy property (eliminate the offending program; though he wants you to trust that he won't destroy anything of value, and that he will know the difference) because he witnessed somebody running from your house with your property and trampling his lawn during the escape.

What this boils down to is that he wants to violate your personal property because somebody else did so already and caused collateral damage to his property in the escape. It's a "kick 'em when they're down" strike.

No Duty to Retreat...

[Pii]

There is a concept in law called "No Duty to Retreat," and I see no reason why it cannot be applied in much the same way to cases like this.

This concept relates to self-defense, and deadly force. Follow along with me...

If a person is in public, and is threatened, that person must make every reasonable effort to avoid the use of deadly force as a means of self defense, prior to useing such force. He must attempt to leave the scene, etc. In short, there is a Duty to Retreat.

If, however, that person is in his home, his own property, that person may use deadly force as a means of self defense without having to exhaust every means of escape or avoidance. On his own property, a person has No Duty to Retreat.

How is the scenario for Cyber-attack any different? Unlike most of the people commenting on this article, I believe you do have the right to take active measures in protecting your property.

Obviously, we're not talking about deadly force... We're simply talking about electronic countermeasures.

If an unsecured system on the Internet has been infected by a malicious program, and is now launching it's own attack against your system, your property, denying you the use of bandwidth or resources that you are paying for, I think you're perfectly within your rights to put the attack down, and if necessary, the offending system.

A person utilizing the Internet has a certain responsibility not to cause harm, either through action, or inaction. Most people on the Internet today seem tragically unaware of this. Without this, the Internet is ripe for a tragedy of the commons situation.

Is it wrong to still believe that with Rights come Responsibilities, or that with Priviledge comes Obligation?

Your rights to swing your arms around recklessly ends at the tip of your fingers, and at the beginning of my nose.

I think Tim Mullen is 100% correct, and I'm surprised there aren't more people that agree with him.

Re:No Duty to Retreat...

[Anonymous Coward]

a better analogy would be someone assulting me through a maibomb, then me driving to their house and setting fire to their basement.

Re:No Duty to Retreat...

[Pii]

You're mistaken on so many levels...

I'm talking about disabling the offending instrament in an electronic attack... You're talking about damaging property completely unrelated to the attack.

I'm talking about protecting my own property. You're talking about destroying someone else's property.

As a consequence of my retaliation, they have to restart their server. As a consequence of your action, they have to find a new place to live, if they survive, that is.

You've illustrated the difference between self-defense, and vengeance.

Shocker you didn't sign your name. (Yeah, yeah... I have been trolled. I lost. Have a nice day.)

Re:No Duty to Retreat...

[yoshi_mon]

While this is an intresting analogy, I think that you have missed a step. If someone is attacking your system from across the internet, it would seem to me that you have several steps within your Duty to Retreat before you have the right to use deadly force. You can block the IP, you can contact your ISP, you can contact their ISP, or even a few other things that don't involve the use of "Deadly Force" upon someone elses machine.

Your rights to swing your arms around recklessly ends at the tip of your fingers, and at the beginning of my nose.

This is the internet, your nose is most likely many many miles away from my fingertips. Digital or otherwise.

Re:No Duty to Retreat...

[shepd]

>There is a concept in law called "No Duty to Retreat," and I see no reason why it cannot be applied in much the same way to cases like this.

In most countries, it is not allowed to kill someone anywhere (on your property or not) for any reason whatsoever, apart from imminent death or a handful of other reasons (none of which relate to computers, such as "battered wife syndrome").

Unless that other computer is someone able to pose a real and imminent threat to your life (no, being told "I will kill you" is not a defence to murder in most countries) you have no excuse to attack.

Just thought I'd mention that, since the internet does expand beyond your country (which, since you didn't mention it, I won't assume which one it is, but your interpretation of the law does narrow it down quite a bit...)

Yes, this means that unless I want to restrict the exit of a burglar, I'd have to sit there and watch. It's a small price to pay to ensure they can be brought to justice.

Re:No Duty to Retreat...

[cobyrne]

The problem with this is that you are not being attacked in your home - you are being attacked from afar.

If someone puts a cannon on their own property and fires that cannon at mine, do I have a duty to retreat? Or may I, without first seeking legal recourse, bring a cannon into my property and start firing back at them?

Any /. readers know the legal answer to this one?

Re:No Duty to Retreat...

[janap]

If an unsecured system on the Internet has been infected by a malicious program, and is now launching it's own attack against your system, your property, denying you the use of bandwidth or resources that you are paying for, I think you're perfectly within your rights to put the attack down, and if necessary, the offending system.

Your analogy is leaky. It seems you define your own system as "your house", whilst defining the offender's system as being "in public".

Surely you don't mean to stretch the concept of self-defense to the point where it encompasses the right to enter someone else's private yard, armed with a monkey-wrench, a hammer and a screwdriver, and have him cease occasionally parking in front of your driveway by messing up his car?

On the other hand, I for one would love to be able to do that...

Re:No Duty to Retreat...

[regen]

But the situation is not exactly analogous. Imagine two neighbors, each armed with guns. A theif breaks into neighbor 1's house, and the theif and neighbor 1, start shooting at each other. The theif shoots a bullet that travels into your house. Thinking that you are under attack in your own house, you start shootin at neighbor 1's house. Maybe, you even relise that there is a theif in neighbor 1's house and you are trying to shoot the theif, but instead you shoot neighbor 1, killing neighbor 1. I don't think that you can claim self defense in the murder of neighbor 1.

This situation is a much closer analogy.

Re:No Duty to Retreat...

[TFloore]

"No Duty to Retreat" is also generally called the "Castle Doctrine" as in, Your home is your castle.

It is very much a state-specific concept. For instance, Florida has Castle Doctine in it's law, you have no duty to retreat from your home if someone is attacking you. New York has no such law, and actually specifically states that you must retreat if you have any possible option to do so. If you get trapped in your basement by a home invader, and you have a 16"x16" window in your basement that you might possibly be able to squeeze through to get away, you *must* try to get out through that window before you may legally use deadly force to defend yourself.

Also note that, for businesses and private individuals, there is nothing resembing Castle Doctrine for a place of business, only for a personal residence. Physical security forces are a special case, as they are nearly quasi-governmental.

But this proposal raises several other interesting problems. One of the neat statistics that 2nd Amendment supporters love is the accidental shooting statistics comparison between police and people that legally carry a concealed weapon. Police are much more likely to shoot an "innocent bystander" or similar than someone with a CCW permit. The reason for this, if you look into things, is that a CWW permit holder is usually involved in the assualt/crime from the beginning and knows exactly who the bad guys are. The CCW holder is usually the one *being* assualted, and can see the assaulter right in front of them. The cops come in in the middle of things, and have to figure out who the bad guys are in mid-stream, sometimes under extreme time pressures.

This relates to the Strikeback proposal rather directly. How many DDOS attacks use IP spoofing? Will you know who is attacking your system with certainty? How many systems are you allowed to incorrectly strike back at before you are legally liable?

Which incompetent admins that can't secure their own systems are you going to let decide who to strike back at???

Think of this in terms of the sniper attacks in the DC area last year. How much worse would it have been if 10 people nearby had pulled out guns and started randomly shooting at nearby vehicles that looked like they might be able to hide someone with a rifle? Thankfully, most people that carry a concealed weapon have more sense than to shoot at targets they are unsure of. I don't believe that of BOFHs on the internet.

Re:No Duty to Retreat...

[Anonymous Coward]

If, however, that person is in his home, his own property, that person may use deadly force as a means of self defense without having to exhaust every means of escape or avoidance. On his own property, a person has No Duty to Retreat.

. . .

If an unsecured system on the Internet has been infected by a malicious program, and is now launching it's own attack against your system, your property, denying you the use of bandwidth or resources that you are paying for, I think you're perfectly within your rights to put the attack down, and if necessary, the offending system.

An excellent analogy. You are absolutely correct that you have no duty to retreat on your own property. Thus any counter-attacks are justified, provided they don't extend beyond the borders of your property.

Re:No Duty to Retreat...

[Anonymous Coward]

None of you have obviously shot anyone in your own home. Sure you have the right to shoot someone who has broken into your home, but the $20M lawsuit the perps family is going slap on you seems to be quite a deterent.

Re:No Duty to Retreat...

[evenprime]

Pii said:
There is a concept in law called "No Duty to Retreat," and I see no reason why it cannot be applied in much the same way to cases like this. This concept relates to self-defense, and deadly force. [....] If, however, that person is in his home, his own property, that person may use deadly force as a means of self defense without having to exhaust every means of escape or avoidance.

On his own property, a person has No Duty to Retreat.

What you say is correct in many, but not all jurisdictions in the USA. For example, in Florida, your statement would be correct, since they allow the use of deadly force to protect any of your property. In contrast, Massachusetts residents may not use deadly force to protect their property, although they can use it in self defense. Specifically:

If you are in your own home, there is no duty to retreat, but you may use deadly force only to repel an intruder's deadly force attack against you or your family

According to what I just googled, Kentucky, Massachusetts, Maryland, Missouri, Ohio, South Carolina, Virginia, Washington, Wisconsin and Wyoming don't even allow the use of deadly force to protect a dwelling. Surprisingly, it looks as though Maryland actually allows more latitude in the use of deadly force to protect your business than it does to protect your home. (If someone in one of those jurisdictions has better info, feel free to correct me.)

Anyway, the short version here is that jurisdictions differ widely in a) what you are allowed to defend, and b) what means you are allowed to use in defense.

How is the scenario for Cyber-attack any different?

First off, this idea is a defense of property. It is not a matter of defending you or your family against death or bodily injury. All states allow the use of deadly force in to protect you and your family, but they differ widely in what *else* they let you protect with deadly force; i.e. you may not be allowed to use deadly force to protect your property.

Obviously, we're not talking about deadly force... We're simply talking about electronic countermeasures

You correctly noted that computer strikeback is not the same as the use of deadly force, but you failed to note that the states have similar disparities in computer laws. For example, the Oklahoma Computer Crimes Act of 1984 makes it a felony to

"willfully and without authorization disrupt or cause the disruption of computer services or deny or cause the denial of access or other computer services to an authorized user of a computer, computer system, or computer network."

Why strikeback is a bad idea.

What is legal in your jurisdiction may not be legal in your targets jurisdiction, or in the jurisdictions of the computers, switches and routers that your attack travels through enroute to the the target

It may not be effective in eliminating the problems your network is having from the target site - if you strike back against a machine and accidently harm it, you could find yourself in a protracted feud with the owner of that system (a la "hatfields vs. mccoys") which ends up being more of a bother to you

If you cause collateral damage, you could be liable for it - e.g. someone is flooding you with easily spoofable ICMP and UDP packets and you foolishly DoS the machine whose IP address appears in the header, thus shutting down a small business owner's website. There's a good chance you'll get sued if they know what happened.

it may not be cost effective to accurately trace and identify the machine that is attacking you.

Re:No Duty to Retreat...

[g_goblin]

Take a look at this link then tell me what you would do if this happened to you and your network/website. attack
I realize most of us don't have the time to accomplish this kind of response but my response would be something along the same lines.

Re:No Duty to Retreat...

[Pii]

This relates to the Strikeback proposal rather directly. How many DDOS attacks use IP spoofing? Will you know who is attacking your system with certainty? How many systems are you allowed to incorrectly strike back at before you are legally liable?

Which incompetent admins that can't secure their own systems are you going to let decide who to strike back at???

Think of this in terms of the sniper attacks in the DC area last year. How much worse would it have been if 10 people nearby had pulled out guns and started randomly shooting at nearby vehicles that looked like they might be able to hide someone with a rifle? Thankfully, most people that carry a concealed weapon have more sense than to shoot at targets they are unsure of. I don't believe that of BOFHs on the internet.

You raise valid questions, and so have some others. Most of them, however, seem to think I'm out to shoot someone that sends an ICMP Echo Request in my general direction. :) As tempting as that may be, from time to time, we're not actually talking about killing anyone in this discussion.

How many DDOS attacks use IP spoofing? Probably a great many of them, but for most worms, IP spoofing is impossible, because the initiator in most cases needs to get responses back from the victim host. Using a spoofed IP address would make that nearly impossible.

Obviously, electronic countermeasures would have to be very specific. A set of counter responses would have to be tailored to counter a specific worm.

As an example, when NIMDA was running rampant, fully 5 months after appropriate patches had been offerred my Microsoft, and it was clear that there were a number of system administrators that had no interest in updating their systems, I put the NIMDA countermeasure on my system (I'd seen it posted here, as a matter of fact. That one had a problem, but I modified it to simply shut down the remote system, rather than disabling IIS first, and then attempting to shut down the system (That wouldn't have worked.)).

My logfiles were filled with invalid queries from infected systems... Hundreds of log lines per system. After employing the countermeasure, I'd get 5 or 6 lines in my log, and then silence from the infected host. My script left a message in the offender's log files stating that they were infected, and containing the URLs to all of the appropriate Microsoft documents, and the patches that needed to be installed.

