Tag Archives: offensive cyberspace

Active Defense/Hack Back and “Complete Ignorance”

I recently read a post about “Active Defense” or as some call it, hack back. I won’t reveal the author or the title so as not to disparage anyone. Certainly this topic is very sexy right now and many like to write about it, but most of articles I have seen constitute fear mongering with comments not based in fact or even sound theory, but ignorance of the topic, the laws, and the technology and appear to be an attempt to sensationalize the topic.

Yes, there is a problem. Yes, companies are suffering. Some of the companies have a legitimate complaint. They have done all they can and the government has tied their hands by saying things like, “if you hack back you are no different than the hackers.” A lot of companies, though, have no right to complain because their security really sucks, is like Swiss cheese and they are not willing to spend the money to fix it.

The blog I read recently quoted a former DoJ attorney who stated that it is illegal to go outside of your network and hack back at your attacker. In the next paragraph the writer quotes a so-called security expert who says his company has the capability to determine who attackers are and collect intelligence on them, and this is not illegal but good practice. The expert provides the usual, “do not try this at home,” warning. I will leave it to you to decide whether this warning is good advice or simply self-serving.

So here’s my problem: These quotes claim on one hand it is illegal to attack your attacker but on the other hand not to take the steps necessary to determine who your attacker is? If determining who attackers are was really that easy and clearly lawful everyone would be doing it. Most would admit the greatest challenge with cyber crime is determining who the attacker is, e.g. Attribution. One of the great claims by those who believe “Active Defense” is illegal and immoral is that attribution is extremely difficult and if you can’t determine attribution then you may be, “attacking an innocent victim.”

As a side note to the above comment, and as I have said in previous blogs, if someone has been compromised and their server is being used to attack my company, that person is NOT innocent. A victim like me, yes, but innocent, no. If I have to disrupt his server to protect my company then so be it. Chances are that server owner does not want the other hundreds or thousands of companies who are victims of his server attacks to know that he is the patsy attacking them due to his crappy security

So, I would kindly ask those who like to write about “Active Defense” to please do some research, think the process through, stop confusing the issue and stop writing fear mongering comments like, “you might start a war with China.”

Active Defense: Attribution is just not that important

Imagine owning a company and realizing you have been hacked and the hackers are disrupting operations or stealing trade secrets, intellectual property, private information, or even money.  As best as you can determine this did not just happen but has been going on for a while.  You hired a company to do an incident response, clean up, patch the holes and get you back up and running.  They may or may not have claimed to have secured your network, but state in no uncertain terms that any action beyond what they have done would be illegal.  Within months you notice the same activity.  So, you call the company again.  More money, more time, and more meetings about how much is being lost.  Do you call law enforcement?  Do you continue with the cyber security company and keep paying them?  Do you have a data breach notice responsibility to shareholders, the board, and customers/clients? 

What you need is a clear and concise plan of action to follow in these situations.

When lecturing on “Active Defense” I often hear comments like, “hack back is illegal,” “without attribution you might hurt an innocent bystander,” or my favorite, “you might start a war with China.”  So what is “Active Defense”?  Many people equate it to hack back.  My definition of “Active Defense” is “a clear and concise process or plan for addressing a compromise to the security of your network and/or the loss or theft of data.”  The process begins with an incident response and could ultimately end with hack back.  It includes a series of predetermined check points requiring leadership/CEO involvement in making various decisions.  One of the first decisions is whether, based on the information available and/or gathered, the attack is a one-time occurrence or an ongoing intrusion/breach.  If it is determined to be a one-time occurrence the decision is easy, initiate an incident response plan, clean up, patch holes, and provide notifications required by law.  If the attack appears to be ongoing some of the follow-up on decisions may include: what end-state the company is seeking (find the hacker and prosecute, block the attack, get data back, etc.); what intelligence/information should be gathered; what tools/techniques should be developed and/or used and how; as information is gathered and options presented, which should be considered and pursued; and many more, most of which are all dependent on the facts, information available, best interests of the company, the fiduciary responsibility, etc.  At each stage and as each decision is made risk, liability and legal issues are discussed, evaluated, and factored into the decision process

Okay, so why is attribution not that important? 

