2

Imagine your site was hacked, you have put measures in place to prevent the same hack being successful again using server permission settings but are still unsure what the original exploit was which allowed the hack to take place, and the hacker left their ICQ nickname.

Is there a benefit in getting in touch to ask for details of the original exploit so it can be patched? Presumably they might be helpful or they could try to extort you. Are there any other potential problems with engaging with the hacker to be aware of?

  • A person breaks into your home, steals your stuff, then leaves their phone number and suggests meeting up. Sure, what could possibly go wrong? – MechMK1 Apr 7 at 13:05
  • @MechMK1 yes the question is specifically asking what could possibly go wrong :P – anon Apr 7 at 13:07
  • Basically, you could have your PC taken over, all your credit card data stolen, your personal data could leak all over the internet and possibly your cat could explode. Possible benefits: Few. – MechMK1 Apr 7 at 13:09
  • @MechMK1: Why is that poor cat involved here? What is she guilty for? :-) – Serge Ballesta Apr 7 at 13:54
  • 4
    @SergeBallesta The cat knows what she did. – MechMK1 Apr 7 at 13:59
2

Hacking your server and profiting from it is the cybercriminal's job. Their "job" is unregulated, risky, unstable, without any guarantees, highly competitive, in an environment where they need to be faster than their opponents (not only other criminals, but also sysadmins, antivirus vendors, etc.) and they need to exploit every opportunity they have before it's too late. You are a stranger to them, and you are an opportunity. Why should they help you? They need to make money from you, not lose time and money because of you. That's why you can't expect anything from cybercriminals, and engaging with them will be very dangerous. The only thing you can expect from cybercriminals is other exploit attempts, so engaging with them is only useful for investigation or research purposes (and only professionals and investigators should take these risks).

The only hackers you can expect to help you are ethical hackers. The problem is though: how do you distinguish an ethical hacker from a cybercriminal, or even from a gray-hat hacker? Sometimes it's hard to know what is running through a hacker's mind. Unless you have enough experience and you know what you are doing, if you need help with cybersecurity the safest option is to contact a cybersecurity professional.

| improve this answer | |
0

This is a tough one! Let's analyze the scenario in regards to the potential chances and risks. This might give you a foundation to make an educated choice.

Scenario: We live in the year 2020. People are able to make a good living off working as a cyber security professional. From consulting over secure development to bug bounty hunting - there is a niche for every skill set. Nevertheless, you encountered someone who decided to use his abilities for something unethical and even illegal - breaking into your system without consent. This shady criminal offers you his contact information. Instead of going down the usual route when dealing with criminals - calling the police - you decide to engage in online conversation with this person on the platform he chose.

So what could happen?

Chances:

  • You get a thrill out of "talking to a real hacker" and have a nice little story to tell. People may acknowledge your slightly exaggerated version of the story with a high-five or at least a friendly nod while saying: "Cool story, bro!"
  • You actually found the last real script kiddie on the world wide web, which is believed to only exist in the minds of threat modeling experts. You get mentioned in the next episode of National Geographic.
  • Jackpot, it's Trinity, looking for her Neo. She shows you how to escape the Matrix, you experience the suffering of real life until you finally realize, you never were the chosen one in the first place. Well, on second thought, this might actually be more a con than a pro...

Risks:

  • The criminal lures you on ICQ to use an exploit (e.g. a 0-day for the ICQ client), tricks you into visiting a malicious site or install malware on your system. He steals and/or deletes all your local data, installs a keylogger to capture everything you are doing in the future on your system, gets access to your webcam and spies on you, etc. Later he uses the data to blackmail you or perform further attacks.
  • The criminal gives you ill advice about the vulnerability he exploited originally. He may trick you into weakening the system further or installing malware pretending to be a patch. You are left with a false sense of security, while having made matters worse.
  • The criminal finds out about other systems you own. They might be vulnerable to the same exploit or at least have a similarly low security level. He just got a list of new targets to attack.
  • The criminal gains valuable information about your surroundings. A friendly chat may give him hints about your background, your family, your friends, your pets, who you work for, etc. He can use this information to conduct advanced social engineering attacks and even impersonate you. This also gives him prime targets for blackmailing. And don't forget about those weird security questions to reset your passwords. Knowing the name of the teacher you had in third grade might actually open the door to one of your accounts.
  • The criminal might not be after a financial motive but just want to cause havoc. Stealing personal information from your systems and publishing them on the internet for his fun might be all he is after. Still could have a devastating effect on your life.
  • The criminal could intent planting illegal material on your system to get you in significant legal trouble. You know nothing about that person, except that he or she broke into one of your systems and left an anonymous ICQ address. Might actually be someone who holds a grudge against you and uses this attack vector to cover his or her tracks. Probably not the most likely scenario, but you cannot rule it out.

Comparing the chances to the risks is something you have to do for yourself, as I do not know your preferences and risk appetite. I'd rather advice against engaging with this criminal, but that's just me.

| improve this answer | |