Slashdot Mirror
Hacked Companies Fight Back With Controversial Steps
PatPending writes with this report on companies taking aggressive steps to deal with electronic attacks: "Known in the cyber security industry as "active defense" or "strike-back" technology, the reprisals range from modest steps to distract and delay a hacker to more controversial measures. Security experts say they even know of some cases where companies have taken action that could violate laws in the United States or other countries, such as hiring contractors to hack the assailant's own systems. Other security experts say a more aggressive posture is unlikely to have a significant impact in the near term in the overall fight against cybercriminals and Internet espionage. Veteran government and private officials warn that much of the activity is too risky to make sense, citing the chances for escalation and collateral damage." If you've been involved in such an action, how did it work out for you?
Just remember, if a company asks you to break the law then you deserve what's coming to you when you get caught.
I simply drive to the GeoIP location with my illegal police baton and smack the head of whoever happens to be there at the time when I arrive. I've been doing this for a few years now.
Should you or any of the l33t team be killed or captured, the CIO will disavow any knowledge of your actions...
What are you going to do, DDOS some script-kiddie's computer?
The only time I've ever heard of something like this working out, it was when someone actually went to the effort to find out who was hacking them, and then turned the case over to the police. There was a story like that covered here on Slashdot several years ago.
"First they came for the slanderers and i said nothing."
I was doing due diligence on a computer security firm once who had be subject to a DDoS blackmail attack, you know, give us $5,000 or will we will keep your web site down. Well they back traced the control to some cyber cafe in eastern Europe and worked with the State Department to actually get the local police to go in and arrest the people involved.
If someone is actively hacking you then hacking them back isn't a crime (or it shouldn't be) its just self defense. And if you have to hire some firm to do it I don't see how it is any different than hiring armed security guards or private detectives.
If the law says you can't defend yourself from someone trying to ruin your business then the law is an ass.
-jon
They're shooting me, why can't I shoot back?
I got the location of the punks house and nailed his mom while he was in the basement.
Feeding time came around and mom did not bring down the hot pockets according the regular schedule and he peeked his head above ground.
Said, "Hi. I'm from the company you were trying to hack. By the way your Mom is quite talented. Going to be around more often"
Then we called his mother.
She unplugged his PC and told us she'd deal with him when he got home from school.
On the one hand you take life too seriously, and on the other, you do not take playful existence seriously enough. Seth
The hackee is going to hack the hacker? How exactly does that work? This would be like Poland invading Germany to get back at them for WWII; it probably will go about as well as the first time. Not to mention, in this case, it is quite likely the actual hacker routed through someone else's compromised computer, thus having zero effect, breaking the law, and only doubly slapping some poor SOB in the middle. Real reasonable, sensible, ethical activities here.
Great Intellect...
http://xkcd.com/538/
Obviously, they're in the process of developing Gibson's black ICE!
We should be afraid.
http://www.geoffreylandis.com
A cyber strike-back policy can turn out to be the more malevolent version of the attempt by some media monopolists to track and threaten alleged copyright infringers by IP address. But where the track-and-sue approach pays lip service to the law, this one's attempting the online equivalent of vigilante justice. It would be interesting what methods these "security" companies will resort to.
If the script-kiddie knows anything at all he'll be attacking from a zombie he's already "owned".
I think this is more sensationalism than fact.
My favorite part of the MyCleanPC spam is most definitely the names of the accounts
1. Never put sensitive data on a computer connected to the internet, unless it absolutely must be there.
2. Never keep sensitive data that you don't need, overwrite it, then delete.
3. Never put confidential data into any computer system, networked or not. If you must, do so only if it's encrypted and secured by strong authentication at all times.
4. Use all practical forms of security, firewalls, strong authentication, multiple networks with isolation, IDS, AV/anti-malware, no running as Admin/root, separate accounts for every user with appropriate access restrictions, including separate accounts for any services running on your servers, whole disk encryption, etc.
The first 3 are what I call the "Mr Miyagi" approach, "Best defense, no be there." Item 4 is what most companies focus on, but it's not nearly as useful if you haven't used 1-3.
make imaginary.friends COUNT=100 VISIBLE=false
Looks like he pulled a Wilson.
One of the troll's aim is for others to repeat "mcpc"
What you are doing is just that, repeating it, 4 times
Stop playing that troll's game
Stop repeating "mcpc"
Control your temptation
Muchas Gracias, Señor Edward Snowden !
There are companies that I know, who employed "private contractors" to do things that they can not legally do, to "make things right"
One of those companies, when its refinery was damaged by some African guerillas, got its own "private contractors" to hit back, and they hit back very very hard
So, I am not surprise of what they will do on the Cyberwar front - the "private contractors" can do anything for you, so long as you pay them
Muchas Gracias, Señor Edward Snowden !
They deface your website, you burn down their house. They bring down one of your servers, you kill their entire family. That's the Chicago way!
If you find this post offensive, don't read it! THINK ABOUT YOUR BREATHING! I am what I am because of how apes behave.
If you've been involved in such an action, how did it work out for you?
I have, and let me tell you, it was... hey, hold that thought for just a second, someone's knocking at the door...
#fuckbeta #iamslashdot #dicemustdie
I've been in contact about a job with a French cybersecurity company that has subsidiaries in 3 countries to be able to be able to offer 24x7 service, and, avowedly, do stuff (counter-attack for ex.) that would be illegal in France.
I don't have a big issue with counter-attacks existing, and being nasty (let's face it, if you beat on me, I'm gonna beat on you). I do have an issue with the potential for counter-attack evolving into spying and pro-active stuff. I'm sure they're doing it already.
The Cloud - because you don't care if your apps and data are up in the air.
Well, I found your post insightful and informative. I would like to subscribe to your newsletter good sir.
Om, nomnomnom...
I would think lots of honeypots, dead ends, and misinformation would be effective. It would be difficult for the hacker to know when they have accessed legitimate machines or information. That's one of the problems with typical security is that it typically provides confirmation when an access attempt has failed. If instead of indicating failed access, you instead direct them to bogus data, it would make the hacker's life rather miserable.
Better known as 318230.
Equal to "If someone breaks into your home, you should be able to break into their home."
More like, if someone is assaulting you you should be able to punch back just as hard, or hard enough to make them stop.
I would love to see full backing from the law giving companies full immunity to hack into systems who are attacking them and shut them down. If your system is compromised you do not have the right to have it keep running and attacking people. That is the responsibility any node on the network holds inherently.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Just throw in a bunch of nonsensical keywords that it might interpret as a response to a terroristic-type solicitation, in a way that is blatantly pointless from a human perspective, but will trigger a flagging of the spammers (well maybe your address as well, but that system is illegal anyways and it's not actually terroristic in any way, once reviewed by a human).
This will either scare the living shit out of the spammers, prompting them to stay the fuck away from your email address, bring them to the attention of various shady "counter-terrorist" agencies, perhaps prompting them to prosecute them for unsolicited spamming (doubt it), or both.
Bam, two birds with one stone. Fighting spam and bogging down an illicit and intrusive scheme.
If you've been involved in such an action, how did it work out for you?
You really want us to ADMIT that we've been involved in such an action???
That's a great idea right up until it is a server in a hospital that is being used for the attack.
No. I'm going to have to go with the other post:
And not just that but also a house you THINK belongs to the attacker when it is just one that the attacker is using.
It's the only way to be sure...
When the money in play gets big enough I would think that physical reprisals would become an increasing likelihood. The money providing private security in Iraq and Afghanistan was good, but these guys are looking for new markets and selling an anti-hacking service that involves your attacker winding up dead in a car crash or of an accidental overdose has a certain appeal.
Google Multi-bet.
"Seems there has been blackmail and hack attempts to at least two online bookies,
Multibet.com and Centrebet"
"syn flood on port 80 - MASSIVE one
The server was originaly in Alice, thus killing the Alice network. Telstra then implemented their "DDoS protection" (www.radware.com - ironically, when we told our current DDoS protectors this, they laughed) in their Sydney office. It took out part of their core network in Sydney straight away before they killed the www server ips." http://forums.whirlpool.net.au/archive/237347
They just bought more bots to the fight.
...how did it work out for you?
Great. The SEALS got in, placed their satchel charges, and got out again with no casualties.
So, if I want to hack Lockheed Martin, I route my attack through a compromised Boeing system. Then I sit back and watch the antics ensue.
Have gnu, will travel.
In the past we have mitigated DoS attacks by hitting the servers back harder. Some companies are non-responsive in taking the compromised boxes offline and it is the only way to get their attention.
Good luck with that in court. I'm sure the judge and jury will completely understand your need to risk the lives of patients because you wanted to.
After all, if you were competent then you'd be able to block the attacks or at the very least mitigate/ameliorate any possible damage from them.
I mean that if a patient dies because of the cracker then it isn't your concern.
But if a patient dies because YOU decided to take out that server ... enjoy your stay at the Federal Pound Me In The Ass Prison.
UNlimited nuclear strikes also work.
An eye for an eye makes the whole world blind...
Actually, an eye for an eye can be very appropriate, if you understand what the passage is really saying: not that you're entitled to an eye for an eye, but to no more than an eye for an eye or a tooth for a tooth. It doesn't so much institutionalize revenge as place a fair limit on it. There are, of course, two problems here: first, making sure you've identified the culpret correctly and second, how much hacking, DDOS or whatever is appropriate. Personally, if the attacker lives in a country where the law is respected, turning the evidence over to the proper authorities is probably your best bet. If not, have fun; after all, what's the worm going to do? Tell the police, "He found out I was hacking his computer, so he hacked me back?"
Good, inexpensive web hosting
I'm not a networking guy, but I'm pretty sure the legitimate hackers are using leap frogging through zombied machines to attack you. So, how you know that you're at the original hacker's machine(s) and not another innocent zombie?
I swear to God...I swear to God! That is NOT how you treat your human!
The computer someone retaliates against could just be the previous victim of the cracker. If they have owned a government system of any kind at all (even something that provides a bus timetable) and you attack it then you could be in some very deep shit legally with a courtroom opponent that will spend whatever it takes of taxpayers money to make an example of you.
Capability based security makes it possible to manage the complexity of our deployed software and limit damage caused by a process gone rogue. Imagine each process with it's own sandbox, and you've got an idea how powerful it is. It doesn't mean giving up Linux either... as the Genode project looks on track to give us capabilities with complete linux compatible programs clients in the tree.
Let's stop worrying about cyberwar, and help these guys get a permanent solution in place instead. Then we can worry about how to get IP6 deployed everywhere, and take our internet back.
Years ago I worked at an ISP, and one of our websites was defaced. The FBI traced the vandal back to his AIM account name and left it at that. One of my coworkers checked the AIM profile, which contained some personally identifying information. One phone book later we had a phone number, and some phone calls were made of an, err, 'intimidating' nature. We weren't defaced again (setting a Frontpage password probably helped, too).
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
I've just about had it. Slashdot used to be news for Nerds. Now it's almost entirely mindless bullshit, and the last straw is when spammers are permitted to confiscate the site, and Slashdot management allows it. As if it's my job to waste my mod points to mark this crap as Troll.
I am logging off, and deleting Slashdot from my home page. Have at it trolls. All yours now.
While summary and TFA seem to imply some sort of vigilantie response it never enumerates even a single example of what that would be or cites any incidents where retaliation had actually been carried out.
TFA only seems to provide any detail or information about misdirection, honey pots..etc to thwart attacks and obscure important information...All obvious and non contraversial actions.
What I find most distrubing is this little jem:
"In April, Department of Homeland Security Secretary Janet Napolitano told the San Jose Mercury News that officials had been contemplating authorizing even "proactive" private-entity attacks, although there has been little follow-up comment."
How are idiots like Janet even allowed to be secretary of anything? I don't know whats worse having such thoughts or publically admitting to having had them.
Is never to let an attacker know you are aware of them.
That's a great idea right up until it is a server in a hospital that is being used for the attack.
No, then it's a BETTER idea. Not only is it better for you to have legal protection from being sued for disabling the system, but it's a BETTER idea for someone to stop the compromised system which is probably also leaking very sensitive identify data from patients.
No. I'm going to have to go with the other post
I can't help it if you cannot process analogies correctly.
And not just that but also a house you THINK belongs to the attacker when it is just one that the attacker is using.
See, that's why it was so stupid to go back to that metaphor, because now you are making no sense.
A punch comes from a direction, you disable the guy obviously punching from there. Possibly someone else told him to do it; that's one less guy punching you right now though. That's one less guy he can tell anyone ELSE to punch (or worse).
You want to live in some kind of fantasy world where you just ignore attacks go right ahead, I'd like to live in a world where people care about more than use themselves.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Veteran government and private officials warn that much of the activity is too risky to make sense, citing the chances for escalation and collateral damage.
Doublespeak for:
We're the boss, we didn't catch these guys so there is no real damage. Take no action on your own. We're here to help you.
A rather incompetent script kiddie kept trying to hack one of my servers some years ago. Poking back, I found he had left the entire C: drive on his windows box shared to the world. So I dropped a gift into his startup directory. Yeah, not much of a story.
-- Will program for bandwidth
Nuke it.
Really if everyone had set up a decent firewall, with some community verifiers to remove DNS poisoning, and NAT buddies to make sure you see the same Internet, and then automatic submission of attacker hosts to nuke lists, then permanently blocking them, packet inspection on the localhost or router for the few protocols anyone uses, that would remove a lot of the low-hanging fruit.
I'm not the only person who thinks we're living in the cyberpunk future Gibson warned us about, am I?
