I had a call today from a customer, who asked me details about a cyber attack that occurred yesterday on one of his web servers, it was a common OS injection attack encapsulated in a http post header.
The source IP that committed the injection was a Chinese one, with a reverse & normal lookup I had the confirmation that an untrustworthy domain was behind the attack.
I gathered this information:
- The Payload
- The source IP
- The domain
- The customer infrastructure details
That info is enough to write a report on how to prevent the attack in the future, which should conclude my job on this event.
I got a call from my manager 15 minutes ago, asking me (for the first time) to use my pentester skills to attack this Chinese proxy server back. The goal is to trace the source IP as deep as I can. (The customer requested it).
I'm aware of the UK, French, US & Japanese cyber laws, but not the Chinese. From my point of view, doing this should be illegal.
My manager is telling me the opposite:
There is no law about foreign cyber attack in China. You can nuke them as much as you want.
I don't want to put my company in an embarrassing situation nor disappoint the customer. (This is happening in Japan, here, customers are above gods.)
What you would do in my position? Is what the manager says true?