Was I wrong to do so?

I'm sure there are plenty of people that think I was. I fully understand their perspective.

On the other hand, I think I was within my rights. It's pretty clear that 5 months after the outbreak, the people operating those systems were either unaware of the problem, or unconcerned about it's impact on others.

Let's say your auto manufacturer issues a recall about an unsafe braking system in your vehicle, directing you to take the vehicle into an authorized service center for corrective measures at no cost, and you choose not to do it. Months later, you experience a brake failure, and slam into another car. In my book, you're guilty of negligence.

I view the people that failed to patch their systems, 5 months after the NIMDA outbreak, when patches existed even prior to the NIMDA outbreak, in the same manner. Negligent. You've allowed your property to become a public hazard through inaction.

It isn't as if I built a scanner, to go out and sweep the Internet for people with infected systems, and attempted to shut hosts down at random. My script sat in wait. It retaliated only against systems that had brought the malicious code to bear on my system, and my bandwidth.

(As a result of NIMDA, to this day I am still unable to receive inbound connections on Port 80, because my ISP has set up filtering.)

Re:No Duty to Retreat...

[poot_rootbeer]

How is the scenario for Cyber-attack any different?

For one thing, people don't live in their computers...

Say someone breaks into your house and steals your family photo album. Later you're walking through the neighborhood and notice the album sitting in the seat of a car parked on the road. If the door is unlocked, are you justified in opening it and taking back your photo album? If the car is locked, are you justified in breaking the window?

No, in either situation the right thing to do is to contact proper authorities.

A person utilizing the Internet has a certain responsibility not to cause harm, either through action, or inaction.

s/person utilizing the Internet/robot/

Unfortunately Asimov's Laws of Robotics are merely science fiction. Ethics are not a required component of technology.

Re:No Duty to Retreat...

[Anonymous Coward]

In most countries, it is not allowed to kill someone anywhere (on your property or not) for any reason whatsoever, apart from imminent death or a handful of other reasons (none of which relate to computers, such as "battered wife syndrome").

The results may depend upon whether "imminent death" is recognized as being present in any physical assault. Any injury, hit or fall can be fatal, so deadly defense can be used against any actual or threatened attack.

The police sometimes shoot a guy who was only holding a knife. Should the Police Musketeers be called to carry on a swordfight? How many police officers are allowed to be stabbed to death or have body parts sliced off before they can protect themselves? Is it OK for any police officer to get hurt, or for their spouse and kids to lose any part of them? The same goes for police officers as for anyone else.

Re:No Duty to Retreat...

[Pii]

For starters, you are being attacked in your home. It doesn't matter that the attack is originating from elsewhere... It's the end-point that counts.

From your statement, you make it sound as if anyone initiating an attack on you with a ranged weapon (Slingshot, Bow and Arrow, Crossbow, Catapult, Mortar, Firearm, Artillery Shell, Ballistic Missle, etc.) is in the clear. Is that your contention? That would be absurd.

In Virginia, if someone is shooting at you (Your life is in imminent danger), you may use any force necessary to repel the threat, up to, and including, deadly force. Additionally, you may use deadly force to defend the life of someone else (You don't have to be the person in jeopardy), although, in terms of this discussion, that's irrelevant, and would open up an entirely different can of worms.

(You *should* make a reasonable attempt to evade or avoid when in a public place, but in a case where you are already being shot at, I think the threshold of "reasonable" is dramatically lowered. Is it reasonable that you must turn your back to a firing gunman and flee? Not in my mind.)

But this is not a discussion about the use of deadly force, and in the end, we're not talking about taking the life of the system administrator that failed to install a system security patch.

We're talking about the use of a non-lethal electronic countermeasure against a system that is attempting to compromise a system that is your property (your computer), and wasting resources that you have paid for (bandwidth).

I cited "No Duty to Retreat" because of the similarities between the case for using force as a means of self-defense, and the use of an electronic countermeasure as a means of protecting your property.

I think it is unreasonable that I should be forced to endure damage to my property or degradation of resources that are rightfully mine so as to accommodate an attacker, unwitting though he may be. It elevates the rights of the attacker to a plane higher than that of my own rights, and that runs 180 degrees opposite to everything I believe.

(For those playing along at home, yes, I am a citizen of the United States. I realize that in other parts of the world, the notion of Rights can be viewed as a curious novelty. Just the same, in this country, Rights are supposed to be sacrosanct.)

Re:No Duty to Retreat...

[Sylver Dragon]

I'm talking about disabling the offending instrament in an electronic attack... You're talking about damaging property completely unrelated to the attack.

I'm talking about protecting my own property. You're talking about destroying someone else's property.

While I disagree with the AC above, I don't think I can agree with your position on this.
In a black and white interpretation of the idea of downing a system to protect one's self, it does sound good. Problem is, we don't exactly live in that sort of world.
For starters, consider the burden of proof.
Ok, you down a rouge server. In doing so you disrupt a business and cost them money. You are hauled before a court and asked to defend your actions. Now, how are you going to prove that you were defending your system? Router logs? Those could have been forged, your ability to down the offending server would indicate that you have that level of ability.
Scan the affected system? Comes up clean. After all, once the server went down, the admin did a full scan of the system and cleaned out the problem. And he's not going to admit that he was at fault.
Or consider the abuses of his sort of thing.
"Your honor, we here at Walmart.com found it necessary to down the smallstore.com web server, because it was sending out a requests, to our server, which appeared to be a worm"
I'm afraid that this type of idea is just inviting disaster. I agree that, in a perfect world, this would be a great idea, but this is not a perfect world.
As for the self defence analogy, I see it as invalidating the argument for this sort of thing.
Its a matter of perception though, so we are almost certain to not agree, but I'll put this forth anyhow.
The internet is a public place. It is not your home, it is not your property. When you open that pipe to the internet you are creating a presence in this public place.
As such, if you come under attack, you have that "Duty to Retreat". Actively hacking the attacking server is an overuse of force. You could have contacted your ISP and insisted that they firewall you off from the attacking server.
Yes, your computer is your property, and if they attacking server starts a process on your system, you have every right to halt that process. The whole point about your rights ending at the tip of my nose still holds, but its a two way thing. You can do whatever you want on your own system, but you are not allowed to reach into someone elses and monkey with it, no matter how well intentioned.

Re:No Duty to Retreat...

[Pii]

Wow, great response...

I agree with each of your points as to "Why strikeback is a bad idea," particularly from a legal perspective.

I concede that my thoughts on this topic are more concerned with the ethical/philisophical ramifications of electonic countermeasures, than with the legal ramifications of undertaking such actions.

I should have noted elsewhere, my citation of "No Duty to Retreat" wasn't intended to build a legal case for strikeback... I cited it more from the perspective of "here's a doctorine that is fairly widely recognized (if only in the US)" that I can get behind. I understand the doctorine, but what is more important in terms of the discussion, is that people understand the reasoning behind it.

If Jimmy Stewart were chiming in, I'm sure he'd say "That's all I can stand, and I'm not gonna take it any more!"

Again, great response...

Re:No Duty to Retreat...

[Sylver Dragon]

Not necessarally so. IIRC, we here in CA, passed a law a little while back that states that if you are in the comission of a felony (breaking and entering comes to mind), and are injured, you are not allowed to sue. We got tired of hearing about the burgler who cut humself of the window, which he broke, suing and winning.
So, if somone breaks into my home, they can expect to be on the receiveing end of a shotgun.

Re:No Duty to Retreat...

[shepd]

>The police sometimes shoot a guy who was only holding a knife.

In my country, if the police did this, there would be a VERY thourough investigation, and almost for sure, the police officer would no longer be such unless there was clear evidence that the officer was very likely to be killed with that knife.

The only time a police officer would be allowed to shoot would be if the person with the weapon (be it gun, knife, whatever) used it in not just a threatening manner, but in a life-endangering manner (holding it to a hostage's throat, holding it within stabbing distance of the police officer, etc).

In fact, in my country an officer has to fill out a report whenver they draw their firearm, period. The police may not use a gun to intimidate.

>Is it OK for any police officer to get hurt, or for their spouse and kids to lose any part of them?

No, however it is their duty to uphold the law, and to ensure justice prevails. Death is not justice in most countries.

The job comes with certain risks. However, very few police officers are killed/maimed on duty in most countries (fortunately).

>The same goes for police officers as for anyone else.

Agreed. And in many countries one doesn't have the right to bear firearms, except in certain cases (and in some countries, in no case whatsoever), so it only makes sense there are so many protections on what an officer can do.

Re:No Duty to Retreat...

[Anonymous Coward]

The police sometimes shoot a guy who was only holding a knife. Should the Police Musketeers be called to carry on a swordfight?

Here is one better: in a much publicized case in Detroit (I believe), a deaf man was shot by a police officer because the officer believed the garden rake that the man was holding was a danger to himself and his fellow officers. Police officers do still carry nightsticks and pepper spray right? By the way, there where 3 officers on the scene.

What goes for the police does not go for everyone - there is no way in hell a jury would have allowed a civilian to shoot another for holding a garden rake. And from eyewitness accounts, the man was not swinging the rake nor holding it in a particularly threatening way.

Re:No Duty to Retreat...

[Anonymous Coward]

Take a look at this link then tell me what you would do if this happened to you and your network/website. Take a look at this and see why GRC is a liar and a fraud.

Re:No Duty to Retreat...

[TFloore]

No, I don't really think you want to go out shooting anyone that pings your system. I do think most people that want this law want to have their systems running reliably, and don't really care what damage they have to cause to other people's systems for that to happen.

Your comparison of Nimda to a brake recall on a car is actually rather interesting. It allows us to consider a lot of things that might actually make sense here, and some that don't make much sense.

First, your comparison to a brake recall would make more sense if the people driving the vehicle didn't know their vehicle *had* brakes. Many (not most, I believe, but a large minority) of the people that were running non-patched systems when Nimda became a problem didn't know they were running IIS. This is one of the reasons MS switched to services off by default.

Second, the manufacturer found the problem, but didn't actually send out notices, just put a note on a web site somewhere where most people don't even know to look. Unless you make a specific effort to become aware of security issues, you won't know. You either join a mailing list and wade through way too much traffic for people that have real work to do also, or regularly visit a website and, again, read through too much traffic. Yes, I'm assuming these are not dedicated sysadmins, which is the case for most small and medium-sized businesses and homes.

Third, for people that get regular service done at a dealer service center, the driver may not know or care about recall work, the dealer does it for them. That's supposed to be one of the reasons you get regular maintenance done by the dealer. Not just because you like paying horrible prices for an oil change. :)

This is actually worth thinking about from the point of view of computer services companies. If IBM Global Services has a support contract with your company to maintain computers, and doesn't supply a patch, they are probably negligent. If IGS doesn't do it, is the company that owns the computers negligent, if they though IGS would? (No, I don't work for IBM, they are just a convenient example.)

Does a home user have a requirement to have their computer serviced regularly by a professional? How about a small business owner?

If a small business buys a microwave oven for the break room and that microwave is subject to a recall because it causes fires... If the business never hears about this (never sent in their warranty card so they don't get notices, and they don't check an online recall site) and doesn't replace it, if someone dies in a fire caused by that microwave oven, is the business liable for not exercising due dilligence?

Frankly, I don't know. I just know this is more complicated than we'd like to pretend it is. I'm looking for a quote here, something along the lines of "For every complicated problem, there is a solution that is simple, easy, and wrong."

Re:No Duty to Retreat...

[mkldev]

Ok, you down a rouge server. In doing so you disrupt a business and cost them money.

Do you know of any business with rouge servers? Last I checked, most of them were beige, or occasionally black.... :-)

Re:No Duty to Retreat...

[GoneGaryT]

Look at the language and the psychology. "State". "Castle". "Defend". We who look after the networks of large organisations have built them into virtual city-states, with moats and drawbridges. "Out there" is the badlands.

See how different this is to how it was - a joyfully shared resource where, if someone came along and fixed your shoddy config without your say-so, they would incur gratitude and amusement, not wrath. Th'Internet has grown contorted and wretched and now we must play the game of the lowest of the low.

IMHO if you verify your target, send a warning, and there's no response or a negative response, shoot. What's so wrong about that?

sig: I used to think that Slashdot readers had backbone and moral courage. Apparently not.

meta-sig: Sheesh!

Re:No Duty to Retreat...

[Sylver Dragon]

Ok you got me, I majored in Math, not English. My spelling is iffy at best.

Re:No Duty to Retreat...

[plover]

By the same logic, this would apply to spam and to spam relays. Given the typical law enforcement agency's less-than-complete grasp of all the technology out there, I would be justified in taking down your box because it forwarded spam to me.

Does it extend further? Can I take down tripod.com because I got a bunch of pop-unders from one of their pages? If I do, can I convince a judge that I was justified because of the loss of bandwidth and memory I suffered?

