121

I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, fixed the vulnerability and blocked the IP address of the hacker.

Can I do something to punish the hacker since I have the IP address? Like can I get them in jail or something?


This question was featured as an Information Security Question of the Week.
Read the Feb 05, 2016 blog entry for more details or submit your own Question of the Week.

23
  • 180
    The said hacker already spends his nights on his computer, alone, staring at his bleak screen, looking for vulnerabilities and installing backdoors. How could you possibly punish him any further ?
    – Tom Leek
    May 11, 2013 at 13:20
  • 39
    Are you 100% sure that you deleted all of the shells? It may be prudent to rebuild the system from the ground up and audit your network to make sure the hacker wasn't able to use the compromised machine to gain access to other machines on the network.
    – user22208
    May 11, 2013 at 14:15
  • 41
    How do you know you have his real IP Address?
    – MDMoore313
    May 11, 2013 at 18:04
  • 44
    Go over to his house and speak sternly with his mother.
    – Warren P
    May 11, 2013 at 20:21
  • 31
    @TomLeek writes: The said hacker already spends his nights on his computer, alone, staring at his bleak screen, looking for vulnerabilities and installing backdoors. How could you possibly punish him any further ? Yeah, but the ground is level on that point, since OP spends his nights on his computer alone, tracking down the activities of crackers attacking his website and dreaming up punishments.
    – Kaz
    May 11, 2013 at 22:04

12 Answers 12

153

You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it.

However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and move on.

10
  • 21
    @ClickUpvote Everybody makes mistakes occasionally. If somebody makes enough of them and the police puts in the effort to dig through all that data you might catch someone. Often they catch one in a group and then use him as a mole to catch the rest. May 11, 2013 at 9:20
  • 13
    Or they hack something that the law/government actually care about, which gives them an incentive to actually try and catch them. I'm sure they don't really care about the average website.
    – rooby
    May 11, 2013 at 13:21
  • 8
    @ClickUpvote here's a list of what I see as hacker investigation priorities: [Exploited government owned networks, Large scale financial exploits, DDOS on public govt sites, Zero Day vulnerability distributers, high incident exploiters, ....., ....., browse facebook out of boredom, ....., ....., script kiddies] (this case)
    – justausr
    May 11, 2013 at 19:00
  • 16
    Of course, you could just post the IP address on 4chan and hope someone is especially bored today...
    – Josh
    May 12, 2013 at 4:20
  • 7
    @hydroparadise If you live in the USA and a robber robs your house you report it to the local corps. What happens if you live in the USA, host your website using a server located in a datacenter in Japan, was attacked by a French hacker using a compromised machine in China? Who do you report it to? Which law enforcement agency is going to arrest the guy?
    – user10211
    May 13, 2013 at 15:25
78

So you have identified the IP address involved in the process of hacking your website. Congratulations!

What makes you believe that this IP is indeed a hacker's IP address, and not simply another hacked into computer running in zombie mode? And who is to say, that your own web server didn't run in exactly the same zombie mode until you removed the shells installed through, as you say, later identified backdoor?

Should you expect another person, whose web server was attempted to be, or indeed was hacked through your compromised web server's IP, thinking exactly the same about you, and is already looking for ways to get even like you are?

I would sincerely hope this not to be the case, and we've moved past the times of witch-hunting and freely accusing and passing judgment upon people before proven guilty beyond reasonable doubt in a court of law, where they are allowed to defend themselves, present their own evidence, dispute gathered evidence against them, and this evidence hopefully weight by and later passed ruling upon by decent enough people to be able to see both sides of the coin before calling it for what it turned up to be.

The mandatory IANAL disclosure applies at this point, but these are the options that you probably ought to be looking at:

  • Report the incident to proper authorities. You should do that not only in a hope the real hacker eventually gets caught and prosecuted, but also to cover your back in case your web server was involved in other illegal activities while it was compromised and acting in ways beyond your immediate control. Then cooperate, be ready for your web server to be taken to a forensic laboratory and you might suffer your services downtime because of it. This will take time off you, and possibly incur cost too.

  • Alternatively, harden your web server against any other possible backdoors, exploits in software you use, and hire a proper security analyst to do their magic. Fill an internal incident report and have it verified by an independent party, to cover your back that way in unlikely eventuality you'll later need this as evidence, if contacted by authorities. This will also take time, and it will cost too. But your web server will be online and your business hopefully making up for any costs involved.

Your choice then, but don't get yourself in greater trouble by playing a self-righteous vigilante, it's just not worth it and the odds are against you from the very start that you'll be seeking vendetta at the right address.

2
  • 12
    Most people outside this community don't know about 'zombie mode'. I think you misunderstood OP. Asking 'can I get them in jail' does not make them a 'self-righteous vigilante'. That's a normal desire for justice. It would be useful to specify who are the 'proper authorities'. May 12, 2013 at 13:27
  • +1 that it's probably not their IP. Any real attacker would at least bounce ONCE, but more likely would proxy -> tor -> victim machine Feb 10, 2016 at 13:59
48

The term most often used to describe what you're talking about is Hacking Back. It's part of the Offensive Countermeasures movement that's gaining traction lately. Some really smart people are putting their heart and soul into figuring out how we, as an industry, should be doing this. There are lots of things you can do, but unless you're a nation-state, or have orders and a contract from a nation-state your options are severely limited.

There are a number of laws regarding hacking a computer you don't have authorization to hack, the CFAA in the USA, the CMA in Great Britain, the CHM in Australia, and the list goes on. All of which make it illegal to do what you want to do, and in some cases have pretty strict penalties for even the smallest of actions.

Let's assume you can hack the offending machine without breaking a law. This is pretty less than ideal. Sometimes the IP address you have will point you back at the actual computer where the hacker was sitting. This is the best case, and also the least likely to happen. More often the IP address you have is an innocent intermediary, that is it's more likely to be your grandmother's eMachine that was compromised when she clicked on a dodgy website while researching canasta strategies. So while there is a chance hacking back could punish the do-badder, the most likely scenario is that you break your aged grandmother's link to the outside world.

Your best option? Report the incident to the most appropriate law enforcement agency. Unless there was significant financial loss it probably won't gain much traction as an individual case. What could happen is that your information will get added to the pile of evidence that could be used to take down a large group.

1
  • 2
    @ŁukaszLech: It's hard to overcome our initial feelings of violation and the urge to exact some kind of toll. Do enough investigations and you start to realize that in almost all cases the source of the attack is nothing more than an innocent bystander. Pretty sad really.
    – Scott Pack
    May 11, 2013 at 17:31
37

Don't play their game, you'll lose

I've learned not to play that game, hackers by nature have more spare time than you and will ultimately win. Even if you get him back, your website will be unavailable to your customers for a solid week afterwards. Remember, you're the one with public facing servers, you have an IP of a random server that he probably used once. He's the one with a bunch of scripts and likely more knowledge than you will get in your quest for revenge. Odds aren't in your favor and the cost to your business is probably too high to risk losing.

It's most likely not his IP

This kind of hacking is incredibly low priority to law enforcement and the IP you have probably belongs to a server 1000 miles away from said hacker. If you are intent on getting his IP, he may have used a proxy whose purpose isn't anonymity, if you track http headers, look for x-forwarded headers in the offending requests, those will more likely have his real IP if they're there. Nobody bothers with chaining proxies for "fun" hacks like this. But again, don't bother, he's hacked you, he won, if you play his game, he will win again. Right now it's not personal to him so the cost of a DDOS attack on you doesn't outweigh the benefit yet.

If you must play the game

I used to setup honeypots for hackers. When one would make it into my intentionally left vulnerable server in my DMZ, I would place some fun files that look important and lead to other fun goodies that aren't so good for a PC's health. Now if I do setup a honeypot, it's just a logging server with a few vulnerable ports so I am alerted of attempts on my network. That way I can watch a little more closely when it's important.

