Forgot your password?
typodupeerror
Security Businesses Crime The Internet Technology

Hacked Companies Fight Back With Controversial Steps 320

Posted by timothy
from the would-dearly-love-to-beat-up-some-spammers dept.
PatPending writes with this report on companies taking aggressive steps to deal with electronic attacks: "Known in the cyber security industry as "active defense" or "strike-back" technology, the reprisals range from modest steps to distract and delay a hacker to more controversial measures. Security experts say they even know of some cases where companies have taken action that could violate laws in the United States or other countries, such as hiring contractors to hack the assailant's own systems. Other security experts say a more aggressive posture is unlikely to have a significant impact in the near term in the overall fight against cybercriminals and Internet espionage. Veteran government and private officials warn that much of the activity is too risky to make sense, citing the chances for escalation and collateral damage." If you've been involved in such an action, how did it work out for you?
This discussion has been archived. No new comments can be posted.

Hacked Companies Fight Back With Controversial Steps

Comments Filter:
  • by Anonymous Coward on Sunday June 17, 2012 @08:15PM (#40355339)

    Just remember, if a company asks you to break the law then you deserve what's coming to you when you get caught.

    • by Geoffrey.landis (926948) on Sunday June 17, 2012 @08:34PM (#40355453) Homepage

      Obviously, they're in the process of developing Gibson's black ICE!
      We should be afraid.

      • by Taco Cowboy (5327) on Sunday June 17, 2012 @08:54PM (#40355563) Journal

        There are companies that I know, who employed "private contractors" to do things that they can not legally do, to "make things right"

        One of those companies, when its refinery was damaged by some African guerillas, got its own "private contractors" to hit back, and they hit back very very hard

        So, I am not surprise of what they will do on the Cyberwar front - the "private contractors" can do anything for you, so long as you pay them

        • I was under the impression that "private contractors" had something to do with "shrinking genitalia." Which would also be somewhat effective.

          cheers,

        • by Sir_Sri (199544) on Sunday June 17, 2012 @10:31PM (#40356001)

          In that situation you should pay off the local government police and or military forces. If you can't pay them more than the local militias or criminals, you shouldn't do business there.

          That is, in effect, what happens in civilized countries. You pay taxes for police services, if the services aren't up to the task you pay (technically 'lobby') politicians to write laws for you that will get the police up to the task or out of the way.

          cyber security is a different matter. There's no one you can pay unless you're a huge multinational, and even then you may not have a presence wherever the problem initiated from. If you're hacked domestically you have the same recourse as physical security, call the police, if there aren't laws that will cover you, pay politicians to write some. But if you get hacked from a foreign country there's really nothing you can do except build hardened systems in the first place. Counter hacking doesn't seem like a good idea, because they, being criminals, are somewhat less hindered by morals and laws than you are, and can retaliate thusly. I suppose if you're really big you pay politicians in both countries to write treaties for you. But that would just serve to make counter hacking illegal.

        • Companies hell, I've had cops come up to me in the shop that wanted obviously illegal stuff done, frankly i think they had seen too many episodes of CSI and actually thought you could hack a network with a VB GUI.

          But honestly this kind of shit surprises me not in the least, anyone who has read some of the stuff that has been dumped onto Wikileaks knows that you can buy pretty much anything if the money is good enough. Personally I'm waiting for a cyber version of the Pinkertons, a little private army you can hire to do whatever dirty little thing you need done in cyberspace. After all thanks to many otherwise pretty damned lawless countries having Internet access in a way its like the wild west only the criminals don't have to physically come over the border to do their raiding before heading back to their personal hole in the wall. So to see the corps fighting back when the law itself can't really do shit thanks to countries that don't play by the same rules? Really not surprising.

          • by L4t3r4lu5 (1216702) on Monday June 18, 2012 @05:15AM (#40357471)

            ... i think they had seen too many episodes of CSI and actually thought you could hack a network with a VB GUI.

