If an attacker gains unauthorized access to a host, or makes unauthorized modifications to information on that host, is it appropriate to contact the police or some other law-enforcement agency? In many cases, the host in question is in the United States, and the attack appears to originate outside the United States.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
As far as I know (and don't go sticking your fingers in any ports now because of this) it's not worth reporting to any law enforcement unless there has been harm or damage to the system. In that case the cybercrime devision of the FBI is where you would report it, which is located in the "contact us" feature of the FBI's cyber-crime site and select "Internet crime" if you have a crime to report. At this point, when no harm is done, as far as I can tell it's pretty similar to walking on someone's lawn (there's no gate, so you don't have much of an argument, or there's a gate and I didn't break it when I came in). Hence, to extend the metaphor, I recommend you send a report to the Host's web admin (which can usually be found using the Last, to go on a tangent, most local law enforcement authorities have a cybercrime division as well, but they mostly handle harassment (serious internet threats) and fraud investigation. |
|||||||||
|
|
I can only provide one Dutch case: A webdesign and hosting company (with approximately 100 clients) had a password hacked that was used for everything. (Yeah, don't get me started on all other security issues there.) A few websites were defaced, and private information from the owner was made public. Overall relatively little damage, but damage with a clear origin (we had the attacker's IP which was not a proxy and traced back to the same city). We printed out the logfiles that we were able to get together (logging was malfunctioning on most websites...), and my boss went to the police with the information. At the police station, nobody knew anything about computers, but everything was written down best they could. The people usually taking these cases were having a training and would probably pick it up next week. Next week came and passed. Next month came and passed. We called for updates, nothing. The case would have been a simple lookup (ISPs are required to log which IP is owned by whom at any given time), but they didn't do anything. To the best of my knowledge, it's now 6 months later and the case hasn't even been looked at yet. I still think you should always go to the police with a breach, but the odds of it being solved are low when there is no big money involved. |
|||||
|
|
I can't really tell you about the US, but here is a general consideration: I heard a story of a woman (US) who parked her car in a long-term parking garage and when she wanted to retrieve it the company had gone bankrupt and her car was gone. Police didn't care to investige what appeared to be a multi car theft... However I feel it is important to report such incidents for the sake of statistics and research, even if there is little or no chance of a positive outcome. Simplified speaking: If nobody reported crimes, police wouldn't know if the crime rate was high or low and what to focus on and try to prevent. Even if police were not able to track somebody down based on your report, maybe one day they catch somebody and might be able to link your incident to that person. Also a police report might be required by your insurance company in order to pay you out. (Also don't underestimate the USA's diplomatic, political and military involvement around the globe...) PS: Usually the officers at your local station will not know what to do but your country's Department of Justice will probably have experts and a point of contact. |
||||
|
|
|
What about an sql injection attack where data is only leaked(by selecting) and nothing is altered. |
||||
|
|
