Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security The Internet IT

O'Reilly Revisits Online Countermeasures 199

Posted by timothy from the take-that-you-basement-dwelling-twit dept.
An anonymous reader writes "I just saw that late last night an editor at O'Reilly published a blog that takes a look at 'countermeasures' and 'striking back' technologies a year after a startup in Austin, TX published a white paper on the subject that caused a lot of controversy. It also links to a blog by Symbiot founder William Hurley's entitled: Self Defending Networks, Aggressive Network Self-Defense, and Vigilantes on the net. which IMHO is a damn interesting read (even though I'm personally at odds with people who want to 'strike back')."
This discussion has been archived. No new comments can be posted.

O'Reilly Revisits Online Countermeasures More

O'Reilly Revisits Online Countermeasures

Comments Filter:

  • What can you do back that's legal? (Score:4, Insightful)

    by Enigma_Man ( 756516 ) on Wednesday June 15, 2005 @04:43PM (#12826931) Homepage
    Is there anything that you can do back that isn't illegal itself? Kind of like being able to defend yourself from an attacker with a weapon of your own? (I know I'm being vague about the law, but just for the sake of argument).

    -Jesse
    • Imaging if IP spoofing is used. You can trick one of these networks into launching attacks towards the IP your program is spoofing as. Spoof as the Microsoft.com IP address and watch as Microsoft turns around and tries to sue the company that launched the counter-attack.

      \/\/3 0wn y0u, |\/|1(r050f7, 7h3 5(r1p7-k1dd135.
      • In summary, strike-back technologies turn your network into attack-bots for script-kiddies..... Note that source routing is unnecessary for this sort of attach so filtering out packets based on this is irrelevant. All that is necessary is for the IDS to *think* it is being attacked from a given network. Many attacks can be done either via UDP or without a connection (TCP Syn floods), so it is to be taken really seriously.

        I wish more people realized this...

        I have had one idea regarding a strike-back tech
        • strike-back technologies turn your network into attack-bots for script-kiddies.....

          This might happen occasionally but these attacks (in my limited experience) are more theoretical than acutal. Shutting down the zombied machines would more than compensate for the occasional spoofed address.

          • This might happen occasionally but these attacks (in my limited experience) are more theoretical than acutal. Shutting down the zombied machines would more than compensate for the occasional spoofed address.

            It might be theoretical, but such attacks would be *trivial* to write. If more people used strike-back technologies, then there would be a real chance that more people would use them.

            With my automated email solution, spoof army.mil and all that happens is that the admin of army.mil gets one email (sa
        • Not only are you advertising "use me as an attack network" you are also advertising "forge an attack against me by (say) dod.mil and watch the feds kick down my door". I wish more people realized that network security is not analagous to gunfighting.
      • In my opinion, this is the only real downside to launching a counter-attack (hitting back at the wrong person). If Joe Hacker attacks your company and costs you business, then you attack him back and destroy the contents of his machine, what's he going to do, sue you? Reveal his identity so you can launch the countersuit? Somehow I doubt it.

        Sure, it's vigilante justice at it's finest, but the reason we don't do this in the physical world anymore is because we have a justice system to deal with it. The cop
      • Imaging if IP spoofing is used. You can trick one of these networks into launching attacks towards the IP your program is spoofing as.

        There are certain attacks that can't be spoofed. For example, whilest you can spoof single TCP packets, you can't spoof an entire session (unless you control one of the routers the traffic would go through anyway). So if you only launch a defensive attack against unspoofable attacks then this would seem safe (unspoofable attacks include stuff like attacks over HTTP, SSH
    • As far as actually hurting the other machine, no, there's nothing obvious. The self-defense rules for online conduct are non-existent at this point, so the only way to be *sure* you're safe is to not attack back. You can still mess with the attackers with things like tarpits, though.

      (For those that haven't been following the jargon, tarpitting is intentionally slowing your responses to the maximimum time before timeout, and sending the minimum amount data in each response. The idea is to take up as much
      • You can still mess with the attackers with things like tarpits, though.

        the Netfilter TARPIT target used to work very well, unfortunately AFAIK it still hasn't been ported to the 2.6 kernel.

        That said, I think you need to be very careful with tarpitting - i.e. only tarpit stuff which has no legitimate use over the public network (i.e. NetBIOS, etc). I'm very much against tarpitting legitimate ports (which you aren't running services on) such as HTTP, etc since it's entirely possible that someone is legiti

    • Re:What can you do back that's legal? (Score:5, Insightful)

      by ImaLamer ( 260199 ) <john@lamar.gmail@com> on Wednesday June 15, 2005 @04:57PM (#12827063) Homepage Journal
      I would suspect that it is equally illegal to attack back - as well it should be. From both a moral and legal standpoint you have to ask yourself if it is okay anywhere else in society [wikipedia.org]?

      Self defense is one thing, but attacking back is another. If someone steals from you, should you steal from them or hurt them? I would say no, and most moral philosophy would also say so too. From a legal standpoint, this is America dammit! Even if I try to take down slashdot.org their return attack has violated my rights to due process. Yeah, I know that it sucks that criminals often seem to get protected more than the victims, but that is the way the system works.

      If everyone took the law into their own hands there wouldn't be "the law" anymore - just street justice. Due process exists in order to protect the wrongfully accussed, and millions of zombie PC owners thank you for that. Just think, most attacks are launched from the actual attackers PC or server. How can you even be sure who to attack?

      If you are so sure, go to the proper authorities. No need to make all the white hats grey.
      • In Texas, in some cases, you are allowed to use force (under some circumstances, deadly force) to prevent a theft from succeeding (circumstance being, that it would be difficult or dangerous to recover the stolen proerty by other means, or the theft is occurring at night). You are definitly allowed to use force (and often, deadly force) to prevent a robbery from occurring....just answering your question, is it OK anywhere else in society...
      • You assume that due process actually exists. If the system worked, I would be inclined to agree with you, but such is not the case. In most cases attacks aren't even investigated unless they hit a certain $$ figure in damages or it's a government system that's hit.
      • Self defense is one thing, but attacking back is another

        This is sophistry. Attacking "back" means by definition that you are responding to someone else's act. If you're standing in a bar and get hit in the face, well, you've just been hit in the face. There's time between that blow, and the next one. Between those blows, you're not "still" being hit in the face, but simply girding yourself for the next blow to the face isn't really enough, morally or practically. Physically stopping such an assault (or t
        • If you're standing in a bar and get hit in the face, well, you've just been hit in the face.

          Except you can't be sure who hit you; and its more like being hit in the back of the head with a brick that has a name written on it. Is it the name of the guy who threw it? or did he write some elses name on it? You might as well grab some random guy and start a bar brawl while the guy with the brick sits back and laughs at you.

      • You're absolutely right that overall, from a moral and legal standpoint, striking back at people who try to hack you by hacking them back is wrong in just about the entire civilized world. But there's a part of the equation that's missing here. It's wrong because there's suppossed to enforcement of that due process on the side of the government, and we don't get it on teh intarweb.

        Have you ever tried to call your local police when your box gets hacked? Pointless. You're left feeling frustrated and powerless. The security experts just tell you to harden your defenses, but that's like telling you to put a moat and wall around your house (and builds a business for same said security experts). You're totally on your own out there when you should have the support of the authorities, despite having paid them your taxes and freedoms.

        So until governments actually start prosecuting the common internet criminal, you're left alone with your interfaces exposed to any idjit with nmap and some root kits, all you can rely on is yourself and other people you know who've been in the same boat. And hey, if the gov-mint aint prosecuting the people that attack you, they ain't gonna do shit about you attacking back either.

        The ultimate solution would be punishing all the assholes that are scripting exploits across the web with real, visceral penalties. Until then you'll have to get justice where you can. Be it street or fiber, it's all you can get.
      • I would suspect that it is equally illegal to attack back

        If someone steals from you, should you steal from them or hurt them? I would say no, and most moral philosophy would also say so too. From a legal standpoint, this is America dammit! Even if I try to take down slashdot.org their return attack has violated my rights to due process.

        This seems to be an example of someone talking out of their rear end.

        No, I cannot legally break into a thief's house and steal at will, whether or not that would

      • Just think, most attacks are launched from the actual attackers PC or server.

        I meant aren't
      • Self defense is one thing, but attacking back is another.

        Self defense and attacking back may well be the same thing. If you're sitting on a park bench and some guy comes up to you every 30 seconds and smacks you around the head with a baseball bat, I think you probably have every right to smack them back until they stop.

        IMHO what you _shouldn't_ do is a delayed reaction - if someone has stopped attacking you already then any retalitory attack you make is offensive rather than defensive. Going back to t
    • Imagine a compromised laptop is brought onto a lan at say IBM and begins an attack say on Apple. Apple's IDT track the attack at the firewall, and the countermeasures respond, IBM which may well have already noted and killed the offeneding laptop, notes the attack and trys to "counter" it. Boom goes london boom goes Berlin.

      It is like defending yourself with hand grenades in a crowded room, even if you didn't have a double back situation, imagine the collateral damage on all the other people who happen to b
    • As long as it isn't a DoS attack, it's probably fair game given that the attacker is rather unlikely to be able to report you.

      However, you have to remember that most attacks are performed via compromised systems.
    • Yes, tar pits and honey pots are quite legal.

      It is a valid form of striking back - making the attacker waste his/her/its time.

      • More like Network Judo (Score:4, Insightful)

        by Gary W. Longsine ( 124661 ) on Wednesday June 15, 2005 @07:52PM (#12828533) Homepage Journal
        Intrusion Suppression techniques like honeypots and tarpits are not really strike-back techniques. They are really more like network judo. When you redirect the energy of the attack, it's not always against the attacker, it's just away from the victim.

        Intrusion Suppression techniques actually reduce the network traffic generated by the attacker, and yet also reduce the effectiveness with which the attacker can perform an attack. It's not really a counter-strike.
    • Is there anything that you can do back that isn't illegal itself?

      Share as much information as you can, even with competitors. Invest into developing software and infrastructure which makes sharing easier. Bring smart people together who want to donate part of their spare time to make the net a better place. Help drafting legal frameworks for large-scale detection and response measures.

      There are many ways to remove a rogue server from the Internet, and a lot of them are quite legal. The key issue is to

      • There are many ways to remove a rogue server from the Internet, and a lot of them are quite legal. The key issue is to bring together those who can (almost literally) pull the plug and those who have the evidence that such drastic action is indeed necessary, and help them to establish something like trust.

        The problem today is that there are so many tens of thousands of systems being used for scanning, automated attacks, DDoS, and whatnot. This approach is only practical for certain occasional central

    • Since blocking a particular host at a router/firewall is sufficient "self-defense" that's probably the ethical limit. Notifying the owner of the trespassing host is a time-consuming, but reasonable step. One more thing, possibly more satisfying: tarpits

      The late LaBrea project implemented techniques that did not block attackers/scanners, but rather through protocol manipulation, HELD ON to them as long as possible, through things like tcp window size, etc. they kept the source host on the line sending zer

    • Make them famous! (Score:3, Funny)

      by Anonymous Coward
      Is there anything that you can do back that isn't illegal itself? Kind of like being able to defend yourself from an attacker with a weapon of your own? (I know I'm being vague about the law, but just for the sake of argument).

      Post their URL to slashdot, and let them bask in unwanted fame. :-)

    • Tracking down the perp and criminally prosecuting them would be an option.
    • Of course you have the right to defend your property, but there will always be a bunch of weenies who would rather run away and hide behind mommy...

      If some machine is attacking your system with a serious denial of service, then you have the right to root that box and halt it. Effectively, you are just turning the other person's machine off and if you would leave it at that, it would be perfectly reasonable.

  • Striking back (Score:3, Funny)

    by UnixRawks ( 705739 ) on Wednesday June 15, 2005 @04:44PM (#12826937) Journal
    "...even though I'm personally at odds with people who want to 'strike back'"

    It worked for Silent Jay & Bob, and arguably the Empire...

  • Where's the beef? (Score:3, Funny)

    by FirstTimeCaller ( 521493 ) on Wednesday June 15, 2005 @04:44PM (#12826942)

    Man what a lame article. A little lacking in substance, I'd say. Why, I've got half a mind to email bomb the author!

  • Low on actual information (Score:5, Informative)

    by InternationalCow ( 681980 ) <mauricevansteensel.mac@com> on Wednesday June 15, 2005 @04:45PM (#12826958) Journal
    If you read the actual blog, it doesn't really contain any information or opinion or whatever. One of the comments on the blog provides more useful information - for older and more informative papers go here: http://www.oreillynet.com/pub/a/security/2004/08/0 3/symbiot.html [oreillynet.com] and http://www.onlamp.com/pub/a/security/2004/03/10/sy mbiot.html [onlamp.com]
    • Plus many of the links to other papers on his own site are broken, ending in a quotation mark instead of a file name.
    • If you read the actual blog

      You must be new here, nobody does that! I find it even funnier that the headline is: "O'Reilly Revisits Online Countermeasures" When really it's more like, some guy who happens tp work at O'Reilly mentions online countermeasures in a blog.

      But hey, why read the article when instead you can read the comments about the comments about the article on /.?

  • what about the counter-counter measures (Score:3, Interesting)

    by udderly ( 890305 ) on Wednesday June 15, 2005 @04:49PM (#12826997)
    I just wonder how aften these strikeback or countermeasures backfire. I remember reading a story awhile back where a gambling site repulsed a DDos attack. The really interesting thing was that it cost the company way more to fight the attack than it would have cost to pay off the extortionist.

    While I understand the desire to stick it to these creeps, from a purely cost/benefit analysis point-of-view, it doesn't seem to me to make a lot of sense

    • Re:what about the counter-counter measures (Score:5, Insightful)

      by Anonymous Coward on Wednesday June 15, 2005 @04:53PM (#12827031)
      As Rudyard Kipling put it:

      IT IS always a temptation to an armed and agile nation,
      To call upon a neighbour and to say:--
      "We invaded you last night--we are quite prepared to fight,
      Unless you pay us cash to go away."
      And that is called asking for Dane-geld,
      And the people who ask it explain
      That you've only to pay 'em the Dane-geld
      And then you'll get rid of the Dane!

      It is always a temptation to a rich and lazy nation,
      To puff and look important and to say:--
      "Though we know we should defeat you, we have not the time to meet you.
      We will therefore pay you cash to go away."

