49

A website (www.blue*****art.com) is trying to attack my server using the Shellshock vulnerability. After doing an Nmap scan on the attacking IP address, I found many open ports. It looks like the website is running Exim, which is vulnerable to GHOST.

The website in question has not been maintained for the past three years (from copyright date, Twitter and Facebook status); possibly the owner passed away. A check with Sucuri shows that it is currently not blacklisted, because no malware has been found.

Should I retaliate by taking over the website from the hacker and shutting it down to stop it from scanning other people's computers?

Improve this question
14
  • 21
    Hackers usually use websites to keep on hacking. I strongly recommend you to not break into another website.
    – mzz
    Commented Jan 29, 2015 at 15:04
  • 8
    Related: How can I punish a hacker?
    – S.L. Barth is on codidact.com
    Commented Jan 29, 2015 at 15:06
  • 27
    Two wrongs don't make a right. You will end up being just as liable/prosecutable as the original hacker. Can you not just block this ip for now, while you report through proper channels?
    – geoffmcc
    Commented Jan 29, 2015 at 18:38
  • 10
    @Smig it's not a particularly interesting question - AFAIK absolutely no jurisdiction anywhere has anything similar to a legal "virtual self-defense" doctrine that would allow to retailate for a cyberattack, and it would be a major news item in the field with interesting discusion if some law like that was passed anywhere. Some government agencies may be granted immunity/authorization for attack as such, but even then it legally doesn't matter if it's a "counterattack" or simply hacking the system for their goals.
    – Peteris
    Commented Jan 29, 2015 at 22:44
  • 26
    I think the better analogy here in any case would be discovering that a thief had stolen your property, and breaking into his house to steal it back. You might have the moral high ground, but you sure as hell don't have the legal one.
    – sapi
    Commented Jan 30, 2015 at 0:15

5 Answers 5

Reset to default
86

Not if you want to stay out of trouble.

What you are suggesting is vigilante action, and most legal systems do not look kindly upon that. Even though you may feel you are protecting other, less tech-savvy people, it would probably still constitute a crime.

What you could do, is try and find out if there are authorities to warn. This could be the hosting provider, the registrar, or the police of the country where the website is hosted. Or, if you believe the site has been hijacked, find either the owner or their remaining relatives.

Improve this answer
4
  • 1
    Is it vigilante action? Or self defense?
    – corsiKa
    Commented Jan 30, 2015 at 14:55
  • 30
    @corsiKa It is vigilante action. For self defense, it is sufficient to block the IP address until the situation is resolved.
    – S.L. Barth is on codidact.com
    Commented Jan 30, 2015 at 14:58
  • 3
    @S.L.Barth Blocking an IP address will protect you from everything from that IP address except from bandwidth consumption. It's possible that there are situations where that bandwidth consumption is a problem, and there might be something one could do to the sender, which would cause the stream of packets to stop. But it is rarely a good idea to take such actions.
    – kasperd
    Commented Jan 31, 2015 at 18:18
  • 2
    @kasperd, yes, you could for example "tarpit" its connections. Depending on the scanning method and system, this could even bring down the attacker's machine due to resource exhaustion.
    – LSerni
    Commented Jan 31, 2015 at 23:01
66

You should contact the hosting provider, their contact information can be found by a whois lookup of the IP address of the server. You should give the hosting provider logs with the evidence that the attacks originated from that IP.

The hosting provider can inspect network traffic to find out if any attacks is still ongoing and take the host offline if necessary.

Improve this answer
1
  • 5
    I'm sure someone who knows about Shell Shock, sucuri, GHOST and Exim, also knows how "their contact information can be found" and that they "should give the hosting provider logs with the evidence that the attacks originated from that IP".
    – Dan Dascalescu
    Commented Jan 31, 2015 at 21:15
38

Many times the attacking website has no clue their site is attacking. I own a hosting company, and we're typically notified through our abuse email from the attacked.

Upon investigation, we either find

  1. World writable folder where rogue scanning scripts have been installed
  2. poorly created websites that allow unrestricted uploading
  3. compromised FTP accounts.

In most, if not all cases, our clients had no clue.

Other than that it's illegal/unethical to retaliate.

Improve this answer
2

If someone were attacking you in real life you would have options:

  • Run
  • Defend yourself

I would say that this is a similar situation. If you put the right countermeasures in place and feel that the hacker is going to attempt at all costs to hack your server, I would say you are left with no other option but to defend at all costs, or lock up the castle and call for help.

Explore your options.

  • Law enforcement
  • Internet authorities
  • Shutting down the site
  • Taking over the site
  • etc.

I would say that if you take over or shut down the site, that this hacker may (probably will) retaliate against you.

You should

  • Collect logs
  • Get information on the hacker
  • IP address, etc. - stuff you can do passively
  • Contact authorities

Law enforcement and Internet authorities have resources that you may or may not have. They are prepared for these kinds of attacks and the retaliation that comes with tracking them down.

You don't know who is hacking you or how much resources they have at their disposal.

So, unless you are something like a Penelope Garcia, I wouldn't recommend going toe-to-toe with a hacker in his own neighborhood.

Improve this answer
2
  • 2
    what about simply blocking the IP on your firewall?
    – schroeder ♦
    Commented Jan 29, 2015 at 23:43
  • @schroeder, I think that falls under etc., doesn't it? I know that I didn't really hint into that direction. blocking IP's is a never ending battle if the Hacker is insistent on attacking your system, they may have access to other IPs or can spoof their IP.
    – Malachi
    Commented Jan 30, 2015 at 14:15
-3

Obviously the safest bet would be to do what most of the responders have already suggested, logging and notifying the appropriate resources to get it shut down...but that's no fun is it?

Should the ongoing attacks be of the active sort as opposed to automated botnet types of attacks (which sounds closer to what you are dealing with...and I have little familiarity with this particular vulnerability), where a live attacker's goal is to penetrate your system and perhaps take something valuable, then I've cough cough played with the idea of retaliating with a BearTrap (think honeypot leading to a disguised malicious payload). Legally, that's a little less straight forward now isn't it versus an active takeover action...although much more sophisticated.

If you break into my house, steal my safe and upon cracking it open it explodes in your face then, hey...

Of course this probably invites greater, more motivated retaliation in the end...but the moral and legal lines are much more blurred...

Improve this answer
5
  • 12
    If you booby-trap a safe and it blows up in a would-be safecracker's face, you'll be charged with, and probably convicted of, attempted murder. Self-defense is restricted to what is known as "reasonable force", and only in the presence of an immediate threat. Blowing up a safecracker fails both tests, as does counter-hacking an attacker.
    – Mark
    Commented Jan 31, 2015 at 0:09
  • the legality issue related to the creation of a honeypot not the safe ANALOGY...I thought that would be obvious but apparently not to all. I don't think putting a bomb in a safe that explodes upon opening would solve anything. To be clear I'm referring to the idea of someone stealing something that might not be as beneficial as they believe. You would need to hire the worse lawyer to
    – AgonyOfVictory
    Commented Feb 2, 2015 at 16:20
  • I see it very difficult to prove any intent to do harm from stolen, "experimental" code...that's some Minority Report type shit...
    – AgonyOfVictory
    Commented Feb 2, 2015 at 16:39
  • No one cares about your code, and even if they do, it's the source code they want, not binaries. The chance of someone running your malicious code on their machine is slim at best. More likely, they'll be running it on your machine -- since what they're generally after is the ability to launch future attacks against third parties anonymously and without taking up their own bandwidth and CPU.
    – cHao
    Commented Feb 3, 2015 at 10:54
  • Probably true, but it's not unheard of & technically possible. All intrusions aren't the same, I wouldn't overestimate the avg. attacker's sophistication either...**Honeypot Stings Attackers With Counterattacks** : darkreading.com/vulnerabilities---threats/…? "aggressive and offensive honeypots are a controversial concept and the legal ramifications are tricky. Sintsov, who presented his honeypot experiment fndings at Blck Ht Europe this month in Amsterdam, says the legal issues are up for interpretation..."
    – AgonyOfVictory
    Commented Feb 4, 2015 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .