Hacking Back: Industry Reactions to Offensive Security Research
Hacking back, whether as part of an active defense strategy or a threat intelligence effort, is a controversial practice that many security firms and experts officially advise against. However, retribution is in some cases part of active defense offerings and researchers do occasionally compromise the infrastructure of threat groups to unmask their activities.
A good example of researchers “hacking back” is detailed in a report published this week by security firm Check Point. The company hacked into the phishing and C&C servers of the Iran-linked group dubbed Rocket Kitten (aka Newscaster), which led to the identification of victims and even an individual suspected of being the main developer.
Many industry professionals contacted by SecurityWeek pointed out the legal implications of hacking back, and while some condone these practices to some extent, others condemn Check Point for the way it acted. Some experts have provided more legitimate alternatives to hacking back, both when it comes to active defense and threat research.
And the feedback begins…
Lance Cottrell, Chief Scientist for Passages, Ntrepid Corporation:
“There are obvious legal issues with hacking back which could put security professionals in hot water very quickly. A huge amount of ink has been spilled about the exact line between appropriate self defense and illegal hacking by the defender. What often gets overlooked is the problem of misattribution and innocent bystanders.
Attackers are usually using hijacked computers for their command and control servers in order to execute their attacks. In many cases they are constantly changing through multiple such compromised computers to ensure their identities and locations remain unknown. This creates a big problem for hacking back. Although the attack may have been tracked to a certain computer, that computer is probably owned and used by some innocent party; a previous victim of the same hacker. Disrupting that computer, and with it the owner’s business or data, further victimizes that bystander.
With proper care, and with law enforcement in tow, it can often be very effective to seize or take control of key servers in the hacker’s stolen infrastructure but it needs to be done judiciously and with a focus on minimizing collateral damage. Many people are looking for an opportunity to simply take the fight to the enemy and give them a taste of their own medicine. That is just vigilante justice. Proper “hacking back” is very deliberate and more about carefully disassembling the hackers network than exacting revenge.”