It just gets gray really fast. One persons "attack" is another persons advertising (think "free speech".) What if someone downloads a Metallica MP3 from a Trojan RIAA machine? That may be considered entrapment, or it may be seen as an active defense. I think that anything that has such a nebulous line, such a wide gray area, probably shouldn't be allowed simply because of the "slippery slope" patterns of abuse we see so often here in America.

Re:No Duty to Retreat...

[fireboy1919]

One small change from your scenario: instead of guns, make them magical elven guns - ones that always hit the intended target, since you can easily guarantee that you're killing the right process (kill the one that's shooting at you).

So you won't be killing your neighbor.

Then we're at the same moral quandry as before. May you kill the thief who is not victimizing your home?

We also get the same realization out of this as with killing malicious processes: you've done something to save your neighbor's house.

Re:No Duty to Retreat...

[0xA]

Most of them, however, seem to think I'm out to shoot someone that sends an ICMP Echo Request in my general direction. :)

I don't think you would do that but I have met some people that would.

About a year ago I got an email from some guy telling me I had I virus on one of my company's computers and it was trying to hack into his system. He was rather upset. When I investigated I found that it was actually just an SQL replication agent that I had put the wrong IP address into. I guess he had one of those personal firewall programs that pops up a dialog any time somebody tries to connect to your computer so it looks like it is actually doing something. I sent him a message saying I was sorry for the mistake, it won't happen again etc. He wrote back that saying I was obviously an idiot, I tried to hack him and if it happened again he would call the cops.

A week later I am starting a replication manually and I enter the IP wrong again, same one, it was very similar. Buddy flies off the handle, emails me 6 times, emails abuse@myisp 10 times, calls my office etc. I spent a week explaining this to people.

Now you know, and I know that a couple connection attempts to your machine on a port that is not open is no big deal. It is almost always a mistake. Your average user does not know this. I don't even want to think about what would have gone on if this guy had access to "Evil Hacker EZ Revenge Kit" or something like it.

I agree with this idea in a theoretical sense but I think it is too dangerous to become a common practice.

Re:No Duty to Retreat...

[Alsee]

IP spoofing is impossible, because the initiator in most cases needs to get responses back from the victim host. Using a spoofed IP address would make that nearly impossible.

Actually this is a very interesting point. You CAN spoof the return IP address and infect a target without receiving any of the responses *IF* you can predict the target's sequence number response. You can blindly broadcast the whole attack using that sequence number.

If you try this method it would probably be a good idea to broadcast each packet two or three times to compensate for any lost packets. The redundant packets will be ignored by the target.

Different systems have varying degrees of vulnerability to sequence number prediction. For anyone interested in the gory details, here's handy Google search on the subject.

-

Re:No Duty to Retreat...

[g_goblin]

It doesn't matter if it happened or not to grc, it has happened to many users out there. I was just pointing out an example of what can happen to you from a lowly script kiddie.

I disagree.. it costs me money!

[Marx_Mrvelous]

If I am being DoSed by a computer (or several computers) it can cost a company thousands, if not tens of thousands of dollars. If I'm a sysadmin of Yahoo! And my service is interupted, I want every means possible to shut down an attacking system. Most the time ISP's ignore pleas about DoS attacks (just ask anyone on IRC!)

The tools he's talking about use the same exploits the worm/virus/trojan does, but instead of doing something bad, it kills the flooding. If you have an insecure machine, you're lucky that you don't get sued by it.

There will come a time when you *can* be sued for having an insecure machine used as a proxy for a hack. Until then, his solution seems to be a good real-world solution.

Re:I disagree.. it costs me money!

[Nathaniel]

"If I'm a sysadmin of Yahoo! And my service is interupted, I want every means possible to shut down an attacking system. Most the time ISP's ignore pleas about DoS attacks (just ask anyone on IRC!)"

You are arguing two very different situations at once. If you admin Yahoo!, your ISP already recognizes your voice and knows to jump when you tell them to.

Part of playing on the internet is dealing with loosers. One of the risks you take is that other systems will attempt to attack your system. If you can't handle this, go live in a cave without the internet or string cable from your house to your friends' houses.

If you don't think it is fair for your ISP to charge you for traffic that you actively don't want, negotiate with your ISP so you don't pay for that traffic. That would give the ISP a direct incentive to block the traffic at an earlier point, as they should have.

If your ISP ignores you, get their other customers to join you in your complaints, or take your business somewhere else, or work to make it clear that there is a market for service providers able to block attack traffic, and support that market when it arrives.

Re:Vigilante justice? (Answer: No)

[FleshWound]

Vigilante justice?

If this were real life, and the attacker and victim were both humans (as opposed to computers/networks), what Mr. Mullen is proposing would be known as "self defense," not "vigilante justice."

right to exercise self defence

[Martin Spamer]

The right to exercise self defence IRL is recognised in both International and National laws providing the defence response is proportionate to the assault.

As a IT Professional with some interest in the security arena I think I could live with the same situation with regard to IT security providing a similar burden of proportionality existed.

I suggest that a proportionality criteria also allows a firm distinction between the demands of RIAA/MPAA for cracking rights for a minor civil copyright violations and the rights of a system operator/administrator seeking to halt DDOS attack or worm attack by remotely halting the attacking process.

Everybody already HAS that power.

[dark-nl]

This strikeback would only work against systems that are already infected by a worm. Now, the cute thing about worm-infected systems is this:

• You know they're vulnerable, because you know how the worm got in.
• Everyone else knows they're vulnerable, because the worm is being noisy about it.

Face it, those systems are going to get owned, one way or another. His proposal is to neutralize them before some script kiddie strings them all together for a DDOS attack.

The converse is that a properly patched system is NOT vulnerable to strikeback, because the strikeback proposal only targets well-known worms. If your systems are vulnerable to well-known worms, then you have bigger problems than the possibility of having a process killed by this guy's neutralizing agent.

So, he's not talking about giving or gaining any kind of power. The ability is already there. He's talking about whether or not it's a good idea to use it.

Analogy

[nmg196]

Here's an analogy:

A guy in the apartment above you has left his door unlocked and then gone away. A malicous child walks in and turns the tap on for a laugh and then leaves. A while later the apartment is flooded and water is pouring though the ceiling into your property. Do you have the right to walk in though his unlocked door and turn off the tap?

I know what I'd do. It might not be legal, but I don't think anyone would stop me or arrest me and I don't think the owner would mind that much either.

Nick...

Use and Abuse

[sbryant]

I can understand him wanting to kill genuinly malicious processes on other peoples' machines. I would want to too. My problem is that it's open to abuse. Who decides what malicious processes are? What if a malicious person starts using this to kill other processes?

There's also the whole legal kettle of fish. AFAIK, killing processes on someone else's machine is illegal. Even if the US government passed laws allowing such actions (which I think unlikely), you can guarantee that major parts of the rest of the planet wouldn't, which in turn could land people in hot water...

As has already said, I think the best course of action is that the ISP be held responsible for terminating the network connection of any machine behaving maliciously (mbm), which means that nobody messes with the mbm itself. It's legally, and IMO ethically, much safer, but you'd still need to define precisely what malicious behaviour is, eg: just because a server is sending lots of data to one IP address doesn't make it malicious.

-- Steve

In related news....

[Mark (ph'x)]

George Bush has released his own network security suite "Homeland Security" with many advanced features.

"Homeland Security" allows you to scan another system for 'Toolz of Mass Hax0ring' and to kill any processes that try to stop you. It even allows you to take a remote host down if you belive it to have such Toolz in its possession.

Furthermore, "Homeland Security" allows the admin to arbitarily flag a process as 'Bin Very Nasty' and gain root on any host that you belive may be running it. After root is gained on the remote host, "Homeland Security" sets up its own daemons to police secuirty on the remote host. As an extra bonus, hosts that do not help police your process control can be added to /etc/hosts.deny.trade.

Of course no modern security package would be complete without a broad range of settings to really lock down your users and remove from them as many privildges as you think you can get away with under the guise of Security.

GWB Homeland Security, proudly sponsored by the 'Land of the Free' Software Foundation *sarcastic cough*

Who will be in control????

[beetinkle]

Who will be the admin of the list of approved process to kill? And if we are trying to make our machines more secure from outside control, ie worms, viruses and hackers, will we have to make a "secure backdoor" so that someone can remotely kill the "approved process". We should make the manufactor of the operating system responsible for the safety of the system, the sane as car, drug and other manufactors are reponsible for there products. I think that before we make another hacking tool avaiable we need to fix the system. And educate users, management, who controls the money spent for IT as well as system admins. On a lighter note, Can we use this to stop spammers????

Perfect

[Anonymous Coward]

Everyone knows that Slashdot is perfect, and needs no improvements. That is why all complaints about the features of slashdot are redundant and off-topic.

I say.....

[mao che minh]

....the law grant us the permission to kill malicious users, instead.

Vigilantism at it's best

[Mulletproof]

There is a reason why this is generally frowned upon in real life... It's because the person who takes the law into their own hands often decides their own own definition of justice. Your method of terminating the process may be wildly different from Joe hacker's, who is more than willing to format your harddrive to do it, even if you have no knowledge of the worm.

Lets face it, this is going to be another elitist club here. After all, what percentage of the population would have the knowledge to do this sort of remote termination? And then there is the age old question of the UN-- Would you allow those incompentents to attempt to terminate process on YOUR computer? I know, I know, your computer is secure, whatever. But would you let AOL Joe have a crack at your computer like you have the right to crack his? BE HONEST NOW. Hell no.

I'll admit, vigilantism has it's positive points, but when you can just as easily set up a firewall and run anti-virus or something on a regular basis, it really doesn't give you the justification to [analogy] break into somebodies home to turn down there stereo becuase it's annoying you [/analogy]. After all. If your l55t nuff to terminate stuff remotely, you should be l55t enough to block it just as easily.

Re:Vigilantism at it's best

[uncoveror]

Another big problem with vigilantism is that vigilantes usually end up punishing the innocent based on mistaken identity. Also, a worm-killing worm unleashed on the internet, if buggy, could cause more damage than the Nimda or Code Red it is trying to seek and destroy.

good idea with limit

[DonFinch]

Legally it would be the same as if there were a gunman on your neighboors lawn without his permission, shooting at your house. You have every right to defend your house. AND with the right circumstances get damages from your neighboor for violation of duty of care or negligence.

will never work because of legal liabilities

[JeanBaptiste]

Go ahead and try this method. You will soon be sued out of existance. And rightfully so, imho.

Self-defense, not vigilantism

[Anonymous Coward]

If I roam dark alleys looking for muggers to attack, I'm a vigilante. If I'm minding my own business, and a mugger attacks me, and I knock him out, that's self-defense. Self-defense is legal pretty much everywhere, except maybe Great Britain.

The strikeback proposal is simply that if another system is currently in the act of attacking you, it should be okay for you to put a stop to it, using the minimum force necessary. It does not involve "teaching them a lesson," shutting down the server, or attempting to patch holes...his sample code makes the bare-minimum change to stop the worm from hitting you. Damaging the opposing system in retaliation should be illegal, just as knocking out a mugger and then shooting him in the head is illegal. Retaliation is out of bounds. Minimum-force self-protection is allowed.

Of course, the first step should be to ask the sysadmin to stop it himself. And if you can stop damage to your system simply by patching your own system, you should stop there. But if you can't reach anyone, and the worm is resulting in a denial-of-service even after you've patched, a little extra force seems entirely appropriate to me.

A Virus to Patch and Destroy....

[kevlar]

I've always wondered why someone hasn't taken the time to modify existing worms to simply patch the holes they exploit. Or even disable the box on some level. It wouldn't be hard to accomplish either, I could probably do it in an evening if I had the time...

Fundamentally flawed

[Anonymous Coward]

This proposal is fundamentally flawed, and here is why:

Where I used to work, they run a set of public NTP servers. _Very_ regularly, complaints come in about attacks coming from port 123 on these hosts. In every case, after enough dialog between us and the person reporting the attack, they would actually look at the NTP configuration of the machine under "attack" and realize that they were trying to use these hosts as an NTP server and it was their fault that the IDS was reporting the traffic as attacks. If they were allowed to use strikeback, these machines would spend more time with NTP killed than running.

Logic leads to abusive laws; 3 strikes

[Jeremiah Blatz]

From the article:
If someone commits three felonies, they are put away for life.

Of course, this is a horrible law, mostly used to imprison non-violent criminals. It's worth pointing out that the family for whom this law was passed (their daughter was killed by a repeat sexual offender on parole) is actively campaigning against the law.

The moral is that one must be very careful when constructing laws that propose solutions to difficult problems. Any law making it legal to hack somebody's machine is subject to enormous abuse, and shold not be lightly passed.

There is a difference

[heikkile]

If I hack into a disturbing machine, I am in the wrong and deserve to go to jail. But if some machine requests default.ida from my box, and I return a valid response that happens to be bigger than the requester expected, and he happens to crash on that, I have done nothing wrong.

But there has to be a grey zone in between. Where do we draw the line? Where do you think a judge will draw it?

