6 ms·

If a company's already been hacked, what makes them think they have the knowledge/expertise to fight back?

• OutOfHere 7mo ago
  Exactly. They don't even have the know-how to defend themselves -- there is no hope of them getting on the offensive, at least not without extensive external help.
  • follie 7mo ago
    This has nothing to do with the reality of computer security. Not getting hacked requires doing everything right and some luck. Hacking requires some luck or doing one thing right.
    • cindyllm 7mo ago
      [dead]
    • whatevaa 7mo ago
      It applies to more things than computer security. Best defense is offense is a very old and broad say.
      • dathinab 7mo ago
        it's also why Germany started WW1 and what made it easy to put all the blame on them (after WW1, WW2 is a different thing) and also is related to common war crimes iff in a conflict combatants frequently hide as civilians (as a defense by offense will sooner or later lead to attacking random civilians due to mistaking them for hidden combatants) so I would take that saying with a bit of salt
      • conductr 7mo ago
        Guerrilla warfare strategies undercut old saying like this and are essentially what these hacker groups represent
    • dathinab 7mo ago
      The problem is to hack something you need to know the what, where, who. Companies have a very visible what, where, who in most cases. Hacker don't, and take extra steps to obscure it (e.g. jump hosts, bot nets etc.). Now if it's idk. a spear phishing campaign or similar "hacking back" by giving them trapped data or reverse social engineering attacks might work. But if it's a technical security vulnerability some one found by scanning and sneaked into using multi-country jump hosts and cleaned up behind them. Then you have little chances to find them and to do so likely requires getting information from telcoms which require judge orders to be handed over, and from multiple countries, too.
      • follie 7mo ago
        Sure though I would view that as a separate problem with the idea of asking anyone to target attackers.. Everyone is an equally good psychic some believe they are better than others.
    • OutOfHere 7mo ago
      Extending your logic, highly debatable as it is, a firm should first of all be hacking itself constantly via red teaming. This will help it discover and perhaps fix issues that external hackers can otherwise exploit. This self-offense is a means of defense.
      • follie 7mo ago
        Every company that meets modern regulations runs scanners that identify some attacks against themselves. The scanners sold to them stop there because it is liability to do anything beyond that. You don't have to be a genius to use Telegram instead of Teams you'll simply be fired for taking risks with better tools for the job than organizations and governments want to be acceptable and routine if you are in a Western regulated industry. Announce a change that is believable and all the corporate software will change to match the utility that is no longer a liability.
• blourvim 7mo ago
  Nvidia has done it before, I think they included a virus in their data which encrypted the stolen data
  • dathinab 7mo ago
    okay that is kinda funny and much less legally problematic (because they didn't actively hack back and depending on what that virus did in detail could be seen more like how money bags can spray color on the bills if forcefully opened making them useless but not quite destroying them)
  • lonelycompiler 7mo ago
    I looked into it, looks like they attempted to counter-attack. [1] 1.https://videocardz.com/newz/nvidia-allegedly-hacked-the-ransomware-attackers-back-by-encrypting-1tb-of-its-stolen-data https://videocardz.com/newz/nvidia-allegedly-hacked-the-rans...
• everforward 7mo ago
  Even better, why would they bother? If it's a non-monetary hack (i.e. for data), hacking them back won't undo leaking the data. If it's a monetary hack, there are surely much better recovery options than trying to do a hack-in-kind to take it back. It also seems incredibly risky. This US admin might be okay with it, but will the next? For multi-national corporations, will other nations be okay with it? I wouldn't think countries unassociated with the conflict would be happy with digital privateering.
  • dathinab 7mo ago
    > For multi-national corporations, will other nations be okay with it? imagine hacking back and accidentally hitting a hospital killing someone in the process that is a fast line to get an Interpol terrorist arrest request on your head, sure the US won't hand you over, but have fun to never leave the US and get assets abroad sized
    • Aeolun 7mo ago
      Does that happen to state sponsored Iranian hackers?
      • dathinab 7mo ago
        the comments are about "private firms hacking back" not about highly specialized groups hacking first but also "professional hackers" have screwed over hospitals before and confirmed it was accidental, so potentially yes worse Iranian terrorist with hacking skills might intentional target hospitals and they might not sit in Iran so disconnecting Iran is unlikely to help at all with such a threat
    • MagicMoonlight 7mo ago
      At first I thought this was a joke comment, like you could accidentally fire a hacking missile and hit a hospital… but you’re serious?
