9 ms·
America tells private firms to “hack back”
https://archive.ph/vwuA1 https://archive.ph/vwuA1
- jen20 8mo agoRelying on good will and people doing the right thing is clearly bullshit - any system which is insecure should be a legitimate target, and the onus needs to be on those who own the systems to secure them, and be unable to disclaim liability if they do not. However, the law needs to reflect that if people are to actually take the suggestions seriously.
- thatguy0900 8mo agoIs there practical ways other than spending a couple billion dollars to protect yourself from nation state hacking groups? Especially if you'd doing something like internet connected medical devices? Honest question
- jen20 8mo agoThe problem is, it doesn't matter. If the "good guys" are prevented from testing your system to uncover vulnerabilities without legal threats, but the "bad guys" are not, you still effectively do need to spend that anyway.
- malwrar 8mo agoYou can’t really avoid paying for security, which seems to historically be why it is ignored and risked. I’ve always felt the right approach is for an internal security & reliability org be formed to provide an owner and maintainer for core services and libraries, so that things are built robustly from the get-go. Think premade formulations an integration for auth, hosting, data storage, etc. Some companies have small security teams that _kind of_ fill this role, but usually they’re a gate you must pass rather than an ally helping you navigate hard problems by providing and maintaining prebuilt solutions. I’d rather just require that normal devs not need to solve these problems and instead be provided an appropriate sandbox to deploy software in.
- megous 8mo agoThey did login on a global admin account and wiped devices via whatever turd technology is used currently to have complete control over your employee's devices centrally. Central control over everything gives you central way to shoot yourself in the foot. Duh. Don't be a control freak company maybe, or if you are, have 2FA on your admin's accounts. "Nation state" my ass. They also demonstrated that one rogue admin could have deleted the entire company in like one evening, too, if he felt bad enough. Well, they also relied on this company to protect them, so... https://www.bleepingcomputer.com/news/security/microsoft-entra-id-flaw-allowed-hijacking-any-companys-tenant/ https://www.bleepingcomputer.com/news/security/microsoft-ent...
- drivingmenuts 8mo ago> any system which is insecure should be a legitimate target, and the onus needs to be on those who own the systems to secure them, and be unable to disclaim liability if they do not And what is the limit on that, because the only actually-secured system is one that is not connected to anything or accessed by anyone. Look, I agree that people are shit and the only person you can trust is one you've killed yourself, but that's not really a workable solution.
- jen20 8mo agoWell then how do you propose to police that outside of your own jurisdiction?
- VladVladikoff 8mo ago>his front door used an old style of insecure lock, so I spent 4 hours picking it. It’s his fault for not having a more secure lock.
- kstrauser 8mo agoSay I do everything right and still get compromised because an AWS 0-day lets attackers read the RAM of my virtual server. It’s my responsibility, but is it my fault? There’s no such thing as a secure system that’s usable. You can asymptomatically approach it giving infinite money, in the same way you can approach physical security (“if it were really important to you, you would’ve cloned Fort Knox, so I guess you don’t care”) or even the speed of light. But even Fort Knox is vulnerable to a highly determined invading army. Getting compromised doesn’t inherently mean you made mistakes.
- fn-mote 8mo ago> Getting compromised doesn’t inherently mean you made mistakes. I entirely agree, but I think the reason you see such upset posts is that they are thinking of situations where EGREGIOUS mistakes were made and no liability was found.
- kstrauser 8mo agoI'm sure that's right, and I also find that frustrating. It just rubs me the wrong way, like people who say goofy things like "all CEOs suck". They're picturing [insert your least favorite CEO here], but probably don't know, or temporarily forget, that the local bodega's owner very well might be the CEO of an S-corp that operates their little store for liability purposes.
- Hasslequest 8mo agoYou chose to use AWS
- hedora 8mo agoAnd to steal all my data and put it in RAM.
- epolanski 8mo agoI have this huge looming sensation private credit will trigger a mini 2008, but instead of investors sucking up the losses, as they should, american taxpayers will be left with the bill.
- allthetime 8mo agoNot if American tax payers stand up, fight back, and demand better. I won't hold my breath though.
- joe_mamba 8mo ago>Not if American tax payers stand up, fight back, and demand better. How?
- allthetime 8mo agoUse your imagination, or, read some history.
- gruez 8mo ago>or, read some history. If you're trying to make a veiled reference to the french revolution, keep in mind that's also ostensibly what the Jan 6th rioters thought they were doing, though arguably a lighter version. "Let's have a violent revolution to kill the elites" sounds like a great idea, until you realize that it works for the other side as well.
- hananova 8mo agoThing is, they did get everything they wanted with a bit of a delay. So in essence they proved that violent uprisings work.
- kgwxd 8mo agoThat's bullshit. Same nonsense as equating J6 and BLM. J6 was a _government official_, with no evidence, inciting violence in people that _did not care about evidence_. They did not think, period. BLM was individuals responding to seeing, _with their own eyes_, power being blatantly abused _by government officials_, live on TV, many, many times.