The arguments I see against this...

[Anonymous Coward]

I agree that this 'strikeback' capability could be abused. But I've seen a lot of questions people have posed:

(1) What if the machine you attack back is running some critical process and you disable it?
(2) What if the machine you attack back is also hosting other, innocent clients?

and various arguments along the line of 'What if your strikeback also affects X, who doesn't deserve to be affected?'.

My response to this is: What if? Let them be collateral damage. It wouldn't have happened at all if you'd SECURED YOUR SYSTEM. I saw an analogy about someone stealing your car and trying to run over someone else. What if that someone else shoots out your tires? You left your car unlocked, you pay the price.

Another common one is 'just block their IP on your firewall'. I find that response so stupid it's bewildering; people who respond with that have never seen a real ATTACK. I (normally) chat on an IRC network named DALNet. For the past few weeks, all 31 servers have been completely offline, because of a few thousand idiots on cable and DSL, infected with a trojan. If you have a 1.54mbps pipe and you are being sent 3 megs a second from compromised hosts, a firewall won't do $#!t. Nothing. And do you think the ISPs giving access to those people are going to shut off access? No way! DALNet is a free service, it has no budget to sue anybody, why would an ISP bother cutting off paying customers?

So many people here talk out their @$$es it's not even funny.

How do so many people get infected? By running unpatched copies of IE and visiting malicious webpages. Who sets up these webpages? Why, GeoCities! Geocities will NOT shut down any of these malicious sites, since their AUP doesn't say anything about viruses. The only way to get a Geocities page shut down is if it has nude photos on it.

So -- what to do then?

Ridiculous on so many levels

[Anonymous Coward]

1) You do not have a legal right (not even in Vermont) to shoot a gunman on your neighbor's lawn.

2) Not only will you spend 20 years in jail for the shooting, expect to pay heavy fines, any probrably additional jail time for filing a seriously frivilous lawsuit against your neighbor. Your lawyer would also face disbarrment.

3) Not only is your analogy factually flawed, it is logically flawed as well. Your analogy would match Mullen's scenario if you were to shoot your neighbor if a gunman was found on his lawn, which blows Mullen's thesis out of the water.

Is it legal?

[jannic]

I am not a lawyer :-), but afaik, german law contains a section dedicated to such questions, since long before computers where invented. It's called 'Geschäftsführung ohne Auftrag' (benevolent intervention in another's affairs, 'Negotiorum gestio') Other countries have such laws as well, but I don't know any details.

Summarized, this law says that you are allowed to handle someone elses affairs (here: kill a malicious process), if you assume that the owner wants it to be done and can't do it himself for some reason.

But doing so, you need to take special care not to do any damage, else you are responsible to compensate the owner for any damages.

Additionally, you must inform the owner as soon as possible, and give him the chance to do the job himself, if possible. So if you kill a process on someone elses machine, you must take any reasonable measure to find out who is responsible for that machine, and inform him about your actions.

This posting describes my unprofessional understanding of german law - I probably got some details wrong, but I think I got the point. See this page, subchapter 11, for a translation of that law.

well i know a couple people who would be pissed...

[frenetic3]

ok, this idea is ridiculous to the point of being funny - i guess i don't get it. who determines what a "malicious" process is? so under this scenario i could just terminate random processes on other people's computers?

imagine the repercussions on the battle.net ladders.

"i was totally beating the shit out of this kid and then right at the end my war3 exe terminated out of nowhere"
"OMG WHAT A FAG"
"no dude it's ok, i terminated his kernel32.dll"
"HAHA 0WNED"

Wrong

[Anonymous Coward]

The rights of the many do not outweight the rights of the one! Your above example is flawed since nobody has a right to infect other people with diseases, commit crimes, or let their dog attack peoples.

Consider the biological virus

[xant]

If I have the flu, I have a moral duty not to infect others with it. But what if, through necessity or ignorance, I do so anyway? Others in my environment do not have the right to forcibly vaccinate me against the flu or to force-feed me antibiotics, much less to restrain me from going about my business (unless they work in a sterile environment).

The appropriate response for people at risk of catching my disease is to avoid me, to take steps to protect themselves from me--not to stage a counter-invasion.

My letter to Tim Mullen

[Digital_Quartz]

The idea of writing "strikeback" scripts, as you describe, has been tossed around before. I recall reading a quick-and-dirty script for Apache posted on slashdot some time ago that would detect attacks from machines infected with Code Red, and would then exploit the security holes Code Red had opened on those machines to clean them. I used to support this idea, but I'm afraid after some thought, I've changed my mind.

I'd agree that if a worm is running on someone's machine without their knowledge, then the owner of that machine has no rights to that process (the obvious exception being the person who is spreading the worm, who runs it intentionally on his or her own machine, but we'll ignore him or her for now). In order for you to terminate that process, however, you have to break into their machine, and run your own process. You are, in effect, creating your own worm. Your worm may only run for a short while, and may be "for the greater good", but that doesn't change the fact that you are running code on other poeple's machines without their consent.

Even if we opt to ignore the ethics and look at this from a more practical angle, can you guarantee that your strikeback process is not going to adversely affect the machines it cleanses? What if your strikeback process causes a machine gathering scientific data to reboot, or kills the wrong task? This has the potential to set someone back by several days in their work. What if it reboots a machine monitoring medical equipment? You could end up killing more than just a process, if you catch my meaning, however unlikely that may be.

Since you are intentionally running a process on someone else's machine, you are accountable for it's results. If you cause damage to a machine, or cause data to be lost, even if it is inadvertant, you open yourself up to litigation from the owners of those machines.

Computers are not Cars, but even so . . .

[MisterSquid]

Treating computer processes and network connections as extensions of human being ignores the great complexity of computer systems and the irreducible nuances to responsibility, origin, and intent such machines introduce.

Translating your argument into the world of atoms, that would be like holding someone responsible for a vandal who goes into someone's unlocked car, releases the emergency brake, and lets the car go careering into a crowd of innocent bystanders. Just because computers seem to "act" does not mean that their actions are always the fault of their owners, secure systems or no.

The key is to hold those who crack systems accountable for their actions and to educate victims about how to better secure their systems. Those users unwilling or unable to secure their systems should pay third parties to secure their systems for them.

Even the best secured system is not uncrackable. Would you hold the best sysadmin in the world responsible for a script kiddie's lucky guess?

Your post says you would.

Re:Computers are not Cars, but even so . . .

[MalleusEBHC]

I don't think it is a matter of holding everyone responsible for any attack that may come from their machine. It is about holding negligent users responsible for their negligent actions.

For exameple, if someone owns a gun but keeps it locked in a safe in their house and stores the ammo somewhere else, yet some master thief manages to steal their gun and use it in a crime, I doubt anyone would say that is the fault of the gun owner. However, if the same gun owner left the gun loaded and laying around on their front lawn and someone came by, picked it up, and shot somebody, they would be sued and/or arrested for their negligence.

The problem is determining at what point is a computer user negligent. Is your average consumer negligent for connecting their Windows box to a high-speed connection and not using any firewall software? Or is it someone who turns on various services like file sharing without knowing full well what they are getting into? Or is it anyone who takes reasonable precautions, but when they get cracked they don't realize it until their box has had a chance to eat up tons of somebody else's bandwidth?

Re:Computers are not Cars, but even so . . .

[MrResistor]

The key is to hold those who crack systems accountable for their actions

We already do that, and have done so for years. It doesn't seem to be working, and the primary reason for this is because there are too many unsecured systems available to perpetuate these attacks. Any real solution to the problem has to take that into account and provide motivation to the owners of those unsecured systems to take appropriate precautions.

Notice that i said "unsecured", not "insecure". Like most things in Common Law, intent is very important here.

and to educate victims about how to better secure their systems.

How much more do we need? Every time theres a major virus going around I see a report on the evening news, and by the time it gets that big there is generally no shortage of information available about the virus and how to defend against it. I can't remember the last time there was a major virus that wasn't exploiting a hole for which a patch had been available for months.

Clearly education alone is not enough, the "victims" need to have a reason to pay attention, or all the education in the world isn't going to do a bit of good (you know, kind of like now).

Those users unwilling or unable to secure their systems should pay third parties to secure their systems for them.

Why? Think about that from this hypothetical users perspective. They've managed to get the machine up and running and serving pages on their own, what motivation do they have to go to the added expense?

Right now there is no motivation other than the desire to be a "good netizen". Most people don't have that desire at all. Go ahead and take an informal poll next time your walking down the street. Ask how many people are willing to pay even for an antivirus subscription. I think you'll be unpleasantly surprised.

Stupidity should be painful. If leaving your system wide open makes you liable for negligence, then I would say that is effective motivation to either learn something about security or pay someone else to take care of it for you.

Public Responsibility

[stobesel]

If you witness a 16 year driving a stolen car while drunk, it is your responsibility as a member of society to either stop him (if possible) or notify the appropriate authorities. The owner of the vehicle is not usually notified of the crime until after the fact. And any damages incurred to the vehicle are not paid by the police or arresting individual. If you own a car that CAN be stolen and used to commit property crime, then you assume a certain responsibility to do everything possible to prevent this. If after that, it is still stolen, then any damages that happen to it are your problem (and your insurance company's). If you leave the 'keys' in the ignition and the doors unlocked, don't blame me for the flat tires my spike belt inflicts while trying to protect my family!

Bad counterexample

[wiredog]

How about if we made it YOUR fault if someone breaks into your house whie you're away on holidays, breaks a gas line or something, and then the house explodes and devastates the neighbourhood? After all, why didn't you secure your home?

That's the way it is already. If you left your door wide open, knowing people were going into houses and blowing up entire neighborhoods, you would be responsible. If the lock was defective, and the manufacturer knew that and didn't take corrective action, then they would be responsible.

Re:Bad counterexample

[Garin]

Um, what? No, no, no. You leave your doors open, and it's -your- fault that someone comes in and blows up your house? That is laughably false. About the only difference is that the hypothetical bomber may not have committed break-and-enter (here I believe it was referred to as the "thin man" exception -- if you're thin enough to get in the door without pushing it open, then you haven't committed a B&E. I've heard they've since tightened this up so that even a "thin man" can be charged).

You're seriously mixing up negligence and criminal responsibility. If I left my sidewalk icy and unshovelled, I may be negligent if someone slipped and fell. That person, through no fault of their own, was hurt because I didn't do something that I may be responsible for doing. You're mixing this up with criminal responsibility by saying, "Ah but you are responsible for locking your doors and keeping your house break-in proof! It's your fault that this person broke into your house and bombed the neighbourhood" Um, no, definitely not. The -bomber- is the only person who is responsible for the bomb going off. People are responsible for ensuring that they themselves DON'T BREAK THE LAW, period. My securing of my house is merely helping honest people stay honest. That bomber deliberately chose to bomb the neighbourhood, and break those laws.

It's exactly the same with computers. Some idiot l33t kid decided to root my box and use it to attack other people. That l33t kid is the criminal, not me. End of story.

Try it and you'll go to jail.

[theLOUDroom]

"I believe you should have the right to neutralize a worm process running on someone else's infected system, if it's relentlessly attacking your network"

You don't have that right for lots of good reasons. Do I have the right to go into someone's house and unplug their stereo if the noise is annoying me. Nope. Should I? Of course not. If the noise is bothering me I'm supposed to call the police. If the attacks are bothering you, call their ISP. Vigilanteism is not the way to handle things, escpecially since what they may be doing might not even be illegal, but what you might do in response is.

Here are some good reasons why this guy should not be messing around with other's computers:

• What if he breaks something? What if he thinks he's fixed the problem, but in the process looses critical data, causes loss of services, etc?
• How do I know I can trust whoever decides to break into my system and "fix" something. Many times the only way to be sure you're secure after you've had an intruder in your system is to reformat and reinstall. If I find out that this guy has broken into my system, in order to be a responsible sysadmin, I need to reformat and reinstall just to be safe, in case this wonderfully helpful person has installed a rootkit so he can be "helpful" again at a later date.
• What's to stop someone from using this as an excuse to break into a computer? Why not just break into a PC the is vulnerable to worm X, do anything you want with it and then modify the logs to make it look like all you were doing was fixing their worm problem.
• Making something like this legal makes computer crimes harder to prosecute. I would not only have to prove that someone accessed my system without authorization, I would have to prove that they weren't doing it just to me helpful. That's going to be hard to prove and the burden of proof is on the prosecution. He can argue that he only downloaded my "/etc/passwd" file so he could figure out what users are possible, etc.
• What if this guy thinks I've got a worm and I don't? What if someone decides to spoof some traffic just to make it look like I have a worm? What if I'm just running nmap? Can he still break into my machine, or can I have him prosecuted?
• What if someone's only trying to help me with my worm problem, but I think they've got a worm. Do I start hacking them? What if I mess up the PC of this person who was only trying to be helpful?