      • 7mo ago
• dylan604 7mo ago
  Just because you didn't prevent your opponent from scoring doesn't mean you can't score yourself.
  • wheelerwj 7mo ago
    Can you elaborate on that?
    • deleted 7mo ago
      [deleted]
    • dylan604 7mo ago
      Look at every single sportsball event where the losing team had > 0 points. Same thing. Has there ever been a "war" with 0 casualties on the winning side? There's also a quote from Prez in The Wire, "Nobody wins. One team just loses more slowly"
      • edgyquant 7mo ago
        Anglo-Zanzibar war lasted about 40 minutes and saw 0 British casualties https://en.wikipedia.org/wiki/Anglo-Zanzibar_War https://en.wikipedia.org/wiki/Anglo-Zanzibar_War
  • Barrin92 7mo ago
    except this isn't a game of sports and a private company doesn't gain anything from attempting to "hack back" a foreign adversary. It just costs them resources and makes them an even larger target. And given that those adversaries are in all likelihood state sponsored the actual opponent is the US government, which is abdicating their responsibility. It's like saying "the police doesn't care any more citizen, so you know just punch back". It's also incredibly dangerous btw to tell private firms they have the authority to engage in what is basically an act of warfare.
    • grogenaut 7mo ago
      Why do you think they are likely state actors versus script kiddies.
• robotnikman 7mo ago
  This might be the start of hacker mercenary groups which corporations hire.
  • ordu 7mo ago
    I don't think corporations are that stupid: they have no means of knowing if mercenaries they hire are not the same people who hacks them.
  • justinclift 7mo ago
    Looks like we're doing the Cyberpunk 2077 timeline?
    • theandrewbailey 7mo ago
      We have been for decades, since the 1990s at least. Pondsmith was on to something.
  • antonymoose 7mo ago
    This already exists to some degree. It’s the “Brand Protection” industry and they’ve been doing it for years. Our clients were all Blue Chips that need additional help and or want plausible deniability. Having worked in the space, the normal flow would look something like: 1. Random WordPress blog is hacked, hosts a fake iCloud page, the is linked to in phishing emails. 2. We find it, either by direct reporting or by our internet crawling 3. We reach out to the hacked company, their hosting provider, and their DNS. The goal being take this site offline no matter how. This worked for the vast majority of hacks. Some random plumbing company has no clue their marketing site is compromised and happily works with us. Or maybe they host at GoDaddy and we have a privileged relationship with them and they disabled the site. Last resort the DNS company will just delete their records. Sometimes, though, we get a compromised site on a host in a foreign land that won’t cooperate. Then what? Well, it’s a legal grey area that our in-house counsel felt was perfectly fine: hack the site and take it down the hard way. We didn’t advertise or document when we did this. It was an open-secret inside the company however. All this does is legitimize the sadly necessary work we face in a modern world.
• kmeisthax 7mo ago
  On the Internet, attackers have about the same ratio of advantage that defenders do IRL. They absolutely can hack back, because hacking is easy. The real question is if they can even properly attribute to the correct target. Nobody hacks from their home IP. Anyone remember Uplink? You'd make it way easier to avoid getting arrested (which wipes your save) if you proxied through the tutorial machine first and wiped its logs after you were done. Likewise, even the most basic cybercriminals know to hack with machines they've already compromised, so that all the owners of those machines and their ISP's abuse desks spend all their time pointing the finger at each other.
  • wrboyce 7mo ago
    Jump across borders of non-cooperative nations, too. Say using boxes in Iran and USA, or India and Pakistan.
• dathinab 7mo ago
  they don't worse hacker do like using jump hosts so wherever you "hack back" to has a good chance to be another victim it's also a good point to remind people that most cases of "knowing who was it but not catching the people behind it" are either wild guesses without proof or the attacker leaving recognizable traces (like a literally "it has been us <group>" note /not a joke). But the problem with that is any other advanced enough hacker group/apt could also have made it look like that...
• mc32 7mo ago
  I guess this means if you know your attacker as IDd by your MDR, you don't have to feel helpless in not being able to fight back against the likes of Cozybear, Romcom, Lazarus, etc., if you're up to it. Now, I don't think many orgs would be up to it, but perhaps the bigger orgs in the US might quietly fight back -Microsoft and others typically fight back in the legal space with takedowns, etc., but who knows, they could venture further afield.
  • overfeed 7mo ago
    > Now, I don't think many orgs would be up to it, but perhaps the bigger orgs in the US might quietly fight back Sony's movie division financed a movie North Korea disapproved of, and DPRK retaliated[1] by hacking Sony Pictures and released executive salaries, emails, private employee information, unreleased movies, scripts, and set loose wiper malware on Sony Pictures' internal network. Sony was also forced to cancelled the theatrical release because there were threats of terrorist attacks at theaters that showed the film. "Hacking back" is not a great strategy for most companies, except those that were already juicy targets and are battle-tested against state actors. But what do I know, I'm no fancy CSO. 1. https://en.wikipedia.org/wiki/2014_Sony_Pictures_hack https://en.wikipedia.org/wiki/2014_Sony_Pictures_hack
• chromacity 7mo ago
  I don't think that follows. There's not a single large organization - private business or a government - that can claim to be 100% hacker-proof. A lot of "cyber" problems are also people problems: humans make mistakes, deliberately circumvent policies and security mechanisms to "get stuff done", can be coerced or bribed. That doesn't mean they are incompetent, just that defense is never perfect. Making criminals' lives more complicated is a good strategy. Corporate vigilantism, I don't know.
• JumpCrisscross 7mo ago
  > what makes them think they have the knowledge/expertise to fight back? If the goal is simply breaking shit (versus e.g. exfiltrating data) offense is way easier than defense. Also, security is an ongoing expense. Retaliation is one time.
  • conductr 7mo ago
    > Also, security is an ongoing expense. Retaliation is one time. Disagree. Retaliating draws a larger target on you. Increasing need for ongoing security. And increasing need to retaliate. You’re retaliating against multiple fronts and vectors. It’s all very expensive and an arms race.
    • JumpCrisscross 7mo ago
      > Retaliating draws a larger target on you. Increasing need for ongoing security Does it? I feel like I could pretty easily pay a mercenary group to fuck around with Iran without being particularly concerned about blowback. (My main risk would be getting scammed.)
      • antonymoose 7mo ago
        Having worked in anti-Phishing brand protection firm on behalf of firms like Apple, it absolutely draws a target on your back. We used to receive routine threats from the IRGC on top of the usual DDoS attacks on our systems. Turns out cybercriminals don’t like it when you disrupt their cash flow. Thankfully we never got SWAT’d or had a box of heroin shipped to our office like that one journalist.
      • conductr 7mo ago
        If you could keep your association with that mercenary a secret then sure. But if you were IDK, Walmart, and you went on this offensive or openly admitted to backing the mercenary. Well, now that Iranian group may want to push harder. Instead of attacking your servers, they begin attacking your POS, thermostats, security cameras, time clocks, inventory mgmt hardware, etc. they eventually start targeting your employees and their personal homes and such. They could do all this now, but they generally don’t. Poke the bear and it might bite.
• rdtsc 7mo ago
  > what makes them think they have the knowledge/expertise to fight back? That fact that they have money to hire someone to do it? Now one might ask why didn't they use that money to defend themselves to start with.
• Bender 7mo ago
  If a company's already been hacked, what makes them think they have the knowledge/expertise to fight back? Not required. This is unlikely to be random SecOps and SecEng corporate employees as the legal risk is too high as government administrations are replaced every few years. Just like real piracy at sea companies would hire mercenaries or nowadays referred to as private military contractors. The fight back would just be to initially identify them (attribution) then activate PMC's at or near their location and neutralize the root cause. With time countries will tire of random PMC's showing up and will take a stronger approach to dealing with their own hackers in addition to making the internet less anonymous. The effort to make the internet less anonymous has clearly already started as HN have been witnessing. Efforts like bcp38, 84 [1] authenticated packets likely using a nonce after government ID based auth and many other methods will be implemented as previous efforts have stalled. [1] - https://www.rfc-editor.org/bcp/bcp84.txt https://www.rfc-editor.org/bcp/bcp84.txt