Is retaliation the answer to cyber attacks?

January 3, 2011 at 1:59 am · Filed under Computing, Educational, Feedback, Game Play, Guest Author, Hard Targets, Hi-Tech, Interactive, Internet, MOBILE, Politickz, Poll, U.K., U.S.A. and tagged: Cyberwarfare, Data security, London School of Economics

The law frowns on cyber attacks but Black Hat speakers advocate exploiting vulnerabilities in attack tools and botnets against attackers

Should revenge assaults be just another security tool large IT shops use to counter cyber attacks?

It’s a controversial idea, and the law generally frowns on cyber attacks in general, but at the Black Hat conference in Washington, DC last week, some speakers took up the issue of whether and how organizations should counterattack against adversaries clearly using attack tools to break into and subvert corporate data security.

One idea that got plenty of attention here was the notion of exploiting vulnerabilities in attack tools and botnets to try to determine what the attacker was going after or feed fake data, or even dive into the attacker’s network lair.

If it turns out an attacker has taken control of a corporate machine, it’s logical that you’d want to “counter-strike” to find out what the attacker is up to, perhaps by finding a hole in the attack tool being used and planting a backdoor of your own to watch the attacker, said Laurent Oudot, founder and CEO of TEHTRI-Security, a French-based ethical-hacking and vulnerability research firm, who spoke at Black Hat.

“We want to strike back. We want to exploit his network,” said Oudot. You want statistics and logs related to the attacker, and it might be the idea of attacking ZeuS or SpyEye or even a state-sponsored attacker. It’s not so complex to find zero-day vulnerabilities that would allow subversion of attack tools, noted Oudot, whose firm has experience in identifying vulnerabilities, includingseveral related to mobile devices. He suggested it would be fairly simple to strike back against exploit packs such as Eleonore, or feed fake information into attacker’s hands. “You can strike back,” Oudot said. “Your enemies are not ethical hackers.”

Matthew Weeks, a security researcher who recently joined the Air Force, also spoke on the question of counterattacks against hackers clearly using attack tools to break into networks, acknowledges the law would probably regard most counterstrike ideas as illegal.

But as a contributor to the open-source version of Metasploit, a tool that can be used for either good or evil to test and explore network vulnerabilities, Weeks says tools such as this have their own vulnerabilities much like any type of software will, and attackers may not pay attention to patching their own attack tools.

At the conference he went into depth on some vulnerabilities in open-source Metasploit. And he says other tools, such as Nessus or the Wireshark protocol analyzer, which can also be used for attack purposes, have also had vulnerabilities.

While the idea of counterattacks remains contentious, especially since there could be “unintended consequences,” Weeks noted, his inclination as a security researcher is to explore how countermeasures such as “tarpits” could be put to use, which would put attackers in an endless spin cycle when they connect.

It’s possible to “tie up resources in an attack,” said Weeks, and it would make sense to monitor what hackers are up to.

Click to see: Chart of security do's and don'ts

There’s scant evidence that companies or civilian government agencies are trying to turn the tables on attackers in these ways, but the military arms of several governments around the world, including the U.S., are building up cyber-forces with an eye toward supporting a retaliatory strike capability. And no one denies espionage takes place in cyberspace.

Continue Reading by clicking below:

 

CLICK LOGO to complete reading this article

Related Articles

• Dutch release man accused of cyber attacks (reuters.com)
• Cyber Attacks Force EU to Close Emission Trading System (thewapper.wordpress.com)
• The US Needs To Learn To Limit–Not Win–A Cyber War (blogs.forbes.com)
• Cyber Attacks Set to Increase (blogs.wsj.com)
• Cyber attacks could create “perfect storm:” OECD (canada.com)

Permalink