Fighting Back: Symbiot Security

[MrLinus]

You can visit their site at http://www.symbiot.com/ but I wonder how legal this will be and how accurate it will be. They claim the following:

first IT security solution that can both repel hostile attacks on enterprise networks and accurately identify the malicious attackers in order to plan and execute appropriate countermeasures - effectively fighting fire with fire

There are no details as to what the iSIMS actually is (device or software). In fact, details are very vague. Perhaps a way to get attention before release?

[phishphreek]

I've always been really interested in these types of "solutions".

On one hand, if there was a way to remove vulnerable machines, or remotely patch them, then the internet would be a "safer place". But, in doing so, unautorized access to a computer, you're also breaking the law. Is it worth getting yourself into trouble to keep a machine from attacking you? Or, just make sure your firewall is setup to block the attacks?

They didn't really say HOW they were going to stop the attackers. Defense is probably best. Because how can you REALLY know who your attacking back? The actual "cracker" would hopefully not be so stupid to attack directly from their machine. So, you attack Grandma Smith...

Reminds me of a thread that we discussed a while back... I think most of the opinions will be relevant, so I'll link to it.

http://www.antionline.com/showthread...hreadid=252406

In the practical art of war, they are considered dispersive
ground. Additional levels of symmetric response apply invasive techniques, which
require the authorization of management for specific arming orders. Invasive techniques
can be categorized as: (1) non-destructive; (2) destructive but recoverable; and (3)
destructive, non-recoverable – again with respect to proportional response to the hostile
acts.

Ok, so I get a hold of their hack back solution and I call myself "management".
I attack back in the worst possible way turning grandmas machine into an boat anchor.

This could be fun!

[Lv4]

heh, I was just reading about that on the FD mailing list Ms Mittens

Anyway, like has been stated before this is a bad, BAD, idea. I don't know that there is any way, short of detailed forensics, that can prove who is attacking you, and this usually crosses the boundry to various different ISP security groups to do so. These people are going to be the cause of a lot of "issues" with basic endusers who get owned by some skiddie.

I forsee them getting the proverbial pants sued off of them in short order... but of course I could be wrong