      And that is called paying the Dane-geld;
      But we've proved it again and again,
      That if once you have paid him the Dane-geld
      You never get rid of the Dane.

      It is wrong to put temptation in the path of any nation,
      For fear they should succumb and go astray,
      So when you are requested to pay up or be molested,
      You will find it better policy to says:--

      "We never pay any one Dane-geld,
      No matter how trifling the cost,
      For the end of that game is oppression and shame,
      And the nation that plays it is lost!"
    • The company who fought them, and the consultant who helped out, are now in business together protecting other people from these sorts of attacks, making way more money than it cost to fight the attack. Not only is Kipling correct, but in this case you mention it even made sense from a short-sighted cost/benefit point-of-veiw.
    • While I understand the desire to stick it to these creeps, from a purely cost/benefit analysis point-of-view, it doesn't seem to me to make a lot of sense

      When you pay these clowns, all you're doing is proving to their apprentices that they've chosen the right career. It's exactly like giving terrorists or kidnappers what they want, and with exactly the same results.
    • 1) Should you capitulate to DOSnet blackmailers or figure out some way to survive their attack?
      2) Should you attempt to attack those DOSnet blackmailers?

      They require two separate cost/benefit... er... analysis... analyses... analysises... calculations.
    • It looks like the security establishment is with you on this. From an article on hacking phishing sites [news.com.au]:

      But while the defacements have undoubtedly halted a number of fraud schemes, security experts are dubious about the methods. "Are the ends good? Undoubtedly. Are the means justified? I don't know," said Cory Altheide of the SANS Internet Storm Center, a consortium of academic and industry security experts. "All I really know is the stories of vigilantism ending well are few and far between."

      Cons

      • Considering how many spams come at us from zombie PC's owned by clueless users, there could be a lot of innocent bystanders that get stepped on when someone unleashes a DDOS on a spammer.

        Why would you call them "innocent"? Imagine a driver's defense after an accident: "Oh, all this driving things are just too technical." Innocent? I don't think so...

        I'm not going into legalities here, but morally you are responsible for what your things (and kids and pets) do to others (legal responsibility exists too

        • actually, I agree. I'd add that I hold broadband providers like Comcast partly to blame: they downplay and ignore the security issues of having an unprotected computer on a fixed IP address just to ease the sale of their service. But the broadband provider is hurting itself if it never promotes internet hygeine: letting their domain become a free fire zone for zombies and counter measures only makes their service look worse.
          Guardrails? reminds me of a very strange blog [blogspot.com] I came across.
          • they downplay and ignore the security issues of having an unprotected computer on a fixed IP address just to ease the sale of their service.

            Sorry, but having a fixed IP address really isn't a security risk - unless you're a high-profile target pretty much all the attacks you get are directed at random IP addresses so having a fixed address gives you exactly the same probability of getting hit at if you have a dynamic address. Even worse, if a zombie is on a dynamic address, it makes it very difficult for
  • I clicked through and tried to read the blogspot article, but every link on the blogspot article defining important terms like "countermeasure" for example, that would help me understand precisely what they are talking about, NONE of those links work. I can't tell what exactly they are talking about doing to prevent DDoS etc, except that it will involve a "network" of volunteers.

  • I'm not clicking that! (Score:3, Funny)

    by Scrameustache ( 459504 ) on Wednesday June 15, 2005 @04:50PM (#12827005) Homepage Journal


    Is it wise to slashdot a site advocating "fighting back" web attacks?
    I'm gonna wait an... [NO CARRIER]

  • Arms race example in the p2p world (Score:4, Interesting)

    by stripmarkup ( 629598 ) on Wednesday June 15, 2005 @04:52PM (#12827019) Homepage
    Here's an interesting example of an escalation, going on right now. It seems that anti-p2p organizations are trying to pollute some torrents for TV shows such as six feet under (see discussion here [thepiratebay.org]).

    What they do is put out a file of the same size but with random data. Since the torrent file has segment hashes to verify integrity, any segments downloaded from the bogus file will fail the checksum and waste downloaders' bandwidth. The community of downloaders is fighting back by spreading black lists with the IP addresses of the bogus clients.
    • well I dunno if that's an arms race yet. It will be interesting to see if the trackers evolve and stop tracking seeds that send bad packets effectively removing them from the swarm. (note: I don't know much about the topography and responsibility of the trackers, just pondering what ifs).
    • I suppose the big concern now is that somebody will use one of the hash-attacks which have been recently published, and generate a fake file with virually random data, which passes the chunk hash verifications... Then, you will have a problem with Bit Torrent. I expect the next version of Bit Torrent will allow more flexibility in how the hash is done.
    • ... except in that case, the people downloading the files are breaking the law, and the people 'polluting' the torrents aren't.
      • IANAL, but tt depends on where the downloaders are located, and whether downloading the content is illegal according to local laws and international treaties that apply. For example, there are lots of books that are public domain anywhere but in the US. It's not so clear cut.

