Slashdot Mirror
FBI Monitoring Hacking Targets For Retaliation
An anonymous reader writes: As high profile security breaches continue to grab headlines, little is being done visibly by the government to prevent future attacks. This is prompting some victims (and potential victims) to find creative ways to stop the hackers. The FBI is now concerned that U.S. companies and institutions are themselves breaking laws by retaliating with cyberattacks of their own. "In February 2013, U.S officials met with bank executives in New York. There, a JPMorgan official proposed that the banks hit back from offshore locations, disabling the servers from which the attacks were being launched ... Federal investigators later discovered that a third party had taken some of the servers involved in the attack offline, according to the people familiar with the situation. Based on that finding, the FBI began investigating whether any U.S. companies violated anti-hacking laws in connection with the strike on those servers, according to people familiar with the probe."
Disabling servers from which an attack is being launched against you isn't "retaliation". That's self-defense. Now, I know that striking back at the right target isn't easy, and some "innocent" people may get hurt, but if you are being attacked, and some third party's stuff is being used to attack you, you're still not "retaliating" if you damage that stuff in an attempt to end the attack.
They are concerned because some of these Attacks are perpetrated by the FBI/NSA/CIA.
Can't have people retaliating against their own infiltration operations...
Too bad the internet's down in North Korea, they'd be interested in this story for sure!
An i(phone) for and i(phone) and a (blue)tooth for a (blue)tooth.
I'm not sure what else to infer from a story that implies the fbi is investigating jpmorgan for criminal activity...
Catch the people defending themselves.
And I am all for it.
...should you not defend yourself?
as if the FBI/CIA/NSA aren't already tools of the plutocratic multi-nationals.
i believe that the only reason they don't want them doing it on their own is that it robs the 3-letter agencies of political glory.
never bring a twinkie to a food fight.
I know I shouldn't say it but this is completely fucking awesome. We live in a cyberpunk future!
Is this the same FBI that told us NK was responsible for the Sony hack?
Federal Bureau of Incompetence.
"If any question why we died, Tell them because our fathers lied."
Normally I would be against this, but nowadays hackers are mostly just extortionists. Not to mention the damage they've done to the work done by real hackers trying to protect freedom. Really, I think this generation of hackers just need to be purged so the scene can get back to normal.
Probably not. Any hacker with two brain cells to rub together would quietly infiltrate systems in company A, from there infiltrate Company B, C & D, rinse/repeat until sufficient layers of abstraction sit between them & their target, and then use them to attack the real target. If the response of victim X is to nuke the IPs from which the attack came, they are a) hitting the wrong entity, b) potentially destroying evidence left by the real perps, and c) probably initiating a re-retaliation from the victim of their attack.
I prefer rogues to imbeciles because they sometimes take a rest.
but not ok for anyone else. this is what happens when governments routinely skirt the law.
the companies wouldn't have an incentive to do that.
- Zav - Imagine a Beowulf cluster of insensitive clods...
Probably not. Any hacker with two brain cells to rub together would quietly infiltrate systems in company A, from there infiltrate Company B, C & D, rinse/repeat until sufficient layers of abstraction sit between them & their target, and then use them to attack the real target. If the response of victim X is to nuke the IPs from which the attack came, they are a) hitting the wrong entity, b) potentially destroying evidence left by the real perps, and c) probably initiating a re-retaliation from the victim of their attack.
... and so begins Internet War 1!
Is anyone surprised by the attitude of the FBI? They're cops. Cops are people who ignore you when you report a theft or assault, protect their own skins instead of the public, then throw you in jail for carrying a weapon to defend yourself.
Gamingmuseum.com: Give your 3D accelerator a rest.
Dog in the manger. Can't protect you, can punish you for doing anything to protect yourself.
This friend speaks my words. Thank you.
Most Respectfully Yours Mark Allyn Bellingham, Washington
Is this the same FBI that told us NK was responsible for the Sony hack?
Federal Bureau of Incompetence.
I just wish we could get all the incompetence located in a single bureau. Tim S.
You need a name for that group. Something catchy. How about "League of Nations?" Or maybe something a little more modern. "United Nations?" But United Nations sounds like everybody would get involved. So maybe you want to have a smaller group of just the most important countries, specifically addressing security problems. You could call it the "Security Council" and just have the most powerful countries on it. Plus maybe a small number of rotating seats so the rest of the world had some representation. Then, for the biggest powers you could have direct lines of communication between their leaders so that they could cut through the diplomatic crap when the shit really hits the fan. Telephones would work. Better make them land lines for reliability. And make them red, because red means they're important.
The purpose of the police is to protect the state. Normally they do this by enforcing the laws in such a way that those with the power to threaten the state feel that they are more secure being supported by the state than by threatening it. Additionally they often enforce other laws that happen to be there.
Don't read this remit too narrowly. Consider it in context with "The law in its majesty forbids both the rich and the poor man from sleeping under the bridge."
Unfortunately, I have described an honest and upright police force, not the one we've got.
I think we've pushed this "anyone can grow up to be president" thing too far.
Probably not. Any hacker with two brain cells to rub together would quietly infiltrate systems in company A, from there infiltrate Company B, C & D, rinse/repeat until sufficient layers of abstraction sit between them & their target, and then use them to attack the real target. If the response of victim X is to nuke the IPs from which the attack came, they are a) hitting the wrong entity, b) potentially destroying evidence left by the real perps, and c) probably initiating a re-retaliation from the victim of their attack.
The use of jumpboxes is common when attacking targets, which is exactly what you have described. However, the idea that you just "hack back" via a DDOS isn't how it is done. Companies know that blind DDOS retaliation will only land them in hot water, so they use other methods.
A common method is a honeypot - a network segment with machines in it designed to be infected for observation purposes. Then, when activity is noticed in this network, things like trojaned PDF documents can be placed in the honey pot with titles like "All customers credit cards do not share". The attacker downloads this "great" data, opens it, and gets hacked in return.
This way, the payload is deployed against the target hosts only through the direct action of the attacker themselves.
Other methods that are similar are used, but this should give you the gist.
Try to hack my 31337 firewall!
Great idea... why didn't we think of that?
o.0
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
you aren't hacking the one person who's hacking you, you're hacking innocents whose computers have been hijacked for the sole purpose of hacking you.
Twat.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel