How can I punish a hacker?

Question

I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, fixed the vulnerability and blocked the IP address of the hacker.

Can I do something to punish the hacker since I have the IP address? Like can I get them in jail or something?

---

This question was featured as an Information Security Question of the Week.
Read the Feb 05, 2016 blog entry for more details or submit your own Question of the Week.

Answer 1

You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it.

However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and move on.

Answer 2

So you have identified the IP address involved in the process of hacking your website. Congratulations!

What makes you believe that this IP is indeed a hacker's IP address, and not simply another hacked into computer running in zombie mode? And who is to say, that your own web server didn't run in exactly the same zombie mode until you removed the shells installed through, as you say, later identified backdoor?

Should you expect another person, whose web server was attempted to be, or indeed was hacked through your compromised web server's IP, thinking exactly the same about you, and is already looking for ways to get even like you are?

I would sincerely hope this not to be the case, and we've moved past the times of witch-hunting and freely accusing and passing judgment upon people before proven guilty beyond reasonable doubt in a court of law, where they are allowed to defend themselves, present their own evidence, dispute gathered evidence against them, and this evidence hopefully weight by and later passed ruling upon by decent enough people to be able to see both sides of the coin before calling it for what it turned up to be.

The mandatory IANAL disclosure applies at this point, but these are the options that you probably ought to be looking at:

• Report the incident to proper authorities. You should do that not only in a hope the real hacker eventually gets caught and prosecuted, but also to cover your back in case your web server was involved in other illegal activities while it was compromised and acting in ways beyond your immediate control. Then cooperate, be ready for your web server to be taken to a forensic laboratory and you might suffer your services downtime because of it. This will take time off you, and possibly incur cost too.

• Alternatively, harden your web server against any other possible backdoors, exploits in software you use, and hire a proper security analyst to do their magic. Fill an internal incident report and have it verified by an independent party, to cover your back that way in unlikely eventuality you'll later need this as evidence, if contacted by authorities. This will also take time, and it will cost too. But your web server will be online and your business hopefully making up for any costs involved.

Your choice then, but don't get yourself in greater trouble by playing a self-righteous vigilante, it's just not worth it and the odds are against you from the very start that you'll be seeking vendetta at the right address.

Answer 3

The term most often used to describe what you're talking about is Hacking Back. It's part of the Offensive Countermeasures movement that's gaining traction lately. Some really smart people are putting their heart and soul into figuring out how we, as an industry, should be doing this. There are lots of things you can do, but unless you're a nation-state, or have orders and a contract from a nation-state your options are severely limited.

There are a number of laws regarding hacking a computer you don't have authorization to hack, the CFAA in the USA, the CMA in Great Britain, the CHM in Australia, and the list goes on. All of which make it illegal to do what you want to do, and in some cases have pretty strict penalties for even the smallest of actions.

Let's assume you can hack the offending machine without breaking a law. This is pretty less than ideal. Sometimes the IP address you have will point you back at the actual computer where the hacker was sitting. This is the best case, and also the least likely to happen. More often the IP address you have is an innocent intermediary, that is it's more likely to be your grandmother's eMachine that was compromised when she clicked on a dodgy website while researching canasta strategies. So while there is a chance hacking back could punish the do-badder, the most likely scenario is that you break your aged grandmother's link to the outside world.

Your best option? Report the incident to the most appropriate law enforcement agency. Unless there was significant financial loss it probably won't gain much traction as an individual case. What could happen is that your information will get added to the pile of evidence that could be used to take down a large group.

Answer 4

Don't play their game, you'll lose

I've learned not to play that game, hackers by nature have more spare time than you and will ultimately win. Even if you get him back, your website will be unavailable to your customers for a solid week afterwards. Remember, you're the one with public facing servers, you have an IP of a random server that he probably used once. He's the one with a bunch of scripts and likely more knowledge than you will get in your quest for revenge. Odds aren't in your favor and the cost to your business is probably too high to risk losing.

It's most likely not his IP

This kind of hacking is incredibly low priority to law enforcement and the IP you have probably belongs to a server 1000 miles away from said hacker. If you are intent on getting his IP, he may have used a proxy whose purpose isn't anonymity, if you track http headers, look for x-forwarded headers in the offending requests, those will more likely have his real IP if they're there. Nobody bothers with chaining proxies for "fun" hacks like this. But again, don't bother, he's hacked you, he won, if you play his game, he will win again. Right now it's not personal to him so the cost of a DDOS attack on you doesn't outweigh the benefit yet.

If you must play the game

I used to setup honeypots for hackers. When one would make it into my intentionally left vulnerable server in my DMZ, I would place some fun files that look important and lead to other fun goodies that aren't so good for a PC's health. Now if I do setup a honeypot, it's just a logging server with a few vulnerable ports so I am alerted of attempts on my network. That way I can watch a little more closely when it's important.

You're looking at this wrong

When a guy cuts you off on the interstate and you rush up to get him back, his response isn't always going to be good for your health. Instead of getting even, think of your experience as a free security audit where the only expense was doing work that you should have done in the first place. Hackers are frustrating, but the first couple of times you have this happens will change your view of security. But overall....Woooooosah

Answer 5

Remember - no matter what they did, if you do hunt down the hacker (assuming you have identified the right one) and punish them,

you will have broken the law, and the police are likely to be able to prove your guilt

Don't do it. Vigilante justice is for Caped Crusaders and Superheroes!

Answer 6

Of course you can punish hackers. Just use a service like GeoBytes IP Locator to know their address. Drive there, knock on the door, and whoever opens, he/she must be the hacker. Then just go ahead and punish them for the bad girl/boy they are.

Back to reality. Unfortunately, it's very likely that they'll go unpunished.

Depending on your jurisdiction, your case might just be too minor to entice capable law enforcement agencies to track down your attacker. Of course, officially, they'll never tell you that. You'll report it, and they'll tell you they'll do the best they can.

It's very likely that your attacker is using some anonymising service (Like Tor) which makes it very difficult and resource-consuming to track him.

If I were you, I'd ask a security expert to assess my site and fix the vulnerabilities to prevent this from happening again.

Answer 7

There's no profit in it for you to punish the attacker. Your resources are best spent securing your server and getting on with business.

Answer 8

What you can do directly is sending an abuse mail to his ISP. Just lookup the ip in the ripe.net database. In most cases there is an abuse mail listed for the owner of the IP.

ISP take legit abuse mails seriously, at least in my opinion.

Answer 9

What yo do is: Contact your local computer crime police office, file a complaint and press charges against unknown individuals, hand over the IP address and you might get lucky.

In reality, chances are low anything will happen.

Answer 10

If you have the time/knowledge/resources you can redirect the traffic from the attacker's IP to a honeypot and study the attack traffic eventually you'll find something useful to link to the responsible person.

Make sure to keep an eye on your server to track attacks from new IP's and you should add the new range into the redirection list.

Have fun

Answer 11

Well I don't think you can trace the hacker by using his IP. Most probably he is using a zombie machine/IP to do what he want. Best thing you can do is to report the authorities with whatever details you have & tighten your security.

Make sure your web site stays usable and user friendly while you tighten the security.

Answer 12

I think the IP address you got is may be proxy address..because the one who know how to hack he/she must know how to hide their actual IP..So just enhance security level of your website. and defend your website..because now a days hacker doing all this thing easily and can't caught..

Thanks..