BTW, I had a linux box get owned by the ramen worm a couple years ago. I never knew (I rarely used the box) until I got a call from my isp (my school at the time) telling me they had recieved a complaint from someone claiming I was scanning their network. They said they would disconnect me if it continued. I fixed the box, didn't get disconnected and the world was a better place once again. If my computer goes haywire and starts doing things it should, I accept that it may be pulled off the internet. I signed a contract saying that. I did not sign one saying anyone was allowed to log onto my box without my permission and try to fix things. If someone breaks into my computer, I'll press charges. It doesn't matter if they say they were only trying to be helpful, I can't/won't trust them.
I have personal info on my computer. I don't want anyone else getting it. If I send them to jail and have their computer confiscated, I'll at least have a better chance that they don't have any of it.

God Damn Mongolians!

[Rand Race]

I believe you should have the right to neutralize a worm process running on someone else's infected system, if it's relentlessly attacking your network. I've even written code to demonstrate the process.

Code that will neutralize South Korea!?

ha

[frenetic3]

what if some h9x7r was more l55t than me though? i would get 8wn2d! :P

Intelligent Operating Systems

[Eisenfaust]

An operating system could be designed to selectively allow remote hosts control over portions of the system.

For instance an operating system could allow any host to kill the processes that had open sockets to that host. You could even narrow that down to allowing a host to kill any process which had an open socket not originated by the host. This would disable remote hosts from killing servers that they initiate connections to but would allow processes to be killed that originated connections to remote hosts.

At the operating system or even hardware level you could also engineer a system in which a remote host could request a stop on all traffic targeted at it. If this could be done securely people that were being targeted by another machine could request the operating system to stop all processes from directing traffic its direction.

You already know why, Wiredog.

[Anonymous Coward]

Because your EULA terms state that you will not hold the manufacturer liable, that's why.

huh

[stinky wizzleteats]

So, you want to implement technology where any random third party can kill processes on your servers? In what universe should security people "get this"?

Plaigarist! Karma Thief! Loser!

[wiredog]

Stealing someone else's insightful post.

Sounds like a Bush Man

[Anonymous Coward]

Quietly attack and justify it. hummmm....

Oh now, come on!

[Rocko Bonaparte]

You know you've considered serving a spiked cmd.exe for all those hacked boxes out there that keep asking for it!

Vigilantism

[Spazmania]

We do "get it." Its called "vigilantism" and in a country based on law its a bad idea. There's neither a need nor room for Wyatt Earp in the twenty-first century.

Re:Vigilantism

[PigleT]

Agreed.

It says two things: first, that you're worried your systems won't withstand an onslaught, and second, that you're immature enough to resort to vigilanteism when blocking sources could've been good.

Quite what a tool to do this sort of thing for you would accomplish is beyond me. The potential for auto-DoS (read: shooting yourself in the head) is quite high. The likelihood of contributing to the problem (increased traffic over an inadequate link, for example) is all the higher for it.

Read up on iptables -m limit, and see what happens.

Sloppy rights talk - this is about property rights

[djembe2k]

All this talk about rights and self-defense and vigilantes and vaccinations and putting down dogs is taking this conversation wildly off course. Computers are property, and this is about property rights.

Computers don't have rights or responsibilities. Processes don't have rights or responsibilities. If computer A attacks computer B (via a worm or whatever else.) and computer B "strikes back", self-defense is a fair metaphor, but it isn't a relevant legal or ethical argument, because the computer don't have rights.

Computers are property. More specifically, my computer is my property. I have a right to keep my property, and you have a responsibility to keep your hands off my property, and if you don't keep your end of that agreement, you've broken the law and I can bring the government into it.

Yes, your property rights are violated if my computer has a worm that attacks yours. Maybe the government will acknowledge that and step in, and maybe it won't. If you don't like the way the government handles this, elect somebody who will change it, write a letter to your legislators. But the government's refusal to step in doesn't mean, as Mullen asserts, that the owner of the attacking computer has no responsibility. It just means that the government has opted not to hold him responsible. The only way to fix that is democratically.

But suppose Mullen is right about that, and this person has no responsibility. He says "no responsibility means no rights". Wrong. The constitution says that no person shall be deprived of life, liberty or property without due process of law. In practice, that limits the action of government, not offended sysadmins. But the principle here is that my rights are my rights, and nothing I do, however, bad, foreits them automatically. Maybe, after a fair legal process, society (i.e. government) may decide to take away some of my rights (i.e. lock me up, fine me, whatever). But not before. That's a fundamental part of the social contract which makes us civilized.

Then Mullen makes a different argument: the rights of the many outweight the rights of the few. (Thank you, Spock.) Maybe. But the same principle applies. My rights are my rights. Maybe you can get a court order to require me to donate blood, if it will save 100 lives. But if you take my blood without getting the court order, you have still violated my rights and broken the law.

Now, if the guy who took my blood is a real hero, and believes what he did was right and necessary, then he'll say that going to jail is a small price to pay for saving 100 lives. Good for him. If Mullen really believes this is a case where the law runs contrary to ethics and morality, he can wear a grey hat and illegally hack systems for the greater good. But unless he's willing to wear a black hat, he'd better admit what he's doing it illegal, and a violation of rights, and be prepared to take the punishment when he does it.

IANAL, yadda.

Normally, yes.

[Anonymous Coward]

If you're a 95 pound paraplegic being punched in the face, you may use enough force to halt the attack.

If that requires a firearm, then so be it.
The court will back you on that one.

In other words...

[Junior J. Junior III]

While GuiltyOfThoughtCrime = True
Do
InvoluntaryElectiveBrainsurgery (GuiltyParty);

(* Thanks, but I think I'll pass. I'd rather own my own machine. *)

sounds like using a sledge on a thumbtack

[The Evil Couch]

his idea is a hell of a lot more invasive and more "wrong" than simply noting an attack, blacklisting the source and sending the ISP an email notifying them of the situation.

I realize that it's frustrating as a sysadmin to see attacks from the same place, by the same virus/worm all the time, but the answer isn't a counter strike. it's to simply contain the virus and let the people that are infected unfuck themselves and learn from their mistakes.

besides, even if it weren't morally and ethically wrong, just who would control such a program? would sysadmins have to be federally or state liscensed, much like concealed weapons holders? who would be there to ensure that the vigilante sysadmins weren't abusing their abilities and crushing boxes left and right, then claiming that they were being attacked.

no, a knee jerk reaction of "wtf! this mother fucker's infected and trying spread it on to me! fuck him! I'll fuck his box up for that shit! stupid dumbass n00b!" isn't going to advance the Internet community, sysadmins or users anywhere. just stick to blacklisting IPs and domains. it works.

death wish, the internet worm...

[LifesABeach]

gee roland, then if i can show that some event is going on in your house, and i can find some people who agree that it is a bad thing, then i can just go on inside your home and break that event generator? now that's 'getting it'.

am i missing anything in your thesis?

Toaster Oven

[wiredog]

You can start a fire with a toaster oven that takes out an entire row of condos, but nobody legislates that you have to clean your toaster oven every 30 hours of use.

Sure they do. Through negligence lawsuits. It's why you have homeowners or renters insurance. So that when you negligently forget to clean your toaster oven and burn down the entire row of condos your insurance company pays for the damages. Unless you have insufficient insurance, in which case you pay the damages.

Re:Toaster Oven

[swordgeek]

Hmm. You'd have to be pretty negligent to have a dirty toaster oven cause a fire. I can't imagine that a lawsuit like that would stick, but that could be because I've been away from the US for five years now.

Even so, my point still holds: Toaster ovens aren't a licensed item, and if someone is negligent, you would sue them for damages--not have them arrested for breaking the law, nor hunt them down and make them pay.

If damages are caused (and fairly assessed), and negligence is clearly proven, then a damages suit is (perhaps) a fair cop.

flawed analogies

[Anonymous Coward]

I have never before seen so many flawed analogies in one place. Do so few of you actually understand computers that you must relentlessly compare them to something else in your life?

what ever happened to:

[CakerX]

whatever happened to hosts.allow and hosts.deny on a firewall??? simple answers to simple problems.

On a legal level this should be peachy. If your server is being attacked, you should be able to respond. On a systems security level, this is NOT OK. Giving access to other companies/entities to shutdown proccess on machines which they are not entitled access, is more of a security hazard than what it intents to fix.

Removing THE worm

[Anonymous Coward]

Ok, so does this mean I could finally write my worm removing tool, Remote Windows Uninstaller?

Code green?

[nochops]

Does anyone remember CodeGreen?

This was a worm that propagated like CodeRed, but instead of diong malicious things, it patched the insecure system.

There's also CRclean, which does the same, but only to machines that attempt to infect it first.

Make ISPs responsibile

[spells]

As part of the service agreement, ISPs should be allowed to test for security problems prior to allowing new machines / customers access. As new vulnerabilities arise, the ISPs should test again. Machines with vulnerabilities are not allowed on the network. That is more palatable to me.

Anyone besides my ISP attacking my machine should be illegal.

Not a good idea at all

[Anonymous Coward]

Every good Bleveskovolokian could tell you that this idea just won't work. If a system such as the said system was to gain popularity the writers of the worms could easily guard against it by fixing/blocking the service that they exploited to get in. Once this is done, and it wouldn't be difficult, it would become impossible for this method to work unless of course they decided to scan a whole list of known exploits, but that seems kind of scary.

The ethical consequences here are too much. Nobody better be messing with my box. It's illegal for a reason. If you think something is wrong with my box you should contact me and I shall be the one to repair it my way. There is of course a much better alternative than what this guy is recommending. Write a little script that automatically blocks the attacking IP either on the local system, firewall, or router. Once this is done their attacks will not harm you (except for occasional slight wasted bandwidth.) If you break into my box you will be prosecuted.

"Vigilante" is such a dirty word

[Anonymous Coward]

Call me a gut-toting American libertarian, but I don't see anything wrong with "vigilante" action when it's done on the immediate, tactical level -- and with accountability afterwards. Where I live, it's perfectly legal to kill another human being under certain circumstances instead of waiting for the cops to deal with the problem (e.g. imagine someone's trying to kill you). Homicide is not necessarily murder, and (counter-)attacking some else's computer isn't necessarily computer crime.

If someone's computer establishes a relationship with your computer by initiating activity, and their computer is not acting with the sincere intent to communicate in a meaningful manner, they have waived certain rights they would normally have -- just as a person who points a gun at me has waived certain rights they would normally have. I'm not saying any of this frees the "vigilante" from having to answer for their actions later if they act inappropriately. But to say they shouldn't be allowed to act at all (whether it makes sense or not) simply because it's "vigilante" action instead of government action, is just wrong.

If my modem's bandwidth is being used up by some jerk's 64K pings, I have the right to try to do something about it right now, and shouldn't have to wait 2 weeks for some 'net cop to look into it.

Admins would notice?

[towaz]

I think this would be a good idea but a lot of preperation will need to be done and the code constantly reviewed until release in the wild...

But in the event of this virus actually doing more wrong then good in the wild what would happen then. I would if working on this sort of thing have installed a backdoor, which I realise now was also Max Visions intentions with his worm incase it joined the dark side.

My other point is a lot of admins would not realise they were dis/infected in the first place....we can not keep sending out worms to sort out the Incompetent admins everytime they is a new worm...the internet is already noisy enough.

.

universal morality?

[spazoid12]

Thinking like this is predicated on a person's sense of right-and-wrong. This guy believes something should be fixed on someone else's machine. He might be annoyed to know that someone else's machine is not as he'd prefer...but in practice all he has is an opinion.

I happen to believe that there is a universal morality. But it's a big step from believing that...and meddling with other people's private lives and personal property just because you might think they are wrong, or ignorant, or merely unaware and you're doing them a favor.

Obvious considerations fall out of this proposal. The RIAA might think it is right in it's preemptive meddling with my personal property. Or, what if the software designed to do us all a big favor was designed to roam the net like a bot looking for viruses? Would it always know what is a virus and what is not? Would it delete the wrong things? Would it delete harmless collections from some kind of museum of viruses?

Can I...

[paxgaea]

Can I get this with a Quake 3 front end?

Incompetence?

[EvilBudMan]

--That, I think, is a good point. The solution, however, is not to make the counterattack legal, thus continuing to absolve people of responsibility, but to make the owners of the systems legally responsible for their failure to secure their systems. If your system is 0wn3d and used to launch a DDoS attack on AOL (or Slashdot, Kuro5hin, whoever), then AOL should have the right to sue you for damages. Your incompetence caused their loss.--

What about the software companies that make their software so easy to exploit? I doesn't seem fair that the user should have to keep up with this 24/7.

Gut-Toting American

[Anonymous Coward]

Er, I mean to talk about toting guns, but I seem to have caused some confusion. As all you Europeans out there know, all Americans are fat and armed to the teeth. The only reason we don't regularly have gunfights on every street, is that we are too fat to walk down the street. We would rather drive (because it's less tiring) and shooting at each other from cars is less personal and satisfying than doing it on foot (although it is becoming more accepting in L.A.).