  • You know... (Score:5, Insightful)

    by LegendOfLink ( 574790 ) on Wednesday June 15, 2005 @04:52PM (#12827027) Homepage
    even though I'm personally at odds with people who want to 'strike back'

    In the UK, when somebody files a lawsuit and loses, not only do they have to pay for their own court expenses, but also those of the defendant. This isn't the case in the US, which is why we are the most litigious country in the world.

    Now, let's look at computing. If we just let the asshole hackers get away with their crime without a fight, they will keep on hitting us hard. But, if we had a mechanism that would "fight back" and destroy a 15 year-old script kiddie's computer that mommy and daddy bought, well, maybe they'd think twice.

    • Re:You know... (Score:4, Informative)

      by chez69 ( 135760 ) on Wednesday June 15, 2005 @04:54PM (#12827042) Homepage Journal
      if you file a lawsuit against IBM and loose, your financially screwed for life. not the kind of position I would like to be in.

    • Re:You know... (Score:3, Informative)

      by Mr. Flibble ( 12943 )
      The problem is that the majority of the attacks are from skript kiddie "pWn3d" servers. Sure, they launch their inital attacks from their home machines, but from there they get more and more zombies (for DDoS) or SSH hosts for tunneling.

      I have had some servers get hit, and start attacking others. Now, if you were the target, and then started attacking one of my servers in retaliation, how does that help me?

      From this vantage point, I have not only had one of my servers attacked by a skript kiddie, but now,
      • I used to do this, but gave up some years ago. It was pretty rare to get a useful response of any kind from the owner of the attacking system. Oftentimes they didn't believe the report or didn't understand the problem.

        There is one type of "attack" that I continue to try to foil this way -- bogus "you're infected" messages from email antispam gateways. Many email administrators still don't understand that virii can (and do) spew email with fake headers, and don't believe it when it's explained to them.
    • In the UK, when somebody files a lawsuit and loses, not only do they have to pay for their own court expenses, but also those of the defendant. This isn't the case in the US,

      Uh, what gave you that impression?

      The principle that the losing party in any legitimate legal action pays fees is derived from common law, and applies in the US. Regardless of who brought the action, the loser generally must pay the cost, unless the judge or jury determines the action to have been frivilous (for instance, in

    • It's not a 15 year old script kiddy any more. These days it's a 20-30-something blackmailer from Russia or somewhere outside of the nation you live in. Forget about how powerless local law enforcement would be... forget about how unresponsive the national law enforcement would be and consider how ineffective international law enforcement on this would be.

      An article on Slashdot not too long ago talked about how a guy fought back (through defensive measures) and eventually won. It was expensive in terms o
    • In the UK, when somebody files a lawsuit and loses, not only do they have to pay for their own court expenses, but also those of the defendant.

      I've lived all my life in the UK and I used to believe that. It isn't strictly true... For example in civil cases (such as the fraudulent retention of deposits etc.) where the dispute is over a sum less than £5000 the only legal provision is the "Small Claims Court" - for which the victim must pay an up-front £80 filing fee (recoverable on winning), bu

  • Is this anything like ? (Score:3, Funny)

    by Adult film producer ( 866485 ) <van@i2pmail.org> on Wednesday June 15, 2005 @05:01PM (#12827105)
    The Cisco self-defending networks I saw on the tv show 24 ? Right after Chloe said that CTU had a proprietory algorithm for cracking blowfish they show some Cisco graphics on a screen and they blow off DOS attacks like, "ohh, we're protected by these self defending cisco networks" or some crap like that. 24 = pentagon & corporate propaganda.

  • You Know... (Score:2, Interesting)

    by ch0p ( 798613 )
    ...A guy on the pulltheplug irc network ran a tutorial on writing exploits for exploits. Basically, they'd run a process that looks like a vulnerable server, and when someone comes along and takes the bait, they end up rooted.

  • Law enforcement can't do it all (Score:4, Interesting)

    by ScentCone ( 795499 ) on Wednesday June 15, 2005 @05:05PM (#12827151)
    Considering the huge horsepower of things like the SETI screensavers and P2P networks, I don't think it's a question of whether or not a conflict between spare-CPU/BW Good Guys and zombie-army bad guys could be won by the good guys. Or at least, make things painful for the bad guys. The main issue is counter-counter-counter-craftiness that might stealthily turn such a network to the dark side.

    Several sys admins I know who have never had the time or inclination to put up a honeypot or opt for similar tactics absolutely light up at the prospect of actually making the attackers miserable. In fact, it's not even the attackers they complain about, it's the ISPs that (with copious documentation about the bad acts of specific customers) don't do anything about it. To the extent that foreign governments are those ISPs, well, same sentiment.