            I cringed as much as the next nerd when I heard that line, but if you think about it it actually make sense. The fact that the terms are inaccurate is immaterial. She could have told them she fired up Backtrack 5 and used a known buffer overflow vulnerability in $PerimiterSwitchSoftware to get access to the internal network, and a remote code execution attack to enable directory traversal and and run w3svc as Admin, giving her free reign over the network. Would they have understood any more?

            You're thinking of it as the actress saying lines for your amusement. She's not. She's telling a colleague, who wouldn't understand anyway, a bunch of buzzwords and jargon to dissuade them from getting too involved in something which will only confuse them, and distract them from their own involvement in the situation.

            If Finance ask you about backups, do you tell them about cron jobs and the difference between differential and full backups? No, you tell them it's daily and hosted off site, and they should worry more about getting your pay cheque ready for the last Friday of the month.

    • "Credit travels upwards, blame travels downwards. That's just the way it works."
      - Pointy Haired Boss.
    • by sociocapitalist (2471722) on Monday June 18, 2012 @05:08AM (#40357445)

      Just remember, if a company asks you to break the law then you deserve what's coming to you when you get caught.

      Well..if the US government (stuxnet for example) can do it (with no declaration of war), then it mustn't be illegal right? /ironyoff

    • by non-plus (260549) on Monday June 18, 2012 @11:23AM (#40359529) Journal

      once, we had a less-than-skilled attack on a company i was network admining at. I traced the source down to an ISP in a South American country and ISP and I contacted them stating that such-and-such IP on their network was engaging in an attack on my company. I asked them to look into this and block the user from hitting us thru the routes I provided. They said there was nothing they could do. I asked them what other recourse I had. They told me there was nothing I could do but shut down our systems and hope it went away. I asked them if I could take action to stop it and could I get and e-mail statement to that effect. They sent me an e-mail stating there is nothing they could do and I could do whatever I needed to correct the situation.

      I ran it by the legal guys. got a thumbs up. put on a darker hat.

      moved a bit of traffic off the oc-12 we had and proceeded to clobber the offending IP address and the nodes at the far end (ISP equipment). I got a very polite call after about an hour telling me that the offender has been pulled off-line and asking if I would be so kind as to stop defending myself as it was killing their network. I stopped my defense and was given a few names with contact info to call in the future should the needs arise.

      a good result.

    • Every time a corporate tool asks me to break the law, I just tell them "No problem! Put it in writing and sign it!", and then they go ask somebody else and I never hear about it again. Totally not kidding.

  • by Anonymous Coward on Sunday June 17, 2012 @08:19PM (#40355365)

    I simply drive to the GeoIP location with my illegal police baton and smack the head of whoever happens to be there at the time when I arrive. I've been doing this for a few years now.

  • Stupid (Score:5, Interesting)

    by phantomfive (622387) on Sunday June 17, 2012 @08:25PM (#40355417) Journal
    What are you going to do, DDOS some script-kiddie's computer?

    The only time I've ever heard of something like this working out, it was when someone actually went to the effort to find out who was hacking them, and then turned the case over to the police. There was a story like that covered here on Slashdot several years ago.
    • by khasim (1285) <brandioch.conner@gmail.com> on Sunday June 17, 2012 @08:35PM (#40355469)

      If the script-kiddie knows anything at all he'll be attacking from a zombie he's already "owned".

      I think this is more sensationalism than fact.

    • Re:Stupid (Score:5, Interesting)

      by Wolfling1 (1808594) on Monday June 18, 2012 @02:21AM (#40356865) Journal
      A couple of months ago, when I ws selling my motorbike, I received a few of those 'I'm on an offshore oilrig and I want to buy your bike' spams. I was curious, so I constructed a honeypot to see if I could gather some intel on the perps before going to the police.

