Slashdot Mirror
Hacked Companies Fight Back With Controversial Steps
PatPending writes with this report on companies taking aggressive steps to deal with electronic attacks: "Known in the cyber security industry as "active defense" or "strike-back" technology, the reprisals range from modest steps to distract and delay a hacker to more controversial measures. Security experts say they even know of some cases where companies have taken action that could violate laws in the United States or other countries, such as hiring contractors to hack the assailant's own systems. Other security experts say a more aggressive posture is unlikely to have a significant impact in the near term in the overall fight against cybercriminals and Internet espionage. Veteran government and private officials warn that much of the activity is too risky to make sense, citing the chances for escalation and collateral damage." If you've been involved in such an action, how did it work out for you?
Just remember, if a company asks you to break the law then you deserve what's coming to you when you get caught.
I simply drive to the GeoIP location with my illegal police baton and smack the head of whoever happens to be there at the time when I arrive. I've been doing this for a few years now.
What are you going to do, DDOS some script-kiddie's computer?
The only time I've ever heard of something like this working out, it was when someone actually went to the effort to find out who was hacking them, and then turned the case over to the police. There was a story like that covered here on Slashdot several years ago.
"First they came for the slanderers and i said nothing."
I got the location of the punks house and nailed his mom while he was in the basement.
Feeding time came around and mom did not bring down the hot pockets according the regular schedule and he peeked his head above ground.
Said, "Hi. I'm from the company you were trying to hack. By the way your Mom is quite talented. Going to be around more often"
95% of the time your "retaliation" isn't being targeted at the actual attacker, you are far more likely to be attacking some 3rd party's legitimate, vulnerable server that is acting as a re-director for the attacker. Now the 3rd party is going to be pissed that you're harming their business.
http://xkcd.com/538/
Obviously, they're in the process of developing Gibson's black ICE!
We should be afraid.
http://www.geoffreylandis.com
If the script-kiddie knows anything at all he'll be attacking from a zombie he's already "owned".
I think this is more sensationalism than fact.
I was doing due diligence on a computer security firm once who had be subject to a DDoS blackmail attack, you know, give us $5,000 or will we will keep your web site down. Well they back traced the control to some cyber cafe in eastern Europe and worked with the State Department to actually get the local police to go in and arrest the people involved.
If someone is actively hacking you then hacking them back isn't a crime (or it shouldn't be) its just self defense. And if you have to hire some firm to do it I don't see how it is any different than hiring armed security guards or private detectives.
If the law says you can't defend yourself from someone trying to ruin your business then the law is an ass.
Equal to "If someone breaks into your home, you should be able to break into their home."
1. Never put sensitive data on a computer connected to the internet, unless it absolutely must be there.
2. Never keep sensitive data that you don't need, overwrite it, then delete.
3. Never put confidential data into any computer system, networked or not. If you must, do so only if it's encrypted and secured by strong authentication at all times.
4. Use all practical forms of security, firewalls, strong authentication, multiple networks with isolation, IDS, AV/anti-malware, no running as Admin/root, separate accounts for every user with appropriate access restrictions, including separate accounts for any services running on your servers, whole disk encryption, etc.
The first 3 are what I call the "Mr Miyagi" approach, "Best defense, no be there." Item 4 is what most companies focus on, but it's not nearly as useful if you haven't used 1-3.
make imaginary.friends COUNT=100 VISIBLE=false
An eye for an eye makes the whole world blind, especially when the guy who just got poked in his good eye opens fire on everybody else.
To me, tracking them down (let me guess, you can do a traceroute?) isn't exactly hacking by any means. Finding the person and telling law enforcement is not hacking, it is arguably the antithesis of hacking (not to say you got the right person, but that's aside the point). That makes your later claim that this is somehow like having someone holding a gun to your head, thus justifying "self defense," all the more confusing.
Great Intellect...
There are companies that I know, who employed "private contractors" to do things that they can not legally do, to "make things right"
One of those companies, when its refinery was damaged by some African guerillas, got its own "private contractors" to hit back, and they hit back very very hard
So, I am not surprise of what they will do on the Cyberwar front - the "private contractors" can do anything for you, so long as you pay them
Muchas Gracias, Señor Edward Snowden !
I've been in contact about a job with a French cybersecurity company that has subsidiaries in 3 countries to be able to be able to offer 24x7 service, and, avowedly, do stuff (counter-attack for ex.) that would be illegal in France.
I don't have a big issue with counter-attacks existing, and being nasty (let's face it, if you beat on me, I'm gonna beat on you). I do have an issue with the potential for counter-attack evolving into spying and pro-active stuff. I'm sure they're doing it already.
The Cloud - because you don't care if your apps and data are up in the air.
I would think lots of honeypots, dead ends, and misinformation would be effective. It would be difficult for the hacker to know when they have accessed legitimate machines or information. That's one of the problems with typical security is that it typically provides confirmation when an access attempt has failed. If instead of indicating failed access, you instead direct them to bogus data, it would make the hacker's life rather miserable.
Better known as 318230.
