With the rapid increase in security breaches leaving law enforcement struggling to keep up, some organizations are taking the law into their own hands and punishing hackers themselves.
Striking back at hackers with, for example, denial of service attacks is a sensitive subject, since doing so is illegal in most countries. However, security experts say the U.S. Department of Defense has used these methods. In addition, private companies use special firewalls and other counteroffensive software that can be set to automatically strike back at hackers, according to U.K. Internet security consultant and ex-hacker Mathew Bevan, among others.
Conxion Corp., an ISP (Internet service provider) based in Santa Clara, Calif., is one private company that acknowledges having reversed a denial of service attack on a group of hackers. When asked if giving hackers a dose of their own medicine is company policy, spokeswoman Megan O’Reilly-Lewis said, “We deal with it on a case-by-case basis.”
The World Trade Organization’s (WTO) Web site, which was being hosted by Conxion, was hacked into in late 1999. An organization called Electrohippies, or E-Hippies, bombarded the WTO Web page with download requests, which caused the Web service to slow down but not to crash completely.
“What our security staff did was to quickly write a script to reverse the traffic. Then they followed up with some more sophisticated methods,” said O’Reilly-Lewis. “It seemed to work fine,” she added.
“If they had been sophisticated hackers they would have easily avoided” the reverse attack, she said.
Hack attacks are clearly on the increase, and so are companies that specialize in tracking down the hackers.
“There’s a spectrum of things that we do,” said Bob Ayers, U.K. vice president of Para-Protect Ltd., headquartered in the U.S. The company uses an intrusion detection device with which it keeps tabs on a customer’s IT system. Ayers, a former U.S. military intelligence officer, described some of the actions companies can take when they discover an intrusion: “Disabling an account. Terminating the network link. We can go to the ISP and ask them to step in and take action.”
A company can also go beyond the e-mail address and find the person behind the crime. “You go pay him a visit,” said Ayers. “You talk to him and let him know that you’re not happy with what he is doing.” It might work, depending on your powers of persuasion, he added.
When asked if his company launches denial of service attacks on hackers on behalf of its customers, Ayers said, “I really don’t want to answer that question one way or another. All I can say is that the technology is there and how it is used is something I cannot predict.”
Both Ayers and another security expert, Winn Schwartau, president of IT security company Interpact Inc. in Seminole, Fla., and founder of security Web service Infowar.com, said that the U.S. Department of Defense has at least on one occasion launched a denial of service attack on hackers.
“Absolutely they have,” Schwartau said. “There was a group of pro-Mexicans (the Electronic Disturbance Theater) and they announced they were going to attack the Pentagon,” he said. “The Pentagon (the building that houses the department) knew about it. The Pentagon started shooting back, which was the right thing to do. However, it was illegal,” Schwartau said.
Not surprisingly, the Pentagon denies ever having used these methods.
“I am not aware that we have struck back at anyone with a denial of service attack,” said Susan Hansen, a spokeswoman at the Department of Defense. “We don’t discuss our specific security” measures, she added.
The number of malicious break-ins into companies’ computer systems is becoming alarming. The U.S. Federal Bureau of Investigation (FBI) found in a recent study that 85 per cent of respondents had detected computer security breaches during the past year. The survey was based on responses from 538 security experts in various U.S. corporations and government agencies. Sixty-four per cent suffered financial losses due to security breaches, and 186 respondents reported a total loss of almost US$378 million. Thirty-eight per cent of respondents detected denial of service attacks, compared to 27 per cent last year.
According to a survey done by Schwartau, about one third of surveyed companies in the U.S. have already, or plan to, develop strike-back capabilities for possible hack attacks.
– IDG News Service