    So, the real issue is governance of such a system. It's sort of like sharing time on a big research telescope. What committee can be trusted to put the resource to use effectively? I know that a lot of people with network resources are so fed up with the probes, the phishing, the DoS extortion and all the rest that they'd have absolutely no problem deploying a box or two, and a couple of MB/sec to the cause. But the liability(ies) for having it used unwisely are pretty scary, so I'm all ears if someone comes up with an interesting approach. If the worst thing that happens is I get a block of my IPs null routed on their way to Moscow, well, goshky, I'll take that deal.

    Some things we have to take into our own hands. And just turning the other cheek with more and fancier firewalls and intrustion detection is too passive for my taste, at least in the face of concerted, bad-to-the-core coordinated efforts by professional, organized crackers. Have I wanted to burn up every inch of some basement-dwelling script kiddie's DSL before? Sometimes. But nothing like I've wanted to blot out entire pieces of some Asian and eastern-European networks. And not just for my sake - for all of my clients, and their clients, and everyone it impacts.

    Don't mean to rant, but I've just spent all morning explaining this stuff to a suffering dot-com. His much-repeated question was "Why can't we just do this back at him until he quits? I'll spend the money... this is pissing me off."
    • "Why can't we just do this back at him until he quits? I'll spend the money... this is pissing me off."

      Because he won't quit. He'll simply open a new account with a new ISP and start all over again.

      • Because he won't quit. He'll simply open a new account with a new ISP and start all over again.

        That's exactly where a robust, million-member network would shine. When that guy and his tactics surface again, he get's stomped by what amounts to an immune system that's seen that strain before. It's the stomping I'm started to get interested in, not just having thicker skin.

    • But nothing like I've wanted to blot out entire pieces of some Asian and eastern-European networks

      I get an incredible amount of spam, scans and ssh login attempts from the USA - blocking countries is not the answer.

      Some of us actually want to communicate with the rest of the world or do business in Asia, Eastern Europe and Africa. In general the poor attempts at support by US companies show that many companies there do not care about communicating with the rest of the world - but usually the highly succ

  • GMail uses the network of thousands who report spam. Patterns are detected, and soon, a particular message is identified as spam even before it reaches you.

    On a much grander scale, we're accelerating towards a global computing grid which will extract unimaginable power from hundreds of thousands of separate computers each with the processing capabilities of our brain. The collective intelligence which emerges will possibly rival our fantasies of artificial intelligence [blogspot.com]

    As we modelled the eye to build ca

    • On a larger scale, it spells an evolutionary move towards a decentralized global self-configuring, self-healing, self-optimizing, and self-protecting nervous system. Since Autonomic Computing can look for patterns in data and extrapolate to predict future events, deployed on a global scale, the spin-offs would be very interesting...

      Then at 2:14 a.m. August 29th, Skynet will become self aware.

  • There is an obvious flaw in any internet countermeasures: All an attacker has to do bombard a site that implements countermeasures while spoofing the source address of another site they really want attacked... and the countermeasures site will do their dirty work for them! In an environment where you can never be certain where the attack is actually coming from, striking back would appear to be a fool's errand.
    • These days it's pretty hard to spoof a tcp connection. UDP/ICMP/Weird,rare, connectionless protocol, sure.

      But if they are loading a page over and over via http like in a recent massive DDoS (http://www.dshield.org/pipermail/intrusions/2005 - January/008739.html [dshield.org])
      you can be sure that the zombies' source ip is what it says it is. These days zombies are not worth the trouble of hiding, anyway.

      I wouldn't retaliate, but I would especially not retaliate unless the completed tcp handshake gave me assurance the
      • I thought most DDoS attacks were just doing SYN floods... I guess I'm not up-to-date on this. I agree, unless the routers have been compromised, a completed TCP handshake makes you fairly certain the connection is to the node it claims to be... which is most likely a zombie anyway. In which case the best reaction would be to contact the ISP and get them to block that IP address until the box is fixed, not to retaliate. Of course, if ISP's were perfectly responsive, there would be no problem with DDoS in the
        • I don't actually have any data beyond that one massive, apparently unmotivated, and possibly ongoing attack. I think the SYN floods were sort of passe, but if you are doing just a raw bandwidth attack, they'd do the trick.

          I think an actual connection hoses the recipient in a more precise way, with less bandwidth usage to trouble already indifferent ISPs.

          My sense is that the bots are so common that they aren't worth obfuscating. It may be that egress filtering has caught on, as well. Let's hope so...

          I
      • Not all ISPs are following BCP38 or the similar RFCs, but it's pretty straightforward for ISPs to do uRPF Reverse Path Filtering to block spoofed IP packets from their customers' routers, which block any packets claiming to be "from" an access line that they don't belong on. (Obviously it's more complex if your customer is an ISP, and a bit more complex if the customer is multiply homed.) This blocks most of the direct UDP and ICMP attacks, because it lets the recipient identify the source address and bl
    • Yes, this is a potentially serious issue with any of the active countermeasures. Even simple intrusion suppression techniques like honeypots can fall victim to this kind of redirect attack if exposed directly on the internet.

