Is hacking back a valid security technique for companies?

Question

Recently it has come to light through the reverse engineering of hacking tools that there are vulnerabilities in them that could be exploited to take over an attackers computer during a remote hacking session. In other words, while they are hacking you, you could get into the system from which they are launching the attack to find out what they have managed to access, what the system is, or even p4wn it yourself. The goals would be damage control, deterrence, and ultimately being able to charge the perpetrator of the crime.

Leaving aside the many legal, ethical, and moral considerations (if you are curious there's a debate recorded here), my question is whether hacking back using this technique has any value to a company. If it was ethical and legal would it be worth a company to invest in the systems and skills needed to make this work, or is it a waste of money?

EDIT: There's been several comments regarding leaving the legal and ethical considerations out of the question, so here's the explanation behind that. So far the discussion of hacking back in this manner has been discussed by lawyers, some shouting it is legal, and others saying it isn't. What they do agree on is that there's no case law, and until there is there will be no clear answer. Also, legalities vary from nation to nation, so the answer to legality is "maybe" and "it depends where you are".

However so far none of the discussion I've seen has been among IT Security professionals who would be the ones to design, deploy, and run systems that would to the hacking back. The lawyers all seem to think that organizations would adopt the technique as a matter of course, but I am not in agreement with that and I would like to hear the views of my peers. This is why I've asked the question apart from legal and ethical aspects.

Answer 1

We had this debate at our local OWASP chapter last night about whether a honeypot should strike back. We did talk about some legal and moral issues however decided it was not a good idea because:

1. The majority of attacks are coming from dumb clients on botnets or through automated tools, so what are you actually achieving by taking out yet-another-dumb client?
2. The focus of your business should be aligned to your business objectives - fighting cybercrime (unless you work for a police authority) should not form part of that.
3. If the attack becomes serious and you need to go to court; evidence that you "struck back" would not look good and could work against you. If you are going to spend money in this topic then spend it on forensic tools so that it strengthens any legal action
4. Circular attacks: consider if you accidentally strike back at another tool that has strike back capability? then you're just eating up bandwidth unnecessarily.

Answer 2

Despite you asking us to ignore the ethical and legal considerations, I'm not going to. I think that they're way too entrenched in this issue to be ignored, and approaching it from a purely fiscal perspective is misguided and pointless.

The law
The law in most countries is clear enough on this to say that there's no way to "hack back" in an effective manner without violating computer security laws. You're talking about gaining unauthorised access to a remote system. The question of whether that user is currently involved in a hack against you is moot - your actions are simply illegal regardless. In fact, you could end up getting in more trouble, since an attacker might be leveraging an innocent 3rd party's machine for the attack. Even if a law was passed to say that a hack-back was legal if you can prove that the source of the attack is definitely the hacker, you can never make that assertion.

The benefits
There are benefits to hack-back, but they're largely dependant on the situation. Here are a few things I can see being useful:

• Gaining intelligence on the attacker.
• Disabling or hindering the attacker.
• Increasing the risk for the attacker, thus preventing further attacks.

The drawbacks
Unfortunately, hacking back comes with a lot of drawbacks:

• Any intelligence gained cannot be used in court. You're compromising their system, which in turn makes anything on that system completely inadmissible.
• You might end up causing collateral damage during your hack, which you can be sued for. You might also hit the wrong target, as I mentioned earlier.
• The attacker may see it as a personal challenge, and become more destructive.
• Any hack-back law passed will be very difficult to comply with, since you cannot definitively say that a target machine accurately represents a personal asset of the attacker, rather than a 3rd party.
• Staff may be reluctant to participate in hack-back attacks, since their actions follow them for life, not just during their employment.

The costs
The financial perspective is pretty bland. If you hire a security officer, they're likely to be able to run pentests anyway. You can utilise this existing talent with no additional cost. The real cost comes with legal fees, which are likely to be crippling if you're found to have violated the law. Investment in any further resources doesn't seem to make much sense, since it's not particularly beneficial, and (for the moment) is highly illegal.