      Sure enough, within a day, I had IP addresses and was able to resolve to the attackers location. He was stupid enough to not be using a proxy, and stupid enough to leave some vulnerabilities open on his PC - that made it very easy to be certain that he was the attacker.

      I collated my data, and presented it to the Feds. They weren't interested. Couldn't even care less.

      So I contacted the attacker independently (through my own proxies), and let them know that they should get better at what they're doing, or get out of the game. They didn't try to contact me again.

      I can understand why people would be tempted to undertake their own vigilante actions.
      • Re:Stupid (Score:4, Interesting)

        by Taco Cowboy (5327) on Monday June 18, 2012 @02:37AM (#40356923) Journal

        Unfortunately there are still too many of those who believe that the law will "protect" them

        Even here, we can see those who fervently advocate going to the police / fbi / court even in the cyberwar cases

        There's no point to go to the law when the other side does not believe in one - and, the law there is, in most cases, do not have the jurisdiction over those black hat, in the first place

      • Re:Stupid (Score:5, Insightful)

        by SuricouRaven (1897204) on Monday June 18, 2012 @03:36AM (#40357091)
        The law is only for those who commit really serious crimes, like copyright infringement.
      • by dargaud (518470)
        I have a friend who has a small commercial website selling niche equipment. He sent a big purchase to a customer before discovering that the credit card was invalid or stolen (don't remember). It turned out that it really was niche equipment and a few google searches turned out one guy who was just expecting the very same equipment to launch an expedition. That guy had a website where it was all advertised for sponsors. He used the same login credentials on both sites ! So my friend logged into his customer
    • by rtb61 (674572)

      More accurately "What are you going to do, DDOS some script-kiddie's rotating IPv4 address" and attack some innocent bystander who has a capped download limit and must pay excess charges for downloads and uploads, not only blocking them from using the internet but also having to pay for excess usage charges.

      There is only one active response to be considered, gather all the evidence, reduce the risk of the attack but allow it to continue, contact the appropriate authorities supply the evidence and demonst

  • I was doing due diligence on a computer security firm once who had be subject to a DDoS blackmail attack, you know, give us $5,000 or will we will keep your web site down. Well they back traced the control to some cyber cafe in eastern Europe and worked with the State Department to actually get the local police to go in and arrest the people involved.

    If someone is actively hacking you then hacking them back isn't a crime (or it shouldn't be) its just self defense. And if you have to hire some firm to do it

    • by Anonymous Coward on Sunday June 17, 2012 @08:33PM (#40355447)

      95% of the time your "retaliation" isn't being targeted at the actual attacker, you are far more likely to be attacking some 3rd party's legitimate, vulnerable server that is acting as a re-director for the attacker. Now the 3rd party is going to be pissed that you're harming their business.

    • by smileygladhands (1909508) on Sunday June 17, 2012 @08:37PM (#40355481)

      I was doing due diligence on a computer security firm once who had be subject to a DDoS blackmail attack, you know, give us $5,000 or will we will keep your web site down. Well they back traced the control to some cyber cafe in eastern Europe and worked with the State Department to actually get the local police to go in and arrest the people involved.

      If someone is actively hacking you then hacking them back isn't a crime (or it shouldn't be) its just self defense. And if you have to hire some firm to do it I don't see how it is any different than hiring armed security guards or private detectives.

      If the law says you can't defend yourself from someone trying to ruin your business then the law is an ass.

      Equal to "If someone breaks into your home, you should be able to break into their home."

      • by jcrb (187104)

        Equal to "If someone breaks into your home, you should be able to break into their home."

        More like, "your neighbor is throwing rocks through your windows from inside his house and the police can't be troubled to do anything about it so you go over and stop him, and if his door is locked you may have to break it down"

        • Except in this case, you need to make sure those bricks are coming from that house. Forged IP addresses and what not.

      • by mysidia (191772) on Sunday June 17, 2012 @11:06PM (#40356125)

        Equal to "If someone breaks into your home, you should be able to break into their home."