Regardless, I meant "gun-toting" and the reference to my gut was a typo.

Totally irresponsible

[Perianwyr Stormcrow]

This policy would be irresponsible to both the owner of the system and the vigilante cracker.

System owners get in trouble because suddenly someone has another reason to mess with their machine. It's not clear-cut for even an expert- You might say that it's criminal negligence to leave a system unsecured. Actually, no. We don't have the legal definition for these things yet. Furthermore, there's already an incentive for system owners to secure their own machines- the integrity of their own services and data.

Vigilantes are also on thin ice because it's easy to do more than you intended when "defending the law", and even the cops are in danger when they fuck up. What will you do when you accidentally cause collateral damage in the commission of your act of citizen policing? What if you just have the totally wrong machine? You don't have the authority of a uniform and a department to back you up.

All in all, this is a thoughtless proposal that should never be accepted by any legal authority worthy of the name.

The rights of the music industry and the few

[Concerned Onlooker]

How is going into someone else's PC to kill an offending process substantially different than allowing the record industry to legally crack PCs in order to see if someone is pirating music?

I'm guessing that one will be allowed and one won't. You can guess which one....

It's exactly the same with computers.

[wiredog]

Exactly what I'm saying! Some idiot l33t kid decided to root your box and use it to attack other people. But you were the one who didn't take reasonable measures to prevent the rooting, such as applying the appropriate patches. You were negligent and your negligence resulted in damage to other people. That's why you have insurance.

Re:It's exactly the same with computers.

[Garin]

No. You are not negligent when someone else commits a crime against you (or someone else). You are not responsible for ensuring that it is impossible for another person to commit a crime (even to the best of your abilities). I am no more responsible for someone rooting my box and using it against someone else than I am responsible for someone grabbing my steak knife at the dinner table and stabbing someone in the chest -- even if I happen to be sitting next to an ex-con!

Negligence is when you allow something bad to happen by an omission, a failure to do something that you are responsible for doing. In the case of shovelling the sidewalk, people have the right to walk down a sidewalk. By doing something they are entitled to do, they are endangered by the fact that you have neglected to shovel your walk. However, here is the crucial difference: that l33t idiot has absolutely no right to be using your computer in the first place!

Now, as far as an -insurance- company goes, that's a whole different matter. If a company has a box that is rooted and destroyed, one day I hope the time will come where they will lose any claim for damages they make if their computer is not adequately secured. People don't have "hacker" insurance yet, but one day they probably will.

My point is this: it is not your fault if you are the victim of a crime. Another (inflammatory?) example: no matter how scantily-dressed, a woman is always the victim of a crime if she is raped. Is it -stupid- to leave your computer unsecured? Sure it is. Just like it's stupid to leave your doors unlocked, or to walk in a bad part of town at two am wearing a mini-skirt and a halter top. However, neither one makes it your fault if someone else breaks the law and takes advantage of the situation.

Laws are laws, and it is your duty to follow them. It's not my duty to make sure that it is impossible for you to break them.

Can you imagine the sort of vigilante society we would have if that were the case? People's houses would be booby trapped. Mail carriers would get shot. Meter maids would be beaten as would-be car thieves.

Let me repeat one more time: It is your duty to obey the laws. It it not my duty to make it impossible for you to break those laws. That is the essence of my point.

Re:It's exactly the same with computers.

[juhaz]

I woulndn't be betting a very large sum on your unyielding faith on neglicence being absolutely and one hundred percently being wiped out whenever someone does a crime as a result.

If you leave a loaded gun on somewhere where a lunatic gets hold of it and shoots someone, OF COURSE you are responsible of very dangerous negligence even if he did commit a crime of worst sort.

If you leave doors wide open into your working place and someone steals all the stuff, YOU will get fired, and very probably sued. Even if it was someone else that did the crime.

If you leave your server wide open and someone "walks in" and uses that "gun" to "shoot someone", you should be just as much responsible as you are with those physical doors and physical weapon.

Re:It's exactly the same with computers.

[Garin]

Nope. Still doesn't work.

If I leave the doors unlocked at my office, I could (and should) lose my job. But, at least where I live, I cannot be charged, sued, or forced to pay for the losses. A friend of mine did *exactly* this recently -- she left the back door unlocked at the restaurant she worked at after closing up and leaving for the night. The restaurant lost about $100k in theft and damages that night. She lost her job, and the restaurant tried to make her pay for the losses (her parents are fairly well off) -- until they talked to their lawyer and were advised that they had no claim. Essentially it came down to exactly this: she did something really stupid by not locking up and so she could be fired, but that does not mean she's responsible for the theft by making it easier for a criminal to commit. The thief chose to steal those things, so the thief is responsible for the losses, period.

In the end, insurance paid for all the losses, as it should. Also, the restaurant's insurance premiums went way up, as they should. My friend lost her job. The thief was eventually caught, and is spending two years in jail.

Similarly, if a criminal takes my gun and shoots someone, only the criminal has done something wrong (assuming, of course, that I have complied with the law in my storage of the gun etc). I don't know what the laws are like in your area, but here it is illegal to leave a firearm laying around in a public place -- that is, the criminal would have to commit a crime (B&E) to get the gun in the first place. Do I need a super-duper security system to not be negligent? No. Heck, I don't even need to lock my doors.

We're talking about a moral obligation versus a legal responsibility. Morally, I am required to keep my employer's store locked. But remember, all this is doing is keeping honest people honest! Ultimately, every criminal makes a conscious choice to commit a crime.

It's not my responsibility to make it impossible for you to commit a crime. If you seriously think it through, you'll realize that it's a requirement that's impossible to satisfy in a logical and peaceful manner. I don't know where you live, but if you live in a place like that I suggest you move to a more sane place.

There are situations where I am negligent if someone commits a crime. I am negligent if I know it's happening and I do absolutely nothing about it and permit it to happen. In fact, in many cases I'm actually a criminal (eg. if I know someone is going to murder someone else and I don't say anything about it). Similarly, if I discover that my computer is being used to commit a crime, and I continue to let it happen and I don't fix the problem, then I am negligent.

Think about it: where would you draw the line in computer cases? Is it negligence if I allow anonymous logins to my computer, and then they are used to launch attacks? How about if I restrict the logins so only people who sign in with their real names can log in? What if I restrict it to just my friends?

Now as far as security goes, how secure do I have to be? Do I have to be invulnerable to any known attack? Good luck!! I'd be willing to wager that there isn't a single system connected to the internet that is invulnerable to every known attack. Do I just have to deal with those vulnerabilities that are published on Bugtraq? SANS? And within what window do I have to apply patches as they come out? That day? That week? And what networks does it apply to? Internet only?

Finally, I would not be surprised if, in some parts of the world (especially the US), these sorts of things really ARE negligence and you really WILL be sued for them. My argument is intended to persuade people that applying this to computer security is a very stupid idea that will only bite them in the ass in the end.

Potential attacks.

[Anonymous Coward]

I think the US has the right idea, pre-emptive action. If there is a possibility of attack, take 'em out. No proof required.

Well, what do you know. . !

[Fantastic Lad]

Goodness! I do declare that I am actually proud of my fellow Slashdotters this morning!

With overwhelming opinion stacked against a *B*A*D* idea, (in this case, the use of gratuitous, crotch-hardening force to solve a problem which has been proven in the past to be fixable through any number of other effective options), is refreshing to say the least!

I don't even have to use the analogy I was brewing up while reading the headline, (but will offer here anyway just as a point of interest and cuz I don't like to let even a half-assed brain-wave to go to waste.).

Quoth he: "We should go an' git them suckers afore they come an' git us again!"

Quoth me: "Yeah, them suckers in Iraq is dangerous! --Even though they ain't really done nuthin' to us yit. A'corse the presidint sez theyz fixin' to! An' if we change the law tah make it leegil to start blastin' away without due and open process, (or any rationality whatsoever), then all's I gots tah say is, Yeeh haw! With a ticket like that, it's open season on everybody so long as we can claim de-fence 'gainst a foriegn threat, (which of course we wouldn't even have to prove seeing as how properly demonstrating that a threat exists would make the situation easy to solve through a non-violent and publicly acceptable means!) I bin fixin' fer this ever since that day I got a hard-on when we waz blowin' up frogs with fire-crackers!"

Quoth he: "No, ya inbred hick! I ain't talkin' 'bout Iraq. I'm talkin 'bout them worm-wranglers on the nixt com-pewter over! Ainchoo listnin to a dang thing? Now gitcher dang 12 gauge an rev up the 4-wheeler! It's open season on everybody so long as we can claim de-fence 'gainst a foriegn threat, (which of course we wouldn't even have to prove seeing as how properly demonstrating that a threat exists would make the situation easy to solve through a non-violent and publicly acceptable means!)"

Quoth me: "Yee-haww! Lord praize these post 9-11 daze!"

-Fantastic Lad

i agree

[Anonymous Coward]

if a person was battering at my front door, i have the right to take steps to stop that from happening. if that person's dog was battering on my front door, i have the same right. if that person didn't know that his dog had rabies and it was battering on my front door, i still have that right.

in all cases, i think i have the right to protect any and all of my property, even if it is just a bunch of magnetic storage.

Technique Won't Work Anyway

[jishcat]

All of this discussion is irrelevant, since this technique can be easily circumvented. All a virus writer needs to do to not be vulnerable to rehacking is make sure the hole that it orignally used is closed.

Of course, the defensive rehacker could attempt to use other exploits than the one attempting to be used, but that doesn't seem likely. The worm could close as many exploits as it could to prevent this.

The interesting thing is that a worm could end up have the effect of making your computer more secure by protecting itself from counterattacks.

This leads one to consider a similar idea of worm like updates. I'm sure it's been thought of before, but what if, for example, a Windows exploit was found, and so a worm was released that looked for the exploit, infected, repaired the hole, and then tried to propogate. After a time, the worm could simply expire with the only damage being done that it fixed a security hole. In this way, the good worms would compete with the bad worms, which should at least cut down the damage done by any one exploit by 50%. Kind of reminds me of the good bacteria and bad bacteria that live in the human body. Simply the fact that something "infects" a host, doesn't mean it is bad!

How about a "process firewall"?

[Anonymous Coward]

Why allow any "unwanted software" to run at all?

http://www.geocities.com/ichinin/appwall.htm

I wrote this app a while ago (*) to effectively toast any crap i didn't want to run without my permission, I hope that anyone find it usefull.
(* the tutorial doesn't match the pictures)

P.S: No - i'm NOT giving the source away.

No responsibility means no rights

[-ParadoX-]

This is a much more frightening spector than anything else Tim mentions in his column. This mantra can and would be applied to many other areas if such a policy became commonplace. Apply this to dissemination of knowledge. Suppose I have data available on my webserver that is viewed as "malicious" say how to build a bomb or exploit commonly known vulnerabilities in a web server. Does this give someone the right to remove said data from my server simply because I have a disclaimer saying I have no responsibility for how someone might use this data? This sounds like a piggy back onto another round of "strategic protection of US citizens" i.e. read "strategic reduction of fundamental freedoms of US citizens".

"No responsibility means no rights" gimme a break.

Re:People don't like this (NOW WAIT A MINUTE!)

[cardshark2001]

What must happen is not System Administrators "hacking" every computer in the internet infected by code red or nimbda. What must happen is legislation that makes every person running a computer personably responsible for the security of that same computer. If people don't secure their server they must be penalized, instead of letting us fix the problem... even if they want us to.

Every computer connected to the internet is a "server". I'm sorry, but my grandmother does not deserve to be put in jail because she didn't know enough about computers to apply the latest Microsoft service pack to her Windows box, to patch a problem that Microsoft created in the first place.

There is probably a good solution to this problem, but making ordinary people "responsible" for the bad coding standards at Redmond is NOT IT! If someone trespasses on your property, then shoots someone else, are you responsible because you failed to secure your property? If you buy a defective coffee pot that you use as directed, yet it catches on fire and burns down your apartment complex, are you responsible?

The answer is no, but perhaps the manufacturer of the coffee pot is.

Where have I heard this before?

[asb]

Let's think about this for a while.

How does this scenario resemble the situation in Afghanistan?

Re:Where have I heard this before?

[asb]

Maybe if I explain this to the ones that did not get it.

- Terrorist organization attacks USA from Afghanistan.

- Afghanistan refuses to destroy the terrorist organization.

- USA bombs terrorists in Afghanistan.

Do you get it now?

maybe add a eula...

[Anonymous Coward]

just to get more lawyers in on it.

setup scripts/root.exe to a eula with i agree being msadc/root.exe, which will then attempt to take down the worm.

its not an attack but a service/product the server had to agree to, right?

