Slashdot Mirror
To Hack Back Or Not To Hack Back?
dinscott writes "If you think of cyberspace as a resource for you and your organization, it makes sense to protect your part of it as best you can. You build your defenses and train employees to recognize attacks, and you accept the fact that your government is the one that will pursue and prosecute those who try to hack you. But the challenge arises when you (possibly rightfully so) perceive that your government is not able do so, and you demand to be allowed to 'hack back.'"
Bad idea.
Things like this never escalate. I keep seeing and feeling in so many ways how delicate this all is...and we keep hammering on it. As. Hard. As. Possible.
What you're advocating, quite plainly, is that if you break into my house and steal something, that I can then break into your house to take something from you. The law is quite clear on this. As long as hacking into and stealing resources is illegal, you doing the same is just as illegal. Get a Rottweiler and a home alarm and sign up for personalized security patrols. In essence that is what you can do with regards to your electronic resources.
The real question is what to do when our own government is the one "hacking" our pages
have you seen my sig? there are many others like it but none that are the same
No, but three lefts do.
Solving Unix problems since 1989...
What if the hacker is already attacking from a computer that is not theirs. Firing back would make you no better than them.
Brought to you by Carl's Junior.
After the flawed warfare analogy of the military, we now have a flawed cowboy analogy. How can these people be that shortsighted, everyone knows that the internet is like cars.
With the fact that compromised hosts are the first thing an intruder has between them and their target, how can one be sure that the host attacking them is malicious, or just a compromised box being used as a proxy or launching point for attacks?
If it was a compromised box, and it gets retaliated against, there might be a chance that the IDS/IPS system on the compromised network will log the back-strike, which can easily mean civil/criminal charges.
My take: Block them at the router for a couple days and go on. Trying to "counter-hack" can get one in a world of hurt.
Someone breaks into your place of business, what are your rights? You can bar the door, obviously. You physically intimidate them into leaving sure. You can shoot them... well... if you're in danger and can't get away (or even if you can in some places)... and you have the right to own the gun you're shooting... and well, you better be able to explain yourself.
What you can't do is follow them home and smash their stuff. And you really, really can't start an international incident, that kind of thing is looked down upon.
And two Wrights make an airplane.
You never have the option to take the law into your own hands. If you don't like the job your government(police) are doing, then work on them. But you never have the option to take the law into your own hands.
I work for Umbrella you fool! We have the resources we have the expertise.
I am Bennett Haselton! I am Bennett Haselton!
In Soviet Russia, the government hacks you! In the United States however it's not hacking anymore, because the law says all channels are open for Big Brother, and hacking de-facto does not exist anymore. How about that?
What I find interesting is that people seem to equate a hack back with showing up at someone's house after they're long gone from your place and punching out their window in retribution.
As a sysadmin who has dealt with a number of compromised servers, here is where that analogy fails: I have NEVER seen a hack where the hacker just leaves after they gain access. They create backdoors to ensure that they have access to your network in the future, and will likely try to use your assets in future attacks.
To use the break-in analogy: Most hackers are STILL IN YOUR HOUSE.
Now, one can argue all day about whether it's a waste of resources to hack back, but back hack is certainly not equivalent to tracking someone down and throwing a brick throw their window. In the vast majority of hacks I've personally encountered, a hack back would be active defense.
Why? Not because of any failed cowboy analogy, or belief in how the wonderful rule of law will solve all of our problems for us, but for this one simple reason:
I don't trust you, or anybody, to be able to identify who is attacking you, or even to correctly determine if you are even being attacked at all. Do you need a car analogy? Giving people blanket authorization to strike back at their virtual attackers is like handing Dilbert's boss a rocket launcher and asking him to do something about the lack of available spaces in the office parking lot. If you believe that your network is being attacked and feel the need to strike back at the perpetrators, then please:
I can't promise you that this will _solve_ your problem, but it will give you some time to cool down, realize that your original reaction was based on faulty and incomplete evidence, and keep you busy for a few hours doing something useful instead of being part of the problem.
I was always under the impression that an eye for an eye implied some sort of responsibility on the perpetrator, not everyone else.
It's more of a statement of limited liability. A longer version of it would be "Ye have heard that it hath been said, an eye for an eye, and a tooth for a tooth. So if someone poketh thee in thine eye, thou don't get to kill every member of their family. Just poke them back and then knocketh it off. They didn't expect this kind of Spanish Inquisition, thou doth know."
While hacking back is generally a bad idea for a variety of reasons (such as, it's most likely an innocent user's computer being used as a bot), the article was a monstrosity of uselessness. An individual back hacking a Chinese government hacker isn't going to start cyber world war 3 and the entire notion that it would is stupid. The reasoning for why you don't back hack is completely invalid. It's simply a matter of not being worth it. Most attacks are going to happen through bots and wiping out the bots is just going to hurt innocents and possibly destroy evidence.
AJ Henderson
Lets ignore the morally correct point that fighting fire with fire isn't actually legal. Lets just think about what you hope to accomplish.
Suppose that you poses the time and skills to properly track your attacker back to their actual home system(s), and you manage to crack it. You upload an virus you wrote in your free time that spreads through their computer, deletes all files, and hides in the BIOS afterwards, frying hardware with malicious hardware calls. After you disconnect from their newly cratered system, how long is if going to be until the next random punk off the internet trys to probe your security?
< 00.1 second.
Good luck with your vendetta, I hope it works out for you.
HA! I just wasted some of your bandwidth with a frivolous sig!
Here it is.
:V
And here's what I said last time.
Let's see if I can get +5 just for linking to a comment that got +5.
Replacing one bad analogy with another isn't much better. An "eye for an eye" sought to limit the amount of revenge you were allowed to take. For instance, if someone put your eye out, you weren't entitled to burn down his house with his children it it and rape his wife.
Even in America, that right is reserved for the Feds.
In modern philosophy, the whole concept has been replaced with the idea that you should love the people who are destined to burn in hell forever.
dammit, why can't i ever NOT be sarcastic.
That's not an equivalent. That's the only way you can try and get "justice" if law enforcement doesn't take care of the perpetrators, but it's not a digital equivalent. Let me put it to you this way: If someone was to come into your house and murder your significant other. Would it be okay if the police were to find them and kill their significant other, without trial? Because that would be an equivalent too. The law deals with these things not by revenge or "an eye for an eye", but by (hopefully) proper research, apprehension of the suspects and a fair trial. Hacking back isn't any of those.
I was promised a flying car. Where is my flying car?
And two rights make up what's left of the Constitution.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Be gone with your heathen argumentation. In the Book it said "go forth and multiply", not "go forth and add".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.