Ethics Question

zertron: Yes, that problem is common with cable providers because of bandwidth-sharing, but DIAL-UP SPEEDS CONSISTENTLY FOR OVER A WEEK!? That is NOT a common problem. That is consumer fraud.

MsMittens: I guess it could be read that way, but I don't mean to include the retialation part of hacking them. I'll change the question so it's more clear.

I wish I knew of agencies other than the Better Business Bureau that are involved in corporate accountability -- best of luck in your attempts to get your problem resolved.

I wonder if you could find people who are experiencing the same problem -- there's always strength in numbers.

Like I said before, best of luck.

Yes, when I camplained to the township about them, they commented on the VAST number of complaints they have gotten recently. So I'm not alone in this, and I sense that Charter will be giving a lot of people a lot of credit for this. Right now they're hiding behind the "It's not a guaranteed minimum" defense, but dial-up speeds are unacceptible no matter what the perspective, and that argument will soon crumble.

It is wrong to 'hack the hacker'. Aside from the obvious legal issues, it is likely to escalate the problem, and it destroys your credibility with the proper authorities.

If you hack a good hacker, I agree with you. If you hack your common script-kiddie, I don't think you would have to fear any kind of retaliation.

I think there are several issues.

Can you prevent them passively, with appropriate firewall rules? Or do they have multiple accounts, etc?

Will their ISP take action?

Are you sure you've got the right person, and not a proxy or 'spoofed' packet flood?


I think that if all else fails, what choice do you have, other than staying offline? I would try in this order:
[list=1][*]Do your best to determine who it is, what kind of attack, etc. Bear in mind that you might not always be correct, given the use of proxies and attacks staged from shell accounts, etc.
[*]Report it to the ISP.
[*]Attempt to use the right firewall rules to prevent anything from that address or address range, if possible.
[*]If the ISP shuts them down, case closed. If they get a new ISP, start from the beginning of this list.
[*]If the ISP isn't doing anything, and the situation has not improved, after, say, a week or two... If the problem is very serious notify law enforcement. It doesn't matter if they do anything, so long as they know in advance that you've got a problem. Get them to put it in writing if they won't go after the guy. (For reasons like 'small fish in a big sea' or 'we don't have the resources').
[*]Keep records of both your complaint to law enforcement and to the ISP, and keep plenty of firewall logs. Get a second opinion about if you've got the right guy. If nothing improves, and you're still being attacked and can't defend well, then go on the offensive.[/list=1]
The reason I say to keep all these records, is that it is POSSIBLE (though not likely) that someone will take offense at your vigilante actions. Keep those records so that you can prove you tried every other reasonable attempt, and so that you can prove you had no choice but to act in digital self-defense.

And that's what I think of as the best policy if you're a home user and don't want to get on the wrong side of the law more than you need to.

That's certainly the most cautious, and therfore the safest procedure for handling that. For the basic user, I agree that it's the best procedure.
I don't think I would use that procedure though. I would go through the steps, but I would not leave a week's time for action if the problem persists, and I would not contact law enforcement more than once about it. I think that would leave them too much time to finish the job. That, plus I have a LOT of stuff going on on my PC even when I'm not on it. It would take me FOREVER to get all of it back up. Thus, I have become very protective of my PC. Kind of like the relationship a mother bear has with her cubs. Messing around makes me very angry....

THe matters of ethics is a great idea, I say that you may not want to hack the malicous hacker for fear of retalition. Somtimes strinking at your enemy when he is greater then you isn't so wise.
But on the other hand you can then report his ass.

So I would say it depends..

If I was to be harrased by a hacker, it would seriously matter to me wether it's just a script kiddy or a real malicious hacker. A script kiddy would receive from me first a warning, then a DDOS attack. Not just for retaliation, but most of them don't seem to realize they bother other ppl. In the case of a real malicious hacker on the other hand, I would do all efforts to get hold of his IP, go to RIPE and afterwards to the police. Script kiddies don't know better, but a real hacker should.

Grtz,