      Fortunately these types of attacks can be detected and modulated. With respect to certain antiworm systems [intrinsicsecurity.com] based on honeypot techniques I can safely say that these problems are not insurmountable.

    • There is an obvious flaw in any internet countermeasures: All an attacker has to do bombard a site that implements countermeasures while spoofing the source address

      Or you just need the latest virus that's come in on a laptop to send stuff out on an allowed port through a firewall - then next thing some loser with some sort of knee jerk countermeasure system is hammering at your gateway.

      It's not that simple a task to work out where packets are really coming from, and sending a flood of packets back in th

  • more substantial items about getting even do exist (Score:3, Interesting)

    by museumpeace ( 735109 ) on Wednesday June 15, 2005 @05:12PM (#12827219) Journal
    I tried to submit an item about hacker vigilianties who attack phishing sites back on May 31. Unfortunately, I can't spell and coverage of actual effective anti-fraud hacks [addict3d.org] were not interesting enough.
    We all have a gripe against spammers and phishers and I for one would welcome a book or web page that showed ways to harm the interests of internet and email abusers [ways that could ONLY harm such abusers, otherwise, we just arm the enemy] Is that too tall an order?
  • ...there's always the problem of an innocent or mere idiot getting nailed. If we had layers of defense mechanisms making warnings loud and clear and finally struck back, maybe. But if a fourteen year old script kiddie in Des Moines gets his machine crashed for fooling around, that's a little bit much especially if it is mom and dad's financial info going on the family PC.

    We could publish IPs of scorn but we already have such lists on the net of known scum monkeys and the result is basically like that of

    • we don't need a cyber crime and terrorism unit

      While a case may be made against jimmy the spot welding machine for receiving stolen goods, robots are such well behaved folks that I can't imagine any of them getting involved in terrorism.

      Think about it - "cyber-terrorism" implies a robot with a bomb. Online fraud is a real crime, but not "cyber" or "terrorist" by any stretch of a fevered imagination - the word is just hype for people who want make the problem a more emotive one and get more money to deal

  • I can see it now (Score:3, Funny)

    by Locke2005 ( 849178 ) on Wednesday June 15, 2005 @05:16PM (#12827266)
    1) Identify 2 sites that implement "countermeasures,"
    2) Start a small DoS attach against each one while spoofing the source address of the other.
    3) Sit back and laugh your ass off as they both escalate and take each other out!
    • 1) Identify 2 sites that implement "countermeasures,"
      2) Start a small DoS attach against each one while spoofing the source address of the other.
      3) Sit back and laugh your ass off as they both escalate and take each other out!

      Great idea! It's like cockfighting for the 21st century!

  • Wait wait wait (Score:4, Insightful)

    by cavemanf16 ( 303184 ) on Wednesday June 15, 2005 @05:22PM (#12827342) Homepage Journal
    From the "whurleyvision" blog:
    Who knows--in the not so distant future, "countermeasures" (not "Strike Back" capabilities) may end up being a feature we all look for before deploying any security software. Perhaps tools with these features will come from collaborative efforts between the open source and security communities; which would give everyone equal input on their design, functionality, and ultimately their deployment. In the end a more secure, reliable, networking infrastructure is in the best interest of society as a whole. That's why I've made it one of my goals to do everything I can to move people towards a "Community Centric" approach to securing the assets we all depend on.

    Now, I'm not going to advocate breaking "the law" directly in this post, but allow me to raise an important question to the /. community. Do we really want "a more secure, reliable, networking infrastructure" in the end? Allow me to now elaborate on that question.

    A more secure, reliable, networking infrastructure sounds great on the face of it, but what if we were talking about a corporate infrastructure instead of a networking infrastructure? In other words, big barriers to entry for the little guys to innovate, force change, develop new things, and build NEW corporations. Same goes for networking I think. Script kiddies are not innovative as they are simply piggybacking off of others works, BUT they have been innovative in pushing every company to be highly concerned about protecting themselves against cracking and DDOS'ing, which HAS been good for us, the consumers, as the data and services that these companies provide to us is ultimately more secure, reliable, etc. Those who are doing the really devious crack attacks are being more innovative, and are forcing organizations with a 'net presence to build ever better security defenses to guard against these attacks. These new defense mechanisms in turn often get passed on to other like-minded individuals who desire the same security. I guess that ultimately I am trying to say that while we do want "more reliability" at certain levels, at other levels lack of reliability is what helps spur innovation, change, and pre-emptive corrections to problems which left unchecked, could cause massive, long-lasting damage when a chink in the armor is finally exploited.

    So is "strike back" a good thing? Almost every time it is not going to help in any way. With our "War on Terror" we certainly had some excellent early gains, but now we're in a long, slow decay of gains due to the loss of life and new difficulties we created through our counterstrikes in Iraq and Afghanistan. Bush may have made the world a safer place immediately after 9/11, but now we have the Patriot Act, thousands of dead soldiers and civilians in a war that ultimately cannot "end", and what I perceive to be a whole new level of various threats to our country because we have only encouraged the terrorists to come up with better and more lethal attacks in response to our counterattack.

    So, in summary, yes defending against malicious network activities is good for everyone, but I think that counterstrikes against an amorphous enemy with difficult to define borders (terrorists can come from any country, just as ip addresses can be spoofed to be marked as coming from ANY organization) in response to these attacks pose a serious risk to the network that we call "The Internet" because it will only increase the desire to make more chaos on it ultimately than it will to dissuade it. Then we get more government control, more devestating attacks, and more polarization of "sides" to the war on network intrusion. Let's keep these issues in mind when building our network security plans.

  • Self Defense is Legal and Moral (Score:3, Insightful)

    by RexRhino ( 769423 ) on Wednesday June 15, 2005 @05:29PM (#12827402)
    If someone is trying to kill me or rob me, I have the right to defend myself using force. Likewise, if someone is using some sort of data attack or trying to steal my information, I have a right to defend myself using those means.

    The police and government protecting me are only an extension to my own right to self defense. There are cases were individuals are not able to defend themselves, or where they might think they are defending themselves but doing the wrong person harm, and so we have professional police, judges, who in theory are better at defending us and preserving a civil society than we would be ourselves. They are specialists, just like a doctor is a specialist in treating disease, and so we assume they doing it more efficiently with the least harm.

    BUT, if the profesionals (i.e. the police, judges, etc.) are not able to effectivly defend me and preserve a civil society, I have every moral right to defend myself. Period. Yes, some countries have passed laws against self defense, but the rejection of the right of individual self-defense is part of an overall authoritarian philosophy that rejects any kind of individual rights.

    There can be a discussion of the practical problems of self-defense (How can I be sure that the person who appears to be doing a denial of service attack is the perpitrator? Will retaliation have negative effects on innocent people who are not involved? Can these techniques be abused or exploited by a third party? Will I really be defending myself by using this technology?), but all of these are technical/practical discussions. But from the moral perspective, only a few of the most extremly authoritarian or collectivist ideologies would deny a person the right to self defense.
    • The problem is, these attackers will hide behind the IP address of some innocent individual. They are either going to set up a decoy web page, or log into the system of some company or home user, and launch an attack from there.

      It's not going to do your reputation any good, when you're the one in the newspapers because some disabled kid got his computer owned then blasted away, and the repair shop/ISP traced the attack back to your house.
      • What you are saying is true. But what you discuss is a technical/practical problem. By using counter-attacks to defend myself, I may in fact be doing an innocent harm, and be doing worse harm than the criminals. There are a whole slew of problems with electronic self-defense, that may bring the practice into question.

        What I was saying is that the morality of it shouldn't be in question. Just the technical feasability. Arguing that an atomic bomb is an ineffective way for me to deter my home from being robb
  • O'Reilly Revisits Online Countermeasures

    Here I thought this was going to be about the "caller mute" button, bloviating and the other ways he deals with callers who get the conversational upper hand. Wrong O'Reilly I guess.

  • Reminiscient of the old "Blitzkrieg Server"article (Score:3, Informative)

    by Sam Nitzberg ( 242911 ) on Wednesday June 15, 2005 @07:45PM (#12828483)
    This reminds me of the old 'Blitzkrieg Server' article in Signal magazine some years ago...
    (Links follow for a brief description):

    http://www.findarticles.com/p/articles/mi_m0CGN/is _n114/ai_20783335 [findarticles.com]

    http://attrition.org/errata/www/pd.001.html [attrition.org]

    But, I think that there may actually be room for active-response systems. Also, properly employed, they would be perfectly legal.

    There is no reason that such tools be deployed in public networks. Some organizations have networks (including large and complex networks) that are completely and totally privately owned, and totally segregated from public networks. Such organizations may (subject to appropriate risk - reviews) make judicious use of passive and even active response systems.

    There are other ways to communicate than IPv4. There are indications in messages that active-response systems can't work becaus of spoofing. Suitable integrity and encryption methods can be used to validate source and ip address data.

    There may be more modest active-response methods that may be more generally useful. For example, if traffic is located from a hostile system, the source of the traffic may be back-tracked, and shut off near its source. Not easy - and not necessarily today - but there could be places where such approaches may be deployed.

    Sam Nitzberg
    dontspamthis_______sam@iamsam.com
    http://www.iamsam.com/ [iamsam.com]
    http://www.nitzbergsecurityassociates.com/ [nitzbergse...ciates.com]

Slashdot Top Deals

You knew the job was dangerous when you took it, Fred. -- Superchicken

Close