<a snip from my logs...>
[Wed Jan 15 01:15:24 2003] [error] [client 64.172.131.88] File does not exist: /domains/abcnet/htdocs/scripts/root.exe
[Wed Jan 15 01:15:27 2003] [error] [client 64.172.131.88] File does not exist: /domains/abcnet/htdocs/msadc/root.exe
[Wed Jan 15 01:15:30 2003] [error] [client 64.172.131.88] File does not exist: /domains/abcnet/htdocs/c/winnt/system32/cmd.exe

White worm

[jhines0042]

Hey, has anyone ever written a worm that somehow benefits the "infected" systems by ... say... killing off other viruses?

Imagine a worm that installed an antivirus program....

could we call this an innoculation?

The main problem I see...

[Jester99]

with Mr. Mullen's proposal, is this.

He sees the world this way: 1. People are negligent, and allow machines to become compromised, which allows harm to come your way. 2. Therefore, if people will not defend their own machines, you should be able to defend yours by disabling theirs.

This is a little like the following: 1. People are negligent, and allow their cars to get stolen, which allows hit-and-run drivers to take you out with them. 2. Therefore, if people will not defend their own cars, you should be able to defend yours by being given a rocket launcher to disable theirs.

The second example sounds kinda weird, doesn't it?

I've watched "World's Scariest Police Chases" and suchwhat. If a driver's acting like a maniac, the police bust out these cars with large ramming devices on them, and beat the crap out of the offending vehicle. If someone is driving recklessly on the highway, I can't just take my SUV and ram them off the road myself.

While I may have justification for doing so -- after all, that driver is endangering me and those around me -- I do not have authority. There is a reason that only police are given the power of arrest and other various things they have. (Just try walking around with a pistol in broad daylight in Philadelphia, for example.)

Mullen would have us all issued shotguns, to defend ourselves from any would-be vandals and thieves who enter our homes. While it is justifiable for us to use these weapons against those who would cause us harm, is it really wise to give everyone a shotgun? There are most certainly those who would use them improperly. The obvious solution, of course, is to give everyone some sort of shield, that prevents them from being hit by a shotgun shell, to protect us from bad users of shotguns. But, uhm, then shotguns don't work against the vandals, because they have shields too. So a perpetual arms race against ourselves would develop.

There's a reason weapons aren't issued to us for our own defense -- collectively, we are not responsible enough to operate that way. Only special agencies are given the Authority to administer Justice; justice itself does not belong to the rest of us. Unfortunately, we don't have an "internet police force", nor would one even be desirable.

But ISPs can still pull the plug on users who aren't operating "correctly," and University and other networks can block down a MAC address if it's causing trouble. And that's about as close as we really should want.

Yes! No more patches!

[burningd]

I like that idea. Now I can fire most of my Sysadmins because all holes are automatically fixed by strikeback.
This is what I call effective outsourcing.

OT - Praising this discussion

[SamTheButcher]

Since I have no mod points presently, I'll just post offtopic and say that this thread is one to be noted for intelligent, informed discussion, and I applaud Pii and TFloore for their insights and intellectual openness.

Thanks for the opportunity to think.

Trust us, we're the good guys.

[SecurityGuy]

There's a common thread in these ideas, and that idea is the subject of this post. "Trust us. We want to do something which would in normal circumstances be condemned as unequivocally bad, but it's ok, because we're the good guys."

RIAA: We want to hack back because we're the victims of piracy.
DARPA: We want to track all the minutiae of your life because we want to find terrorists.
Mullen: We want to exercise a(n admittedly limited) degree over your systems because they're harming us.

These notions aren't necessarily wrong, but any proposal to allow people to be exempt from laws or standards of conduct because they think they have a good reason to be bears careful scrutiny. IMO, this isn't much better than those users who just can't possibly get their job done without having the root password, in spite of the fact that everyone else does. We do not need the ability to manipulate others' systems to suit our security needs. I'd suggest a much better solution is responsive ISPs at all levels. If you're hosting a DDoS client, cut their feed and we mean now, or we (the guys above you) cut yours. Likewise, if we don't cut you off, we get cut off by the guys above us. Perfect? Nope, but I'm more comfortable with this than letting any yahoo who happens to think they're under attack by my systems have the right to cause my server to start or stop doing things without regard for the outcome.

Mr. Mullen's idea isn't stupid and it might not be "bad", but it is definitely not the right solution.

Weapons of Mass Irritation.

[Ayandia]

Great, now evil has ANOTHER weapon.

...what? You thought only good guys would be able to do this? HAHAHAHAHAHAHAHHAHAH!!!

almost forgot

[evenprime]

Pii said, "Wow, great response..." thus giving me cause to smile.

I forgot to add that the courts have, in the past, interpreted the Oklahoma Computer Crimes Act of 1984 in a very strict manner. For example, Ryan Breding was running a warez site at OU in 1997 and was prosecuted not only for the copyright violations, but also for violation of the OCCA because the popularity of his site affected bandwidth at the school. Another words, under the 1984 OCCA, simply having a site that is more popular than your provider anticipated can be a crime in Oklahoma if that impacts the bandwidth of your provider.

How is that germane to the current topic? Well, I suspect - remember IANAL, and this is only opinion - that the same courts that decided slowing a school's connections is a violation of the law would also consider interrupting the function of a webserver by causing a reboot to be a similar violation. Further suppose that the target system is a) in Oklahoma, and b) running NT...

smbdie is my favourite

[vandan]

Whenever some Korean faggot spams me, I do a:

smbclient -L $IPADDRESS

From this I get the netbios name of the computer, and then do a:

smbdie -i $IPADDRESS -p 139 -t $NETBIOSNAME

This blue-screens the offender's computer. When I'm satisfied it works (some people have patched their systems), I add it to a cron job to repeat every 4 minutes.

So the spamming faggot doesn't get a chance to spam me as he is continually rebooting.

So yes I agree 100% with the suggestion that we take down others' malicious processes. If only it were so easy to bring the US military industrial complex back into line...

CC & Rs?

[RoboProg]

I'm sorry, sir, but the CC & Rs of our network neighborhood expressly forbid the presence of Windows 9x boxes unless they are hidden behind a fire wall. We are trying to maintain a pleasant, livable place here. Good day.

You can kill my gun...

[Behrooz]

You can kill my gun when you take it from my cold dead fing-...!

Wait...

Never mind.

Darwin. . .

[Fantastic Lad]

My previous modded to, 'Flamebait', eh?

Well, gosh-durn it, Son! Was it the Iraq analogy, a perceived slur against inbreeding, or is it simply that you are generally in favor of computer worms?

Speak up, Son! Don't leave me in suspense. I gotta know how to refine my routine. If I know what gets under your skin, then I can purify it and hopefully make you break out in hives some day! Stupidity-specific pathogens; that's the goal here, Son. --Seeing as how you're obviously not quite dumb enough for Darwin to have taken care of himself. (Where Darwin fails, the rest of us have to roll up our sleeves.)

-Fantastic Lad

Re:People don't like this (NOW WAIT A MINUTE!)

[Branc0]

Then fine Microsoft, fine Linus Torvalds, just fine someone. The sense of impunity is something that cannot happen because when people are imune to law, you tend to be your own law.

Your "right" to defend your systems

[davidarcher2000]

After reading the article and the discussions posted on the CounterPane site, everyone seems to be harping on the same issues over and over again.

First of all, people are using really bad analogies to try and prove their point but I think they're just missing what exactly Mr. Mullen is trying to say. Breaking into peoples houses, loud dogs barking, and slapping your neighbor's kid for mouthing off are just some examples of these (IMHO) "flawed" analogies.

I don't think you need an analogy to understand the situation. When is it ever LEGAL to be an unauthorized intruder in someone else's computer system? That's right, never. (If you have permission, it's not unauthorized. If you own it, it's not someone else's.)

The reasoning behind this proposal is to allow the "victims" of a "relentless attack on their network" the right to "neutralize a worm process running on the infected system". "Neutralize", in this context, can basically be read as "obtain unauthorized access to the infected system and terminate", presumably by exploiting some vulnerability in the system (since most modern OS's do not allow anonymous people to just terminate processes at will). However, in doing so, the "victim" here is assuming the role of an unauthorized intruder and thus breaking the law. And there's a damn good reason why things are set up like that (at least in the US).

Hell, even the police (supposedly), need a search warrant or permission to access your computer systems and read your data. Why would I want to give that ability to every "administrator" that hooks a system up to the internet just because they don't like the data that my computer is sending to theirs? If they don't like it, they have several available options including contacting my ISP to shut off my service, contacting their ISP to block my address at their upstream router, or (in the case of criminal actions) contacting the police. If what my computer is doing is not a criminal act, and neither my ISP nor theirs wants to act on it, maybe they need to find a new ISP or maybe what I'm doing is not a large enough nuisance for anyone except the "victim" to care.

Another problem with this proposal is what exactly constitutes a "relentless attack"? What about an attack that isn't relentless? What about unsolicitied commerical email (aka SPAM)? Who gets to say whether something is an "attack" or not? There is way too much "grey area" there for any sane person to just blindly give out ROOT LEVEL ACCESS to their systems based on such a statement (killing arbitrary processes is definately a root-level operation).

From his original paper, I found the following paragraph particularly troubling:

I say that we have the right to defend our systems from blatant worm attacks, and that we are within our rights to take measures to stop an attacking system from further infringing on our assets, consuming system resources and service availability, and from their ultimate attempt to compromise our systems.

He's talking about "Code Red" and "Nimda" specifically so I'll use those examples also. When you hook a web server up to the publically accessible internet, you are implicitly allowing other systems to send HTTP requests to you over port 80. How you can say that certain requests are "infringing on [y]our assets" is beyond me, but then again, I don't agree with much of the logic of Mr. Mullen's argument. And, yes, each request consumes system resources and if you get enough of them, it could affect the service availability of your web server. However, by putting up a web server, you are implicitly allowing such requests. As far as their "ultimate attempt to compromise our systems", that is a legal matter and should be tracked and referred to the police. You don't have the resources to do that? Well, how important is it for you that the "attacks" stop?

Sorry, Mr. Mullen, but I disagree with your proposal and your opinion that you should have the right to access my computer system without my authorization. Let's leave this up to the authorities and just worry about securing our own systems. Your "right" to defend your system/network from worms stops at my system/network.

It isn't the users it is the vendors

[Presence1]

"Someone who quite blatently leaves his or her keys in their car and parks outside bars would not be viewed by most people as completely blameless in the event that a drunk staggers out, takes the car, and drives it into a shop window.

Leaving a machine unsecured and unmonitored on the Internet is a sure-fire way of ensuring it is hacked and used to attack other machines. We know this. Yet people continue to do it. They do not secure their machines once hacked, and they allow their own machines to attack others once hacked. This is negligence, pure and simple. "

In the case of the car, this is true, since it requires no technical expertise to secure the car by removing the keys. Manufacturers have made efforts to design an appropriately secure system that is easy to use, and if we do not use it, we are legally responsible (in some states) for leaving the keys in the car.

However, the manufacturers of most computer software have NOT made efforts to make the software trivially easy to secure. Even for those with grea expertise, it requires significant effort (many settings, checks tests, etc.). Thus, holding a normal user responsible for the actions of a hijacked computer is unreasonable.

Requiring that one be an expert to hook up their computer to the net is also ridiculously elitist and unreasonable. It would destroy the internet as we know it when 99%+ percent of the people were disqualified from dialing up or getting a broadband connection.

Using a vigilante approach also makes no sense when we are attacking the computers of hapless victims who A. purchased insecure software when there is little practical other choice and B. had it hijacked by others who they have never seen.

We need to hold the vendors responsible to build stable and reliable software, with sound default values. Then, when someone deliberately DE-secures a box and hooks it up, it might be reasonable to consider strikeback action.

Re:It isn't the users it is the vendors

[Todd Knarr]

However, the manufacturers of most computer software have NOT made efforts to make the software trivially easy to secure. Even for those with grea expertise, it requires significant effort (many settings, checks tests, etc.). Thus, holding a normal user responsible for the actions of a hijacked computer is unreasonable.

Invalid argument. In any other area, if you operate something that you know you aren't qualified to operate and damage property with it, you won't be held not responsible because you couldn't have been expected to operate it properly. Quite the opposite, you'll very likely face even more severe penalties.

Yes, we should hold vendors liable, just like we hold manufacturers liable if they make a faulty product. But we should also hold users liable for either knowing how to use their systems or getting advice and aid from someone who does. "I didn't know how to drive." doesn't cut it, "I don't know how to use a computer properly." shouldn't either.

Re:It isn't the users it is the vendors

[Anonymous Coward]

You make a good point, and on the face of it, I agree that 'I done know how to drive' isn't an excuse.

The issue is one of degree, in particular the level of complexity involved.

Let's continue the driving analogy. You've taken driver's ed, have your license and have some good experience. Unbeknownst to you, I rig your brakes to randomly lock one wheel, and I can do this easily because I know how to exploit a flaw in manufacturer's design, which has been insufficiently tested. Are you responsible for the resultng crash?

I can argue that you are at fault because almost any top driving expert with professional/ high performance training and competition experience can almost always handle that situation (in fact, it is a standard car-control drill).

However, I don't think that that would be fair. In such a situation, the law would probably hold the manufacturer significantly responsible.

