I had a call today from a customer, who asked me details about a cyber attack that occurred yesterday on one of his web servers, it was a common OS injection attack encapsulated in a http post header.

The source IP that committed the injection was a Chinese one, with a reverse & normal lookup I had the confirmation that an untrustworthy domain was behind the attack.

I gathered this information:

  • The Payload
  • The source IP
  • The domain
  • The customer infrastructure details

That info is enough to write a report on how to prevent the attack in the future, which should conclude my job on this event.

I got a call from my manager 15 minutes ago, asking me (for the first time) to use my pentester skills to attack this Chinese proxy server back. The goal is to trace the source IP as deep as I can. (The customer requested it).

The question

I'm aware of the UK, French, US & Japanese cyber laws, but not the Chinese. From my point of view, doing this should be illegal.

My manager is telling me the opposite:

There is no law about foreign cyber attack in China. You can nuke them as much as you want.

I don't want to put my company in an embarrassing situation nor disappoint the customer. (This is happening in Japan, here, customers are above gods.)

What you would do in my position? Is what the manager says true?

closed as off-topic by Sjoerd, TheJulyPlot, schroeder Jun 12 '17 at 10:15

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Sjoerd, TheJulyPlot, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    "There is no law about foreign cyber attack in China" - Citation needed. What you have been asked to do is almost certainly illegal, you should involve law enforcement rather than seek revenge. The source IP you have is not even necessarily the attacker. Additionally, be vary careful about taking legal advice from strangers on forums. – iainpb Jun 12 '17 at 10:03
  • 1
    Nice to hear you created an account, welcome! While this question indeed seems to be about security, it is also asking for legal advice. Most people here are not legal experts, particularly not with knowledge about Japanese/Chinese law. I think your question may be off-topic. – Sjoerd Jun 12 '17 at 10:04
  • 1
    I'm not a lawyer, but I can't imagine your manager's request to be legal. – Jacco Jun 12 '17 at 10:07
  • 2
    I would not recommend engaging any target (no matter what its geo-location is) without explicit permission from the owners of the target. This is doubly true in the circumstances you have described. – TheJulyPlot Jun 12 '17 at 10:14
  • 1
    Your question is purely a legal one. You need an expert on Chinese law. You also do not state where you are from. There may be laws regarding the types of attacks you can launch from your jurisdiction. Taking legal advice from strangers on the Internet is bad, so is taking legal advice from a manager untrained in the law. Please consult legal experts. – schroeder Jun 12 '17 at 10:17

Browse other questions tagged or ask your own question.