We even have chromed-out cybernetics, though they're fairly fashion-over-function these days.
We are not anonymous nor 4chan
We are all guests on /.
We must respect /.'s decision on what to do
If /, decides that it wants this annoyance to continue, that this annoyance will continue
Muchas Gracias, Señor Edward Snowden !
Some strange people should really stop dreaming about all that "cyber war" BS....
aaaaaaa
Since most the damage is going to come from botnets, wouldn't striking back just be hurting some innocent grandma who visited the wrong website? Unless they actually dedicate some resources into finding out who's behind the botnet, something various governments and large multi-nationals have a spectacularly poor record at; not 0% success, but close. And I imagine that most of the time they'll run straight into either a large organised crime ring (mafia, russian mob, etc) or worse, a national government like China. Bad idea.
Veteran government and private officials warn that much of the activity is too risky to make sense, citing the chances for escalation and collateral damage.
So the government is saying that responses to attacks should be proportionate and legal ...... Pot, kettle... black
Say you work for company, which gets compromised and data is exfiltrated out of the network to a known source (the attacker used scp so the ip address, username and password are left within bash history or some other bash log). You find it within minutes or before the scp is completed. How do people feel about logging into the machine the data is being exfiltrated to and erasing it from the remote server?
Even if the 3rd party box is one they popped and not the attackers true machine, your not damaging the machine, network, etc., you are just removing 'unauthorized data' (granted, it may be a very fine line).
I think we can translate this differently. "Companies who could not be bothered to set up decent pro-active defences that would have slowed down a hacking attempts are now trying to cover that deficiency by being overly aggressive".
A bit like Wall Street and the US government yelling together at Swiss banks to distract the attention from their leading role in today's crisis (What? You didn't realise that? What do you watch, Fox news?)..
Or like the US we could threaten to send cruize missles to take out Chinese hackers. Cause if your the President anything you do is legal, justified as national defense by the Commander in Chief.
"If you've been involved in such an action, how did it work out for you?"
I don't know. Some douchebags hacked my gaming box so I got them back by hacking their computers. It seemed like they were hacking from a computer fan manufacturing plant or something, because there were literally thousands of devices reporting the same rpms being operated there. I figured it would be funny to mess around with the operating speeds of those fans in the hopes of creating a tornado or something.
They also seemed to be obsessed with U2... apparently, they gave band members nicknames like #35 and #38.
What happens with its the government/RIAA/microsoft using this to silence critics. Massive DDoS against wikileaks or other whistleblower sites? What about a smaller site trying to get off the ground with less of a name that has valuable information?
right vs wrong will be determined on who has the better lawyer.
Unless, like my system, you have black-ICE installed....
mark "geez, slashdotters don't even read anymore...."
Valid question, not?
And what are they going to do about botnet-infested PC's, trojans and hacked systems?
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
They could be looking to use a honeypot to disable some of the attacking machines by getting the attackers to run code (trojans/back doors) to disable bots that are DDoSing them. With the tiny amount of real information given it is hard to say.
Yes, and the lawful way you accomplish that is to call the hospital and inform their IT staff*.
Yes, and WHEN that fails?
Obviously if you have enough info to call someone you should. But what if you do not?
There's simply no scenario under which it is better to let the system keep running if you cannot determine who to contact to shut it off - or even if they are unable to....
IP packets aren't a punch.
Yes, they are.
You are justified in alerting the hospital, and blocking their packets anywhere from your network to the edge of theirs.
And letting everyone else stay compromised and under attack. How totally selfish of you.
*You do realize that hospitals are 24 hour a day operations, right?
You appear to be the one that cares so little about them you would let servers stay compromised until something REALLY serious happens.
And on a side note, how many hospitals are going to have network facing infrastructure that is vital to the hospital running if it should go down, with no backup?
Face it, you set up a terrible straw man and are just upset I have burnt it to a crisp.
I let you have the last word since you think only in hypotheticals and not reality. But anyone reading to this point understands how things are in the real world, and that you have provided ZERO justification for your stance to leave systems up that continue to harm others.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Note that the government are really the only ones saying "there's nothing you can do." Meaning there's nothing THEY can do.
Grar II
what I love about retaliation is that there is good in it - IPS and IDS are good // when someone comes knocking on your door, either zombie or hacker // the best defense is a return cyber attack at the nuclear level -- DDOS the assailants and use half life genesis pathing - that should slow down the culprits and make the zombies aware as well.
No foul - no harm - the US government forces us to take vaccines to go to school, so should our computers take vaccines to fight again viral attacks from the internet.
it's been done -- been there.. can't wait for it to be used en mass.