- Natfan 8mo agohttps://archive.ph/vwuA1 https://archive.ph/vwuA1
- cjs_ac 8mo agoI agree with the characterisation of this activity as 'cyber-warfare', but that has the consequence that telling businesses to 'hack back' is inviting them to raise private armies, with which I strenuously disagree. That sort of thing does, however, to fit with the present administration's ideology.
- ImPostingOnHN 8mo agoThat was my immediate thought as well: Legitimizing in people's minds that it's ok to commit crimes in a self-coordinated fashion as long as it benefits the people in the current administration. It's very dangerous, and is also happening right now with regards to physical violence [0][1], in addition to all the white collar crime (too much to list). 0 – https://en.wikipedia.org/wiki/Pardon_of_January_6_United_States_Capitol_attack_defendants https://en.wikipedia.org/wiki/Pardon_of_January_6_United_Sta... 1 – https://www.nbcnews.com/politics/politics-news/trump-calls-alex-pretti-insurrectionist-agitator-new-video-icu-nurse-e-rcna256724 https://www.nbcnews.com/politics/politics-news/trump-calls-a...
- alephnerd 8mo ago> telling businesses to 'hack back' is inviting them to raise private armies > That sort of thing does, however, to fit with the present administration's ideology These kinds of firms (usually branded as boutique consultancies) have already existed in the OffSec space for over a decade now in most countries and with tacit approval of their law enforcement agencies. It was BSides this weekend and RSAC right now so you will bump into plenty of them walking around Moscone.
- cjs_ac 8mo agoThat made sense when it was just businesses defending their own operations from criminals, akin to banks having to use armed guards to move cash and bullion around. But when it's businesses defending against state-sponsored actors in the context of an actual shooting war, that's very different.
- alephnerd 8mo ago
- scuff3d 8mo agoThat's what we want, corporations waging "cyber-war" in the name of national security. Brilliant...
- FerretFred 8mo agoIf a company's already been hacked, what makes them think they have the knowledge/expertise to fight back?
- OutOfHere 8mo agoExactly. They don't even have the know-how to defend themselves -- there is no hope of them getting on the offensive, at least not without extensive external help.
- follie 8mo agoThis has nothing to do with the reality of computer security. Not getting hacked requires doing everything right and some luck. Hacking requires some luck or doing one thing right.
- cindyllm 8mo ago[dead]
- whatevaa 8mo agoIt applies to more things than computer security. Best defense is offense is a very old and broad say.
- dathinab 8mo agoit's also why Germany started WW1 and what made it easy to put all the blame on them (after WW1, WW2 is a different thing) and also is related to common war crimes iff in a conflict combatants frequently hide as civilians (as a defense by offense will sooner or later lead to attacking random civilians due to mistaking them for hidden combatants) so I would take that saying with a bit of salt
- conductr 8mo agoGuerrilla warfare strategies undercut old saying like this and are essentially what these hacker groups represent
- SilverElfin 8mo agoState sponsored cyberattacks by China should be considered an act of war by the US government. Telling private firms to hack back isn’t a solution. Unfortunately Trump has been spineless and weak on China, as we have seen in the tariff debacle and in the TikTok ban debacle.
- _slih 8mo agohack back assumes you know who hit you. attribution in cyber is hard enough for the NSA
- clcaev 8mo agoThe referenced policy says "We will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities." https://www.whitehouse.gov/wp-content/uploads/2026/03/President-Trumps-Cyber-Strategy-for-America.pdf https://www.whitehouse.gov/wp-content/uploads/2026/03/Presid... I don't see where the policy instructs the private sector to "hack back", a quoted term in the article.
- iamnothere 8mo agoI look forward to the first instance of a DDoS or targeted exploit used against security researchers who have been misidentified as “hackers” by some corporate IDS.
- yabones 8mo agoYeah, considering the number of corporate IT products that count anything from a port scan to requesting /wp-admin a "thwarted cyberattack" I can see this going very poorly when every cowboy IT manager gets their sheriff badge.
- red-iron-pine 8mo agothe distinction between "security researchers" and "APT" is often quite blurry
- SahAssar 8mo agoI don't think you are using APT correctly there.
- nitwit005 8mo agoI was imagining retaliation against AWS, where some compromised EC2 instance happened to be running.
- rolandog 8mo agoI don't look forward to corporations "automating" (unleashing) their "defenses" (hackbots) with AI, and ending up bricking random people's and businesses' phones and devices because they start hallucinating attacks.
- mikkupikku 8mo agoJennifer Government anyone?
- booleandilemma 8mo agoI love this book and it doesn't get enough recognition.
- BLKNSLVR 8mo agoI think there may be adversaries smart enough to coordinate a situation to get a little hacking war going on between two friendlies who both think they're 'hacking back' at enemies. Verifying the actual source of a hack is not necessarily easy, as far as I know.
- MrLeap 8mo agoSorta reminds me of UDP amplification attacks.