        It's more like "If someone breaks into your home, you catch their license plate number. You should be able to break into whatever house the license plate is registered to, and see if you can find your stuff."

        No you don't. Investigating the crime is law enforcement's job.

    • by bky1701 (979071) on Sunday June 17, 2012 @08:42PM (#40355505) Homepage
      An eye for an eye makes the whole world blind, especially when the guy who just got poked in his good eye opens fire on everybody else.

      To me, tracking them down (let me guess, you can do a traceroute?) isn't exactly hacking by any means. Finding the person and telling law enforcement is not hacking, it is arguably the antithesis of hacking (not to say you got the right person, but that's aside the point). That makes your later claim that this is somehow like having someone holding a gun to your head, thus justifying "self defense," all the more confusing.
      • by jcrb (187104)

        To me, tracking them down (let me guess, you can do a traceroute?) isn't exactly hacking by any means. Finding the person and telling law enforcement is not hacking, it is arguably the antithesis of hacking (not to say you got the right person, but that's aside the point)..

        No they tracked them down by using an automated intrusion tool to break into one of the DDoS attack machines and then followed the stepping stone servers back to the control machine.

        • by bky1701 (979071)
          That is more advanced, but still, not exactly hacking by my standards (or of the kind TFA implies). It also still has the potential to have been falsified. In the "eye for an eye" reasoning, what if they were smart enough to give you a false IP and you DoS'd it back, only to find out it was owned by some foreign government?

          I guess I'm just not sure how the first half of your post relates to the second. What actually happened sounds fairly reasonable and not anything like what TFA is talking about; they d
      • An eye for an eye (Score:4, Insightful)

        by techno-vampire (666512) on Sunday June 17, 2012 @10:44PM (#40356057) Homepage
        An eye for an eye makes the whole world blind...

        Actually, an eye for an eye can be very appropriate, if you understand what the passage is really saying: not that you're entitled to an eye for an eye, but to no more than an eye for an eye or a tooth for a tooth. It doesn't so much institutionalize revenge as place a fair limit on it. There are, of course, two problems here: first, making sure you've identified the culpret correctly and second, how much hacking, DDOS or whatever is appropriate. Personally, if the attacker lives in a country where the law is respected, turning the evidence over to the proper authorities is probably your best bet. If not, have fun; after all, what's the worm going to do? Tell the police, "He found out I was hacking his computer, so he hacked me back?"
    • by girlintraining (1395911) on Sunday June 17, 2012 @09:18PM (#40355673)

      If someone is actively hacking you then hacking them back isn't a crime (or it shouldn't be) its just self defense. And if you have to hire some firm to do it I don't see how it is any different than hiring armed security guards or private detectives.

      Real world thinking doesn't apply here. In the real world, if someone attacks you, you can beat them up and claim self-defense because you know it was them. In the digital world, very likely the person you are targeting is innocent. If a computer DDoS' your network, you don't DDoS them back, you block that IP address -- because criminals don't use their own computers to conduct attacks, and neither do they sign every packet with their name, address, and phone number. So when you unload on who you think is attacking you, then (by your own logic) they have every right to retaliate against you! At that point you've created the digital equivalent of a bar room brawl, but with weapons of mass destruction. And with every response by either party comes the increased risk of drawing another person into the conflict.

      If everyone, or even a substantial minority, follows this logic it leads to the internet becoming lawless war zone where business simply cannot be conducted anymore because the network's reliability has been shot to hell. And let me be clear: You're not above screwing up. Even major name security researchers from businesses that specialize in this routinely get the names of the people involved wrong. Often. Open wifi, proxies, bot nets, the number of ways you can appear to be someone other than yourself is dizzying. Hell, I'm posting this through Tor... good luck even finding out who I am. Criminals have access to much better security than that... what do you think the odds are of figuring out who they are if you can't even figure out who I am when I'm making no special effort to hide my real identity?