There is a concept called 'fail-safe', meaning that failures should happen in a safe mode, rather than a dangerous mode. E.g., a failure causes the thing to shut down, not to catch fire. Considerable engineering is required for most consumer products to exhibit such behavior.

Let's face it, computers are legitimately promoted and sold as basic business and household tools. They need to meet the standards of such products.

I would love it if eveyone had the professional driving training and high performance/competition experience as do my friends and I (as licensed racers). It is a great pleasure to drive with them. The raods would be FAR safer if that happened. But, it is unreasonable for me to expect society to make and demand that level of investment to use a basic utilitiarian tool.

Similarly, it would be great if everyone had years of technical training, knew several programming languages, understood sys admin and security issues, etc. (and even contributed to open-source...). But it is similarly unreasonable to expect that level of investment to simply shop and exchange email with friends and family.

This will happen. Remember that for decades, cars were extremely unsafe. I'm not arguing that there should be zero exploitable features, but that the basic product be sound 'out of the box', so that a user with an ordinary level of training will not create a hazard. That is the reasonable and legal level of expectation for a consumer product in this society

Re:It isn't the users it is the vendors

[Todd Knarr]

It depends, but generally yes I would be held liable. I probably wouldn't face criminal charges if the modifications were such that they wouldn't be immediately apparent, but I'd still have to pay for damages and injuries and such (or my insurance would). I would, however, likely be able to hold you liable for the modifications, and be able to sue you to recover what I'd had to pay out. I'd possibly also be able to sue the manufacturer for making a faulty product.

As far as expectations about computers go, they're irrelevant. Computers running lots of software are inherently complex, in the same way and for the same reasons that a 747 is complex to operate. You can make it easier, but you can't make it less complex without making it incapable of doing it's job. Either you adapt your expectations to reality, or reality will continue to smack you.

And when did people get stupid? I can remember when secretaries were expected to be able to write fairly sophisticated macro programs for Lotus 1-2-3 or WordPerfect. And they did it well, often better than professional programmers could. When did it become acceptable to not know how to use a tool you need to use to do your job?

Slashdot

[Unregistered]

Will site admins start attacking /. at any sign of a slashdotting.

I'll get toasted for this, but I'm on his side...

[Starman9x]

I recently started a very similar discussion(*) on my linux user group's chat/list, and got much the same reaction as is posted here. :)

One thing, however, that is common with all the detractors is the presumption that the "counter attack" would be all encompassing, i.e., "his system had a worm trying to infect mine, so I wiped his BIOS in return so the machine can't boot" [that would be seriously wrong...]

BUT that isn't how I (and I suspect the original author) interperet the situation -- someone mentioned the concept of a "surgical strike", and I think that is far more appropriate: "his system had a worm trying to infect mine, so I killed just the worm..."

Mind you, there should be a few other things that "should be done" in the process, mainly, notification (as best as is possible) that the offending system has "something amiss with it", actual pointers to process names or what have you [i.e., proof that it was indeed a "malicious process" and not merely thousands of slashdotters hitting the system w/browsers], notification that the one particular process was stopped (and a request not to start it until it can be verified as "clean" or whatever), and so on.

Yes, this will annoy those folks that are too lazy to take responsibility for their system's actions. They'll piss and moan and complain. If you have a "body of evidence" that you were acting in defense of your system and/or resources, and if this "goes public", then the sysadmin of the offending system will be exposed for the idiot that he is [IOW, a competent admin will clean up the problem, **possibly** thank you and/or acknowledge that there was a foul up, and life will go on without name calling or anyone's panties getting in a bunch.]

One of the threads drew an analogy of a neighbor's monkey throwing rocks and breaking windows, with the "solution" of "shooting the monkey, problem solved..."; my suggestion is that instead of shooting the monkey, clear the neigbors yard of any rocks big enough to break your windows :)

(*) the "discussion" was centered around some things I found in my web server's logs, namely "404 errors" for attempts to retrieve files with names like "../../c/windowsnt/system/cmd32.exe?...." [code red stuff] My premise is simple: "hey, he asked for the file, it just so happens that on my linux system the file 'cmd32.exe' is a script that copies a gigabyte of data FROM /dev/null"

ISP Liability

[Hyped01]

The other big issue (I think) is ISP liability. First, many of these "IP specific" attacks are competitor driven - I know, we receive thousands of such attacks a day, and SANS recently published a report indicating that competitor initiated worms, virii, attacks, etc are one of the top 5 reasons for virii and attack proliferation on the net.

So, since an ISP wont give you the customer's info without a court order, and obtaining one could take weeks or months, wouldnt it be logical, that when reported, after a certain period of time, the ISP becomes liable? I even beleive there are points of law to support this.

Point being, if so, how does one perhaps advise and enforce this on ISPs, and secondly, how does one implement a system that allows an easier way of dealing with this?

Currently, dealing with such "Internet Giants" as Comcast and RoadRunner have resulted in nothing but email after email after email, begging, pleading, explaining, complaining, and eventually threatening legal action - and regardless, no action but the automated response.

How much can you sue a negligent ISP for damage to image (for instance, spoofed emails with derogatory or virus laden content), loss of bandwith or other profit generating resources, etc?

I think this may be the big issue. With a simple "Check here what type of attack you are reporting" and a submission field for the IP address, a simple automated routine could monitor, verify and take action [whether informing a (for instance) Comcast tech or automatically blocking that type of/or all traffic from the offending IP].

For many types of attacks (other than Code Red, Nimbda, etc - this consists of 95% of our attacks), since they are ongoing till someone contacts the user and stops them (or blocks their connection which amounts to the same thing whther they are an innocent infected or guilty of initiating the attack).

These are some of the biggest causes of internet attacks. If you measure the number of businesses and the number of non-commercial entities on the net, and then factor int he massive number of attacks that were Code Red/Nimbda/The NeverEnding MS Hole Of The Week Saga... it's interesting to note that selective, planned attacks against businesses by (presumed by myself - and SANS - as well as others) presumably competition ranks in the top causes of such traffic on the net.

In addition, what most non-commercial entities never realize is, name an Internet worm/virus/script... tell me when you think it came out. Now, 80% of you are probably wrong. It came out many months if not YEARS before you think, and was used to target specific businesses. This includes Nimbda and Code Red and all their variants. The worms later make it mainstream. We had been receiving attacks like these often a year before someone shoved the vulnerability down MS's throat so they coudlnt ingore it. Stive Gibson at GRC has info on some similar incidents.

The ease of it is astonishing, especially with so many "script kiddies" and so many legititmate hackers - jump into an IRC chat room of such type, and claiming to be the business in question, tell them what type of losers they are. Or post such an post with "forged" headers in the newsgroups - it happened to us (newsgroup post). The ISP wouldnt help us, and by the time we knew and responded that the post was not made by us with "proof" ("well, you could have been on a dialin" - "um, not with those host names, which have never been registered to that dialin IP - it's a forged header on a fake post") - by then, attack bots were already being circulated on the IRC channels, much like the ones used against Steve Gibson, attacking us on average 30,000+ a day... some days hitting 6 digits. Our servers can laugh at that, but our bandwidth cant. And you cant firewall it either. Those scripts infect near anything with WinCrap on them. We had universities with OC3s attacking us, people from all over the world, you name it.

If you cant beat the competition, take down their servers. That seems to be the big motto.

If ISPs were liable for inaction, the attacks (including stuff like Nimbda and Code Red that could be blocked with simple filters in many cases) would eventually die off.

Just my 1 or 2 cents...

Rob

best way to kill processes...

[burns210]

http://psdoom.sourceforge.net/screenshots.html

Who wouldn't enjoy playing a good game of doom and blowing away any nasty process?

No problem, the law works that way already

[TekPolitik]

I believe you should have the right to neutralize a worm process running on someone else's infected system, if it's relentlessly attacking your network.

Technically speaking, you do. No, I'm not kidding. It's called the right of "abatement", and it's a right dating back a millenium or so. It's even a defence to criminal charges that you were exercising your right of abatement in a manner that was reasonable in the circumstances.

The problem with this is that they might still charge you.

Now if you're willing to take the risk, the right of abatement is a right to take steps to prevent a trespass or nuisance affecting your property or your enjoyment of your property, even if this requires violating the property rights of somebody else from whose property the trespass or nuisance originates. For example, if somebody sits outside your house at midnight, playing a ghetto blaster at maximum volume, and refuses your request to stop, you can slap them around until they stop, or smash the ghetto blaster. Legally, you will be exercising your right to abate a nuisance.

Yes, theoretically this could be applied against spammers and open relays too.

Doe sthis sound right to you?

[Anonymous Coward]

Since the owner of a system has no responsibility for the actions of a worm, or any malicious process, that runs without their knowledge, I submit that they also have no rights to the process. No responsibility means no rights.

So, if they have no rights to the process, there is no infringement against them when we neutralize it. If someone wants to claim that their rights were violated by our taking out the attacking process, then they should be held accountable for the actions of the process from its inception. They can't have it both ways.


So by that same token, if there is a thief in your house while you are away, he is perfectly justified in burning down your house to get rid of the thief?

The real problem.

[rtechie]

The key is to hold those who crack systems accountable for their actions

We already do that, and have done so for years. It doesn't seem to be working, and the primary reason for this is because there are too many unsecured systems available to perpetuate these attacks.

Most posters have failed to grasp that what Tim Mullen is REALLY complaining about is that law enforcement has been ineffective in preventing worm and other kinds of hacker attacks. He's right, but the reason is not because the hackers are somehow "unassailable" by law enforcement. It's because law enforcement spends very little effort in enforcing "cybercrime" laws.

See, in the USA it's a popular pasttime among politicians to pass new laws against X without even thinking about how that law is to be enforced, let alone allocating resources to do it. Consequently a great many laws in the USA go virtually unenforced. There are numerous other exmaples besides "cybercrime".

What Tim should be doing is lobbying for a "Cybercrime Enforcement Agency" that spends significant resources tracking down Internet criminals.

Now clearly a lot of ad hoc vigilantes attacking "offending" systems would consitiute significant resources, but as many other posters have pointed out the solution is worse than the problem. Such authority (if legally enshrined) would be incredibly open to abuse, and everyone knows this. Other posters have pointed out that they have "struck back" against worms and other attacks even knowing that it was illegal to do so. But the subtext behinds this is that they were willing to "strike back" because they knew that there was little chance they would be caught and punished. This is literally the exact same thinking that led them to be attacked in the first place.

Tim Mullen shouldn't be suprised that the white hats are aligning against him because his solution and his thinking is exactly that of a black hat. He's justifying hacking into others computers by making the claim that he's "doing no harm" and that in fact he's actually helping them. Exactly the same arguments that many "grey hat" crackers make about breaking into systems but not damaging them. To most white hats, systems are "private" and there is no justification for vigilantes to break into them.

This contraversy remids be quite about of the blacklists of spam sites and open relays that are being propogated. The huge difference here is that the blacklists are voluntary limitations people put on thier OWN property and servers, and opposed to changes to other people's property and servers. And analogous situation to what Tim proposes would be hacking into other people's computers to shut down open relays or spam sites. The only difference is that creating and propogating worms is illegal and spam isn't (yet). However I fail to see why this should make any difference to a vigilante.

Why security experts object and users don't.

[Felinoid]

Security experts see themselfs as providing a service to individuals and not to the entire internet.
Preventing unatherised access is the holy grail of security.
But individual users do not see it that way. They don't see the harm in a cracker fixing a security fault.

Look at it like this:
Kids break into your home throw dogy doo everywhere and trash the place. Then a nabor enters though what was your front door cleans up the mess and gives you a new steal door with your same old lock (the lock the bad guys didn't pick when they kicked the flimsy door to splinters).
The cops arrive then you.

They are tecnicly tresspassing and interfearing in a crime seen. Do you care?
I'm the vindictive type.. I'd be pissed.

Last Post!

[alpg]

If I had my life to live over, I'd try to make more mistakes next time. I
would relax, I would limber up, I would be sillier than I have been this
trip. I know of very few things I would take seriously. I would be crazier.
I would climb more mountains, swim more rivers and watch more sunsets. I'd
travel and see. I would have more actual troubles and fewer imaginary ones.
You see, I am one of those people who lives prophylactically and sensibly
and sanely, hour after hour, day after day. Oh, I have had my moments and,
if I had it to do over again, I'd have more of them. In fact, I'd try to
have nothing else. Just moments, one after another, instead of living so many
years ahead each day. I have been one of those people who never go anywhere
without a thermometer, a hotwater bottle, a gargle, a raincoat and a parachute.
If I had it to do over again, I would go places and do things and travel
lighter than I have. If I had my life to live over, I would start bare-footed
earlier in the spring and stay that way later in the fall. I would play hooky
more. I probably wouldn't make such good grades, but I'd learn more. I would
ride on more merry-go-rounds. I'd pick more daisies.

- this post brought to you by the Automated Last Post Generator...