Certainly, being able to identify your attacker makes life much easier for you and your company.  Even if you can’t identify the attacker, being able to identify who owns the server being used to attack you makes life simpler.  You can simply call the owner of the company whose server has been compromised and is attacking your network and work together to block the hacker.  If, for some reason, the owner of the compromised server will not work with you then you can proceed as if he is the hacker.  You might contact law enforcement or if for some reason that decision has been ruled out or, law enforcement for some reason is not able to assist, then you might decide to take action to block the attacks.  At this point the leverage you can garner against the server owner is pretty great.  Chances are his server is not only being used to attack you but many other companies as well.  The server owner will likely not want all of the other companies to know his compromised server is responsible for their pain, assuming they are aware of it.  When this fact is revealed to him he may suddenly be more than ready to negotiate and assist

In many cases though, you will not be able to determine the identity and/or whereabouts of the server owner. 

In that case, if you strike back and inspect the server attacking you, have you lashed out at an innocent bystander?  Many people claim just that.  I would argue this person is a victim like you, but innocent bystander, not even close.  Consider the 2006 movie “Firewall” with Harrison Ford.  His wife and daughter were kidnapped and the kidnappers, using this leverage, forced him to hack into a bank he was hired to protect and steal millions of dollars for them.  Now, granted, I like Harrison Ford, but, if he is stealing my money he’s not an innocent bystander.  He is a victim, but, if it is me or him, choices must be made.  Equally, if it is my company losing thousands or millions of dollars, then attacking the server being used to attack me seems like a pretty good option and it is “game on!”  This is where, depending on how you accomplish blocking the attack against your network, self-defense becomes a factor and part of the decision-making process.  I will leave self-defense for the next installment in this series of blogs entries.

Active Defense/Hack Back/Attribution – The Saga Continues

I have noticed, at least amongst lawyers, there does not seem to be much middle ground when it comes to “Active Defense” or hack back and the right of self-defense.  Those who comment on it either agree self-defense exists in cyberspace, with very few in this camp, or it doesn’t, which is where the majority stand.  All I ask of most is don’t simply jump to the conclusion that self-defense does not exist and “Active Defense” or hack back is illegal, but instead look at the arguments, potential fact scenarios, and definitions.

“Active Defense,” has many definitions and should not be strictly equated to hack back.  Hack back, instead may be considered a subset of “Active Defense,” which does include cyber self-defense or cyber self-help.  Whether or not a company can utilize these theories depends entirely on the given facts of a situation.  For instance, if a company has suffered a cyber attack and cannot show the attack continues or is persistent, they will not likely be able to make a case for the use of self-defense.  My draft definition of “Active Defense” (still a work in progress) is as follows: “a meticulous and escalated approach to a persistent cyber attack wherein the company leadership makes a decision whether or not to progress at pre-determined decision-points, evaluating risk, liability and legal issues.”  Each decision-point will include all of the intelligence gathered, all potential options, tools, techniques, possible scenarios, potential risks, liability, and legal issues.  Depending on the facts and the confidence of the decision-maker there can be few decision points or many.  The number of decision-points is also a factor to consider in the scenario and the actual amount of liability, if any, may depend on how meticulous and cautious the decision-maker acted.  For example, the first decision-point may be whether the attack(s) is or are persistent.  “Active Defense” is very fact dependent.

Unfortunately most jump immediately to the conclusion that Active Defense, or hack back are illegal.  In my opinion this is a very shortsighted view.  If you are a company losing a lot of money, can show you have implemented good or better security, and have taken an escalated approach collecting intel and evaluating risk, liability and legal issues along the way, then I believe you do have a right to defend yourself.  Again, it is very fact specific.  This is where most people then pull out the “attribution” card and claim you will impact an innocent bystander.

If someone drugs and hypnotizes an innocent bystander and convinces him to shoot at you, don’t you have the right to shoot back in self-defense? This is similarly fact dependent.  For instance, if you know the person is an innocent bystander you would likely try and run away and get help, maybe call the police.  You might even attempt an escalated approach causing as little harm as possible to the innocent drugged and hypnotized bystander.  In the end if it is you or him most will likely opt to save their own lives.  Now remember, self-defense applies to person or property.  So, in the end most will opt to save their own property over the property of the innocent bystander.

So, if a server is compromised and being used to attack my company, don’t I have the right to defend against that server? In this scenario I am assuming I cannot identify who owns the server.  If I could I would simply call that person or company and ask that the server be shut down or the malware removed. Also, is the owner of the compromised used to attack me truly an innocent bystander? Is there contributory negligence on the part of that server owner for not having adequate security and allowing his system to be compromised? In a perfect world you could say no, but today many if not most compromises occur because companies have not used due diligence in keeping systems patched and implementing basic security.  Enough for now, comments?