    • by sycodon (149926)

      I always thought the cousin Greedo approach would be appropriate.

      Spammers/hackers should sleep with the fishes.

    • by PaddyM (45763)

      Ah yes, self-defense. Like that scene from the Big Lebowski, when they find out who stole their car? "Do you see what happens, Larry? This is what happens when you f%$K a stranger in the @$$."

      I think working "with the State Department to actually get the local police to go in and arrest the people" is a bit different than hacking someone back. Especially when "hacking them back" might be hacking the wrong person's Ferrari to bits.

  • by Anonymous Coward on Sunday June 17, 2012 @08:26PM (#40355423)

    I got the location of the punks house and nailed his mom while he was in the basement.

    Feeding time came around and mom did not bring down the hot pockets according the regular schedule and he peeked his head above ground.

    Said, "Hi. I'm from the company you were trying to hack. By the way your Mom is quite talented. Going to be around more often"

  • by spaceman375 (780812) on Sunday June 17, 2012 @08:28PM (#40355431)
    One morning our net was SLOW. Turned out most of our 200+ computers were participating in a DOS attack on a computer in Texas. We traced back where the infection started, checked the logs on that computer, and found the source.

    Then we called his mother.

    She unplugged his PC and told us she'd deal with him when he got home from school.

  • The hackee is going to hack the hacker? How exactly does that work? This would be like Poland invading Germany to get back at them for WWII; it probably will go about as well as the first time. Not to mention, in this case, it is quite likely the actual hacker routed through someone else's compromised computer, thus having zero effect, breaking the law, and only doubly slapping some poor SOB in the middle. Real reasonable, sensible, ethical activities here.
    • by Hentes (2461350)

      Exactly, in any case "active defence" is always an uneven battle. A small IT team that's main job is to keep the system running and most likely has little experience in hacking, and has tons of other work they also have to take care of, versus a team of experienced hackers (if they are just scriptkiddies then they most likely don't worth the effort) who do this full-time.

  • by GremlinInExile (2662187) on Sunday June 17, 2012 @08:34PM (#40355451)
  • A cyber strike-back policy can turn out to be the more malevolent version of the attempt by some media monopolists to track and threaten alleged copyright infringers by IP address. But where the track-and-sue approach pays lip service to the law, this one's attempting the online equivalent of vigilante justice. It would be interesting what methods these "security" companies will resort to.
  • Best defense.... (Score:5, Insightful)

    by gstrickler (920733) on Sunday June 17, 2012 @08:42PM (#40355503)

    1. Never put sensitive data on a computer connected to the internet, unless it absolutely must be there.
    2. Never keep sensitive data that you don't need, overwrite it, then delete.
    3. Never put confidential data into any computer system, networked or not. If you must, do so only if it's encrypted and secured by strong authentication at all times.
    4. Use all practical forms of security, firewalls, strong authentication, multiple networks with isolation, IDS, AV/anti-malware, no running as Admin/root, separate accounts for every user with appropriate access restrictions, including separate accounts for any services running on your servers, whole disk encryption, etc.

    The first 3 are what I call the "Mr Miyagi" approach, "Best defense, no be there." Item 4 is what most companies focus on, but it's not nearly as useful if you haven't used 1-3.

    • Re:Best defense.... (Score:5, Interesting)

      by girlintraining (1395911) on Monday June 18, 2012 @01:42AM (#40356755)

      Never put sensitive data on a computer connected to the internet, unless it absolutely must be there.

      o_O Not very realistic when we live in an "always on / always connected" world. Everything is merging into the network and stand alone devices are a minority.

      Never keep sensitive data that you don't need, overwrite it, then delete.

      Also, you should burn all the clothes you haven't worn in over a week (you obviously don't need that many clothes), not have a junk drawer, and while you're at it, delete any data on your system with an access time older than 3 months. Also, delete sarcasm.sys ...

      Never put confidential data into any computer system, networked or not. If you must, do so only if it's encrypted and secured by strong authentication at all times.

      Confidential, defined: Everything that isn't out on the curb with a big sign that says "Free" on it. Also, you should stop using the internet since most of it isn't secured and uses strong authentication... there's never a reason to use plain-text data exchanges. I mean, I don't even leave the house without my PGP key, and when I hangout with my friends, we use finger signs that are one-way encrypted... because otherwise someone might understand us and that would be bad.

      Use all practical forms of security, firewalls, strong authentication, multiple networks with isolation, IDS, AV/anti-malware, no running as Admin/root, separate accounts for every user with appropriate access restrictions, including separate accounts for any services running on your servers, whole disk encryption, etc.

      Basically, throw everything you can at the problem and hope something stops the attacker, and if you frustrate everyone who has to use the system because it requires 30 character long passwords rotated every 15 minutes, 9 levels of encryption, and a sample of hair, blood, finger print scan, iris scan, and ass cheek measurements... it might not be secure enough to protect grandma's secret goolash recipe.

      The first 3 are what I call the "Mr Miyagi" approach, "Best defense, no be there." Item 4 is what most companies focus on, but it's not nearly as useful if you haven't used 1-3.

      I take a somewhat simpler approach to security: Build it so that breaking it costs more than the value of what you're protecting. There is no perfect security. All of it can be hacked. Your only responsibility, professionally, ethically, morally, is to make it cost them as much or more to break through than whatever is being guarded. Criminals are just as rational as anyone else: They go for the low hanging fruit, the most gain for the least effort. I call it the "Mr. Bear Grylls" approach, 'You only have to run faster than the guy next to you when escaping a lion."

  • Looks like he pulled a Wilson.
  • If you've been involved in such an action, how did it work out for you?

    I have, and let me tell you, it was... hey, hold that thought for just a second, someone's knocking at the door...

  • Indeedy (Score:5, Interesting)

    by obarthelemy (160321) on Sunday June 17, 2012 @09:08PM (#40355619)

    I've been in contact about a job with a French cybersecurity company that has subsidiaries in 3 countries to be able to be able to offer 24x7 service, and, avowedly, do stuff (counter-attack for ex.) that would be illegal in France.

    I don't have a big issue with counter-attacks existing, and being nasty (let's face it, if you beat on me, I'm gonna beat on you). I do have an issue with the potential for counter-attack evolving into spying and pro-active stuff. I'm sure they're doing it already.

    • by jimicus (737525)

      I don't have a big issue with counter-attacks existing, and being nasty (let's face it, if you beat on me, I'm gonna beat on you). I do have an issue with the potential for counter-attack evolving into spying and pro-active stuff. I'm sure they're doing it already.

      I'm quite sure the ability to do so has existed for many years.

      Way back in the mists of time I administered a network with a CIPE VPN. (This was shortly after CIPE had been found to have a number of holes that weren't going to be plugged - it was in the process of being decommissioned but I digress). The straw that broke the camels back with that was when I spotted odd behaviour, ran tcpdump on each end of the VPN and discovered that a very particular type of traffic - VoIP as it happens - was going in one

  • by Dan East (318230) on Sunday June 17, 2012 @09:09PM (#40355625) Homepage Journal

    I would think lots of honeypots, dead ends, and misinformation would be effective. It would be difficult for the hacker to know when they have accessed legitimate machines or information. That's one of the problems with typical security is that it typically provides confirmation when an access attempt has failed. If instead of indicating failed access, you instead direct them to bogus data, it would make the hacker's life rather miserable.

  • by swb (14022) on Sunday June 17, 2012 @09:42PM (#40355783)

    When the money in play gets big enough I would think that physical reprisals would become an increasing likelihood. The money providing private security in Iraq and Afghanistan was good, but these guys are looking for new markets and selling an anti-hacking service that involves your attacker winding up dead in a car crash or of an accidental overdose has a certain appeal.