- dylan604 8mo ago> Verifying the actual source of a hack is not necessarily easy, as far as I know. The Geneva convention says that combatants must be identifiable by uniform, so we can just enforce that, right? /s
- type0 8mo agoIt's a kind of digital munition, there's no conventions for that
- daotoad 8mo agoRFC 3514 perhaps? https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
- dylan604 8mo agoYes, this is what I really had in mind but could not retrieve this from my memory banks. If the combatants are not going to properly identify themselves, then the risk of civilian casualties is going to be very high. I guess interlock breathalyzers was just the opening shot.
- LunaSea 8mo agoShould we introduce a new HTTP header : `X-CTF-TEAM: NSA` ?
- mmooss 8mo agoGovernments must have a monopoly on violence. One reason: When a corporation attacks someone, how do they decide who they are attacking? What if they attack the wrong person due to misattribution? What if they do it due to incompetence (stretch your mind adn try to imagine incompetence in IT) or just to look like they did something? What if they attack enemies or competitors? I'm sure they can find some excuse. In every other domain of justice, there is a warrant, an arrest, indictment, and trial, involving they agreement of many people in two branches of government. Also, does this mean I can 'hack back' the endless scammers?
- actionfromafar 8mo agoAnother similarity with North Korea!
- skywhopper 8mo ago“Everyone should become a criminal” does seem to be the organizing principle of the current administration.
- movedx 8mo agoCyberpunk 2026.
- iam_circuit 8mo ago[dead]
- Havoc 8mo agoThis is giving Hollywood hacker movie levels of technical understanding
- pimlottc 8mo agoThey just need to type faster
- testing22321 8mo agoIn the dark with a mask on
- hoherd 8mo agoWhile drinking Brawndo.
- alifeinbinary 8mo agoThey just need to create a GUI interface with Visual Basic and see if they can track the IP address.
- condiment 8mo agosounds like a good opportunity to bring back "letters of marque." These were less about authorizing ships to fight back against pirates, and more about authorizing private to your army to find and capture pirate vessels with the expectation that they would be allowed to keep whatever loot they captured. sounds like we're taking a step in that direction as the Internet is being identified as Lawless as the sea. https://en.wikipedia.org/wiki/Letter_of_marque https://en.wikipedia.org/wiki/Letter_of_marque
- foxyv 8mo agoI guess that would put a different spin on the idea of Software Piracy...
- RealityVoid 8mo agoI guess it would be more akin to smuggling at this point.
- aaron695 8mo ago[dead]
- monarchwadia 8mo agoAre you indirectly referencing this bill? https://burchett.house.gov/media/press-releases/burchett-introduces-bill-authorize-president-trump-issue-letters-marque-and https://burchett.house.gov/media/press-releases/burchett-int...
- Bratmon 8mo agoIt says something about modern Congress that when one of the powers explicitly granted to Congress became relevant for the first time in 100 years, their first instinct was to delegate it away to the President.
- hardlianotion 8mo agoHe could be referencing this: https://en.wikipedia.org/wiki/The_Letter_of_Marque https://en.wikipedia.org/wiki/The_Letter_of_Marque
- zenmac 8mo ago>https://archive.ph/vwuA1 https://archive.ph/vwuA1 Link seems to be down ATM. Is this caused by that cloud flare issue affecting archive.today that was just posted recently?
- voxgen 8mo agoIt works for me Firefox's Cloudflare DNS over HTTP. For clarity, the recent issue[0] likely wasn't intermittent. Cloudflare's malware blocking DNS server now blocks those archive.today sites. Doesn't affect the non-malware-blocking DNS server (1.1.1.1). [0] https://news.ycombinator.com/item?id=47474255 https://news.ycombinator.com/item?id=47474255 "Cloudflare flags archive.today as \"C\&C\/Botnet\"; no longer resolves via 1.1.1.2"
- rdtsc 8mo agoWould this open "interesting" possibilities for false flags: make one entity attack another entity you don't like, and now watch them fight each other.
- sandy_coyote 8mo agoThere's no profit in hacking back, only cost.
- ineedaj0b 8mo agoOvertime, if everyone who robs gas stations ends up dead and shot, people will significantly stop robbing gas stations. The attendant does not want smoke… but if circle K can hire top talent to “eliminate”? How cool would a team of 12 guys charged with hurting the hacking firm be? Awesome job. And if successful you’d have a cool story. White hat but you don’t need to work for the NSA.
- deleted 8mo ago[deleted]
- Surac 8mo agoThere one was a pen and paper rollplaying system called shadowrun. reading all this makes me think of the game world
- doom2 8mo agoIt's still around and up to 6th edition! Catalyst Game hasn't been the best steward of the IP, with the rules still being internally inconsistent and usually needing a lot of house rules to fix.
- secureblueprint 8mo ago[dead]
- TesterVetter 8mo ago[dead]
- hulitu 8mo ago> America tells private firms to “hack back” Only if they know that they have been hacked. Hello Microsoft