You're looking at this wrong

When a guy cuts you off on the interstate and you rush up to get him back, his response isn't always going to be good for your health. Instead of getting even, think of your experience as a free security audit where the only expense was doing work that you should have done in the first place. Hackers are frustrating, but the first couple of times you have this happens will change your view of security. But overall....Woooooosah

1
  • 1
    Even if it is "his" IP, it could be a dynamic line which can be reassigned to another customer.
    – Kaz
    May 11, 2013 at 22:06
22

Remember - no matter what they did, if you do hunt down the hacker (assuming you have identified the right one) and punish them,

you will have broken the law, and the police are likely to be able to prove your guilt

Don't do it. Vigilante justice is for Caped Crusaders and Superheroes!

1
  • 8
    Note that the person didn't say they were going to hunt them down and do something bad. They specifically say "Like can I get them in jail or something?", whcih means going to the police.
    – rooby
    May 11, 2013 at 13:23
21

Of course you can punish hackers. Just use a service like GeoBytes IP Locator to know their address. Drive there, knock on the door, and whoever opens, he/she must be the hacker. Then just go ahead and punish them for the bad girl/boy they are.

Back to reality. Unfortunately, it's very likely that they'll go unpunished.

Depending on your jurisdiction, your case might just be too minor to entice capable law enforcement agencies to track down your attacker. Of course, officially, they'll never tell you that. You'll report it, and they'll tell you they'll do the best they can.

It's very likely that your attacker is using some anonymising service (Like Tor) which makes it very difficult and resource-consuming to track him.

If I were you, I'd ask a security expert to assess my site and fix the vulnerabilities to prevent this from happening again.

0
20

There's no profit in it for you to punish the attacker. Your resources are best spent securing your server and getting on with business.

13

What you can do directly is sending an abuse mail to his ISP. Just lookup the ip in the ripe.net database. In most cases there is an abuse mail listed for the owner of the IP.

ISP take legit abuse mails seriously, at least in my opinion.

3
  • 1
    Mailing abuse at his ISP... May 12, 2013 at 20:02
  • 2
    This is the easiest and most likely way to actually "punish" the hacker. Worst case the owner of another machine that was hacked will find out his machine has been compromised and will hopefully resolve the issue. Best case you cause issues with the hackers home ISP.
    – stoj
    May 13, 2013 at 0:04
  • 3
    This is how the Internet works. Doesn't everyone know about abuse@isp? If this was everyone's response as soon as attacks are discovered we would have far fewer attackers. May 13, 2013 at 14:31
10

What yo do is: Contact your local computer crime police office, file a complaint and press charges against unknown individuals, hand over the IP address and you might get lucky.

In reality, chances are low anything will happen.

2
  • 1
    Is there, anywhere in the world, such an august police office or station as this? May 12, 2013 at 5:49
  • I know we have a Federal Computer Crim Unit May 12, 2013 at 7:15
6

If you have the time/knowledge/resources you can redirect the traffic from the attacker's IP to a honeypot and study the attack traffic eventually you'll find something useful to link to the responsible person.

Make sure to keep an eye on your server to track attacks from new IP's and you should add the new range into the redirection list.

Have fun

1
  • Good intentions can result in a bad outcome. It's simply not how botnets operate - Command & Control doesn't care if one of their zombies suddenly stopped relaying requests on its behalf, it simply moves on to others when any disruption is detected. And allowing the bot to continue relaying requests (even if sandboxed and not further affecting infected host) can be a dangerous path, and the one doing it held responsible for allowing it. I just wouldn't suggest it. Even Google's own team had big problems/reservations doing that.
    – TildalWave
    May 11, 2013 at 18:59
5

Well I don't think you can trace the hacker by using his IP. Most probably he is using a zombie machine/IP to do what he want. Best thing you can do is to report the authorities with whatever details you have & tighten your security.

Make sure your web site stays usable and user friendly while you tighten the security.

-2

I think the IP address you got is may be proxy address..because the one who know how to hack he/she must know how to hide their actual IP..So just enhance security level of your website. and defend your website..because now a days hacker doing all this thing easily and can't caught..

Thanks..

1
  • 4
    Please pay attention to what's already been answered. You're not really providing any new insights about the topic discussed here, and are merely repeating points others made before you. Might I say, in a lot clearer manner at that too. Thanks!
    – TildalWave
    Jul 16, 2013 at 8:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .