Printable View
Tim Mullen @ securtity focus has written a paper on why he thinks "hack backs" should not be illegal.
When Striking Back is The Best Defense
It makes for an interesting read... let the controversary begin... or continue...
oh... looks like
still an interesting read for those who have not already read this...Quote:
Columnist Tim Mullen is on vacation. This article originally appeared July 29th, 2002.
Very nice read I must say, and I agree.
I still get those requests from machines infected with nimda. It's about three ip's that I get many of these requests from. Maybe I should do something. Mwahahahaha. But I think that now they have something for iptables, that you can put in a string and it will drop requests containing that string. I haven't used it yet because I don't have the .so file. I think it requires a newer version of iptables and is not as simple as just putting the .so file where it belongs. I need to secure my box better though, I still haven't figured out how to get my iptables to block requests from a certain ip. Can anyone show me step by step. Because it is always the same ip's that issue these requests. I would like to setup a rule for each that blocks all requests from that ip. Help. Sorry I just started typing and it ended up turning into me asking for help.
I have to agree BUT were talking about the Amendment which is really an american thing.
Just becuase someone hit me dosn't mean I am entitled to hit them back, if someone thieves from me I am not allowed to hit them back.
If someone inadvertantly smashes my car I am not allowed to trash their car in return... There are a lot of things that this issue will refer to. I'd be carefull what you all wish for
iptables -s x.x.x.x
this would do something to packets from the respective IP. what? we use -j [jump] to decide...
iptables -s x.x.x.x -j DROP
this would drop the packages, which is a stealth measure for the most part. other options are ACCEPT and DENY. In the case of the latter the other machine receives a "request denied" so it is preferable to use DROP.. nothing gets sent back, so in the case of pings nobody would know you are there :)
iptables -A CHAIN -s x.x.x.x -p tcp --destination-port ftp -j DROP
This is used in order to add rules to those already existent. For how to create a new chain and stuff, iptables --help or man iptables should help you out... that's really not a big deal :)
so, the -A stands for append, CHAIN is which chain you want to use, -s x.x.x.x is source IP, -p is the protocol [tcp in this case, also could be udp or icmp], and --destination-port specifies only certain ports to use this rule. Port's can be assigned by name or number. FTP in this case could be 21... Also, the -j DROP means "jump to DROP"... DROP being a specific mode of iptables.
You could also have something like...
iptables -A CHAIN -d x.x.x.x -p tcp --source-port ftp -j DENY
Here you see we have -d x.x.x.x and --source-port... it means destination IP and the port on your machine from where communications starts. It's use to restrict certain users from certain stuff. I'm sure you can think of some uses...
iptables -A INPUT -i ppp0 -p tcp --syn --destination-port ! 80 -j DROP
This command stops all communications on interface ppp0 [or you could have eth0 here]. -i stands for input and -o for output... Then we have the rule, which says that on protocol tcp, all syn packages _except_ [the '!'] those to port 80 will be dropped.
Again, iptables --help or man iptables should teach you quickly how to save these new chains [so that upon reboot your new rules are still in place] and... further info [where I learnt iptables, pretty much, except for the man :)] here!
I just thought I should give you a nutshell of what's there anyway. Hope it helps!
[edit]
issue with URL
[/edit]
Hmmm i dunno if someone smashes your car its a good chance theirs is going to be a bit smashed as well. Oh well back on subjectQuote:
If someone inadvertantly smashes my car I am not allowed to trash their car in return...
I agree that yes hack backs could be legitimate depending on the situation. I mean if a system is attacking you non stop and its costing you then you have to do what is necessary to stop the attack. Even if that means neutralizing the system. Im not talking about just attacking because of a ping that would be rediculous. I think you will understand what im talking about.
PeacE
-BoB
if someone has to wonder if a hack back is ethical or not they shouldn't even attempt it. some un-ethical son of gun is just going to kick the crap out of them
Or you could block them at the firewall. And if your firewall doesn't work, then contact your ISP and ask them to block it at the router. And also contact the ISP of the offencing machine and show them logs proving what is going on. Better results then a "hack back" and completely legal.Quote:
Originally posted here by fl34bit3 I mean if a system is attacking you non stop and its costing you then you have to do what is necessary to stop the attack. Even if that means neutralizing the system. Im not talking about just attacking because of a ping that would be rediculous. I think you will understand what im talking about.
When dealing with law it is much simpler to keep it as black and white as possible. Either something IS or it ISN'T legal. If you start trying to spell out scenarios where it is legal or isn't legal you open it up to interpretation and you never know who is going to be the one drawing the line.
Its like our freedoms here in the U.S. We have the freedom of expression, religion, etc. I think the KKK is abhorant and should be illegal, but if I decide that their beliefs are illegal, what is to stop the next congress from deciding MY beliefs are illegal. Once you start drawing lines its a slippery slope and you don't know if you'll like the next line that is drawn- you may be on the wrong side of it.
I wrote an article a while back in which I think I may have even referenced Tim Mulle's presentation: Counter-Hacking: Savior or Vigilante?
Ig he thinks he can "hack back" without forensically contaminating the evidence stored on a machine, he is an idiot. The machine is infected with a virus. You know and I know whether or not tht virus changes timestamps. But try exlaining that to a jury and you'll begin to understand the problem.
He would find it incredibly difficult, if not impossible, to convince either judge or jury that the timestamps can be proven to be accurate and that therefore his attack was not the one which got the machine infected in the first place.
But beyond that, this practice is just unethical. This type of eye-for-an-eye justice is what our legal system is designed to avoid. I don't know where he comes from, but in the civilized world we base our justice system on rehabilitation, not revenge.
IMMO, hack backs will always be a controversial question due to the fact that one may feel in the right no neutralize an attacking system, but what if that system is mearly a zombie, and Joe Average user doesn't even know what his only-4-checking-email-computer is doing...
Soulemans solution may be the right way to deal with it, block their IP or if you're really upset then tracert them and report them to the abuse@their isp. Even if they don't know they are compromised, an email/cut-down from their ISP will definitly ring some bells.
I've read here on AO that a good nmap scan back sometimes is what it takes. If he's really trying to hack you he will know YOU KNOW, and possibly stop being such a lammer.
Here here, I think it's all cool in some cases force is nescesary but were talking about sheer eye for an eye tactics. It's wrong, I'm no chrstian or cathoic whatever you call it. But your all asking for a world of pain, both in your jobs and in legal terms if this thing goes through, How many people are going to become half assed Hackers becuase theres a legal way to do it, how many of those under 18 script kiddies wll get a slap on the hand for doing it and told not to do it again. It won't be a big thing hacking will become a nominal thing and ... it'll muddy the whole issue. Isn't it simple enough that we can ... inform authorities, surely theres some way of doing this. Christ imagine what would have hapened if we were hacking back during the blaster worm thing.. I don't think I could have handled the work load... Eauch...
just to clarify something, if some one hits you, and you feel they will harm you again and have no way to aviod it, you CAN hit them back, it's called self defense. Disabling the attacker is not illegal, least not in the usa... As for computers, there are other options, calling isp, firewalls, etc... this is why it will never be legal.
Quote:
Originally posted here by cross
just to clarify something, if some one hits you, and you feel they will harm you again and have no way to aviod it, you CAN hit them back, it's called self defense. Disabling the attacker is not illegal, least not in the usa... As for computers, there are other options, calling isp, firewalls, etc... this is why it will never be legal.
The Law says, that if someone ATTEMPTS to hit you, you are legally aloud to swing. They had this on TV one time. They brought in a lawyer because there was a myth that you had to be hit in the face 3 times before you could strike back.
The lawyer said "The law says if they attempt to hit you, or act like they may hit you, or if they do hit you, legally you can hit back and stop themf rom harming you. No one is going to wait for 3 hits to the face before hitting back thats stupid".
So, port scanning my network, is an attempt at hitting me, and attacking it is hitting, guess what's going to happen.
The point about defending yourself from a physical attack is that you can only use what the law refers to as reasonable force, at least that is what is allowed in the uk. So if someone tries to punch me and i pull out a gun and shoot him, then i will be going to prison for quite some time as that amount of force will be deemed exessive.
So if someone is trying to hack me what would be classed as reasonable hack back? I think the whole issue would be a nightmare.
Prove it, beyond a reasonable doubt, that they scanned you -- keeping in mind that anything electronic can be altered whether on the screen, on magnetic media, written to media, etc.Quote:
So, port scanning my network, is an attempt at hitting me, and attacking it is hitting, guess what's going to happen.
This is the biggest problem with the attack back scenario and why, IMHO, it will never be justifiable. It is near impossible to prove without some doubt that someone specifically attacked you. It gets to be even more fun with places like Internet cafes and DHCP (that is actually functional).
I certainly would love to get back at the schmucks sending me all sorts of spam and/or viruses (I consider the propagation of viruses a direct attack given the volume they take up on networks) but reality is that I cannot prove for sure that a) the person at the machine presently is aware b) is in fact the "criminal" c) actually came from their machine.
Then again.. it does work both ways! :D (however, with my luck, I'll get the schmuck that spoofed the FBI)
Ms. M: I think in a case where a worm has been "on the market" for a month, it hit the mainstream media and the schmuck still hasn't recognized or cared that his machine is hammering away at every machine it can then a hack-back is justifiable when you are getting no joy from the ISP.
Outside that it's really hard to prove that the IP address "attacking" you is anything to do with the real attacker. Now, were you to do a little "engineering" and maybe place a little logging system to determine the address of the remote connection and then follow the trail to the source then a hack-back is a wonderful thing.... But I have a life and I'm a sucky "cracker" so it's not something I'd try.... But I wouldn't castigate the person that does..... ;)
Souleman>> I know exactly what you mean. Just wanted to say though that i forgot to put in part of what i was going to say. I meant to add in that "when all else fails" that you have to do whatever is neccessary. But that would be the last and absolute final step in a long list of things to fix the problem.
PeacE
-BoB