  • Doesn't End Well (Score:2, Interesting)

    by Anonymous Coward

    Google Multi-bet.

    "Seems there has been blackmail and hack attempts to at least two online bookies,
    Multibet.com and Centrebet"

    "syn flood on port 80 - MASSIVE one

    The server was originaly in Alice, thus killing the Alice network. Telstra then implemented their "DDoS protection" (www.radware.com - ironically, when we told our current DDoS protectors this, they laughed) in their Sydney office. It took out part of their core network in Sydney straight away before they killed the www server ips." http://forums.whi [whirlpool.net.au]

  • by PPH (736903) on Sunday June 17, 2012 @09:51PM (#40355825)

    So, if I want to hack Lockheed Martin, I route my attack through a compromised Boeing system. Then I sit back and watch the antics ensue.

  • by dbIII (701233) on Sunday June 17, 2012 @11:06PM (#40356127)
    The computer someone retaliates against could just be the previous victim of the cracker. If they have owned a government system of any kind at all (even something that provides a bus timetable) and you attack it then you could be in some very deep shit legally with a courtroom opponent that will spend whatever it takes of taxpayers money to make an example of you.
  • Slashdot is Toast (Score:4, Insightful)

    by DougReed (102865) on Sunday June 17, 2012 @11:31PM (#40356251)

    I've just about had it. Slashdot used to be news for Nerds. Now it's almost entirely mindless bullshit, and the last straw is when spammers are permitted to confiscate the site, and Slashdot management allows it. As if it's my job to waste my mod points to mark this crap as Troll.

    I am logging off, and deleting Slashdot from my home page. Have at it trolls. All yours now.

  • by WaffleMonster (969671) on Sunday June 17, 2012 @11:36PM (#40356271)

    While summary and TFA seem to imply some sort of vigilantie response it never enumerates even a single example of what that would be or cites any incidents where retaliation had actually been carried out.

    TFA only seems to provide any detail or information about misdirection, honey pots..etc to thwart attacks and obscure important information...All obvious and non contraversial actions.

    What I find most distrubing is this little jem:

    "In April, Department of Homeland Security Secretary Janet Napolitano told the San Jose Mercury News that officials had been contemplating authorizing even "proactive" private-entity attacks, although there has been little follow-up comment."

    How are idiots like Janet even allowed to be secretary of anything? I don't know whats worse having such thoughts or publically admitting to having had them.

  • by rossz (67331) <ogre@@@geekbiker...net> on Monday June 18, 2012 @12:12AM (#40356445) Homepage Journal

    A rather incompetent script kiddie kept trying to hack one of my servers some years ago. Poking back, I found he had left the entire C: drive on his windows box shared to the world. So I dropped a gift into his startup directory. Yeah, not much of a story.

  • by Chrontius (654879) on Monday June 18, 2012 @01:03AM (#40356591)
    I'm not the only person who thinks we're living in the cyberpunk future Gibson warned us about, am I?

    We even have chromed-out cybernetics, though they're fairly fashion-over-function these days. [bespokeinnovations.com]
  • by valdezjuan (83925) on Monday June 18, 2012 @07:19AM (#40357811)

    Say you work for company, which gets compromised and data is exfiltrated out of the network to a known source (the attacker used scp so the ip address, username and password are left within bash history or some other bash log). You find it within minutes or before the scp is completed. How do people feel about logging into the machine the data is being exfiltrated to and erasing it from the remote server?
    Even if the 3rd party box is one they popped and not the attackers true machine, your not damaging the machine, network, etc., you are just removing 'unauthorized data' (granted, it may be a very fine line).

  • by whitroth (9367) <whitroth AT 5-cent DOT us> on Monday June 18, 2012 @01:22PM (#40360931) Homepage

    Unless, like my system, you have black-ICE installed....

                  mark "geez, slashdotters don't even read anymore...."

Put no trust in cryptic comments.

Working...