Answer 3

Without any consideration for the legal aspects, I think the simple fact that you would have to allow the attack to continue to avoid alerting the attacker is reason enough it is inadvisable, but I think it would depend on the situation. Even if the user appears to be stuck in a honeypot, leaving them able to explore the system is likely going to outweigh the potential benefits of the information you could gather.

If you were able to be configured in such a way that you had a high degree of confidence that they could not escape your cage and execute a meaningful attack, then, provided it was legal in your jurisdiction, I don't see what the harm would be in doing investigative counter-hacking to attempt to identify the attacker so long as you were non-destructive. Any destructive hacking would not be of benefit since the ultimate goal should be to identify the attacker and take legal action to stop it permanently, not merely harm them momentarily and possibly destroy evidence or alert them to their impending legal action. The nature of many attacks could benefit from being able to see one or more nodes back up the chain however since it would be useful to know where the command and control for a bot net is coming from.

That said, I think it would be very difficult to ensure there is no ongoing risk to your security so my general reaction would still be shut it down and let the authorities deal with it. The business purpose arguments were also a good one unless your business goals are served by helping bring down the hacker.

Answer 4

I know a story of a man with a house and a little garden.

After being burgled many and many times, asking police for quicker intervention, but his house was burgled again and again,

Finally the man have installed some traps around his house. Caution advertisment and warning was instaled too, all around his house... But.

Thieves came again and fall in a trap. Harmed, tief had call police to ask for reparation. The man was convicted because of thief harmed. Finally man was forced to paid a lot.

My conviction is: To be better than, I have to not be worst

Answer 5

personally I think that the time would be better spent getting your house in order before heading off into the wild west of vigilantism. Learn lessons from successful and un-successful attempts on your business and lock things down.

And more importantly demand that the products that you use in your IT infrastructure are secure, and securely developed, rather than the cheapest routers with the cheapest firewall in front of them just so that you can tick a box in the compliance checklist.

Answer 6

To add onto the good answer by AJ Henderson.... In order to hack back, you'd have to let the attack go one, and in terms of incident response it is not usually a good idea to allow an attack to continue and the quicker you discontinue the attack the better. But don't take my opinion, and instead refer to the NIST published guide called the Computer Security Incident Handling Guide (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf)

Here is what they have to say about a containment strategy which allows the attack to continue for whatever reason:

"In certain cases, some organizations redirect the attacker to a sandbox (a form of containment) so that they can monitor the attacker’s activity, usually to gather additional evidence. The incident response team should discuss this strategy with its legal department to determine if it is feasible. Ways of monitoring an attacker’s activity other than sandboxing should not be used; if an organization knows that a system has been compromised and allows the compromise to continue, it may be liable if the attacker uses the compromised system to attack other systems. The delayed containment strategy is dangerous because an attacker could escalate unauthorized access or compromise other systems."

Answer 7

It is already a juicy business inside the United State of America itself.

See this: http://www.crowdstrike.com/

Offensive Techniques and Procedures CrowdStrike's Strike strategies provide strategic and tactical measures for combating an adversary on your network. Through surveillance and reconnaissance, counter-espionage techniques, hostile target dismantling, and denial and deception, CrowdStrike security experts provide techniques and procedures to limit the number and severity of future attacks. We help your enterprise go on the offensive against today's most advanced adversaries.

http://www.crowdstrike.com/services.html

If you feel you got the skills they actively hire new people. You could be paid to hack people. A nice job, if you like that kind of challenge.

Cyber Threat Analyst/Offensive Operations Specialist_________________________ Successful candidates will have experience in tactical and/or targeted analysis positions tracking cyber threat groups, using both closed and open source analytical tools and information. Candidates will have strong research, written, and analytical skills as well as the ability to obtain a security clearance. The most competitive candidates will have counterintelligence and operational experience against various adversaries.

http://www.crowdstrike.com/join_services.html

Answer 8

The attacker could have compromised another victim's computer and sending the data through it. This could mean that when you tried to hack back at the attacker you instead hacked the other victim.