If someone is actively hacking you then hacking them back isn't a crime (or it shouldn't be) its just self defense. And if you have to hire some firm to do it I don't see how it is any different than hiring armed security guards or private detectives.
Real world thinking doesn't apply here. In the real world, if someone attacks you, you can beat them up and claim self-defense because you know it was them. In the digital world, very likely the person you are targeting is innocent. If a computer DDoS' your network, you don't DDoS them back, you block that IP address -- because criminals don't use their own computers to conduct attacks, and neither do they sign every packet with their name, address, and phone number. So when you unload on who you think is attacking you, then (by your own logic) they have every right to retaliate against you! At that point you've created the digital equivalent of a bar room brawl, but with weapons of mass destruction. And with every response by either party comes the increased risk of drawing another person into the conflict.
If everyone, or even a substantial minority, follows this logic it leads to the internet becoming lawless war zone where business simply cannot be conducted anymore because the network's reliability has been shot to hell. And let me be clear: You're not above screwing up. Even major name security researchers from businesses that specialize in this routinely get the names of the people involved wrong. Often. Open wifi, proxies, bot nets, the number of ways you can appear to be someone other than yourself is dizzying. Hell, I'm posting this through Tor... good luck even finding out who I am. Criminals have access to much better security than that... what do you think the odds are of figuring out who they are if you can't even figure out who I am when I'm making no special effort to hide my real identity?
#fuckbeta #iamslashdot #dicemustdie
That's a great idea right up until it is a server in a hospital that is being used for the attack.
No. I'm going to have to go with the other post:
And not just that but also a house you THINK belongs to the attacker when it is just one that the attacker is using.
Denial of Service is difficult to defend against, but it is impossible to retaliate against, since it universally uses botnets. It is not "hacking," either. You basically have no recourse of any kind in that situation other than some not-so-useful technical stopgaps to mitigate damage. If you go after people who "attacked you," you're simply further hurting innocent civilians, and deserve to be slapped with the same jail time as the original attackers.
In the case of actual hacking, I have no sympathy. Use proper security and you will not need to worry about it. Unlike denial of service, most commonly exploited security holes are easily fixed - especially if you know they exist (which extortion implies.) Trying to hack back while you have security holes still present in your systems is asking for serious trouble.
Great Intellect...
You had logs and were still penetrated? What OS has logs and gets penetrated?
Well, if you're talking back doors, penetration, and encountering logs,you're probably talking OSX!
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Good luck with that in court. I'm sure the judge and jury will completely understand your need to risk the lives of patients because you wanted to.
After all, if you were competent then you'd be able to block the attacks or at the very least mitigate/ameliorate any possible damage from them.
I mean that if a patient dies because of the cracker then it isn't your concern.
But if a patient dies because YOU decided to take out that server ... enjoy your stay at the Federal Pound Me In The Ass Prison.
Equal to "If someone breaks into your home, you should be able to break into their home."
It's more like "If someone breaks into your home, you catch their license plate number. You should be able to break into whatever house the license plate is registered to, and see if you can find your stuff."
No you don't. Investigating the crime is law enforcement's job.
You had logs and were still penetrated? What OS has logs and gets penetrated?
All of them.
I've just about had it. Slashdot used to be news for Nerds. Now it's almost entirely mindless bullshit, and the last straw is when spammers are permitted to confiscate the site, and Slashdot management allows it. As if it's my job to waste my mod points to mark this crap as Troll.
I am logging off, and deleting Slashdot from my home page. Have at it trolls. All yours now.
Many botnet clients apply security patches to prevent others from taking the machine.
Rod Taylor
Well, theoretically, if one were so obsessively inclined, it is possible to spelunk your way upstream, router by router, to track down the offending computers, even when the attacker is using forged IP addresses. Although, I imagine that even the cozy relationship that the various law / intelligence agencies and the various network providers normally enjoy would immediately become rather frosty if they found you doing that.
Once you have one member of the offending botnet, you find out how it has been compromised. A quick port scan can be telling here, but compromising the machine by other methods can be done, if necessary. Then you'd probably copy the botnet software to a VM for some dissection. Then you'd probably create some software of your own, to silently log any future connections to that machine, while trying to figure out how the botnet is being controlled. Eventually, you'll be able to track down the original (command) computer (even if they're using an IRC channel, or website, or relaying a command from one machine to the next ala Whisper Down the Alley style), and then the fun starts...botnet operators HATE IT when you compromise their command machines, and use the built-in webcam to take a picture of them. They really hate it when you record video. They're even more surprised when they're running Ubuntu, and think Linux would somehow prevent them from being hacked...
But yes, the obvious answer to an attacker on your network is to run to the comms room, and physically remove the network cables. As for the above, well, it's hard to find a programmer that's been angered deeply enough to engage in that kind of investigating.
I am John Hurt.
That's a common misconception in many countries, I *highly* recommend you verify that information for your geographic area.
Perhaps we could use something called "active defense" or "strike-back" technology to fight these MCPC floods?
Ooops. Sorry guys, that put us accidentally back on-topic.
Carry on...
So what happens when people start faking attacks on their server, so they have an excuse to attack their competition?