Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
China Hack Attacks: Play Offense Or Defense?
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
3/14/2013 | 11:51:51 PM
re: China Hack Attacks: Play Offense Or Defense?
In theory, such enforcement is provided by the CERT organisations in each country. In practice, the cooperation you get from them varies enormously.
I know precisely where the C&C for this botnet is, - hiding behind 200 dynamically allocated IP addresses in Turkey - but I can't get any cooperation from the Turkish Telecom company, or a reply from the CERT office.
Even if there were a private cyber hit team, they couldn't trace dynamic IP addresses from the outside, so there is no offensive action that can be taken.
Jonathan_Camhi
50%
50%
Jonathan_Camhi,
User Rank: Apprentice
3/14/2013 | 8:20:44 PM
re: China Hack Attacks: Play Offense Or Defense?
I'm not sure if it should be left up to each business to decide on its own how to deal with the situation. Any cyber security legislation coming from Washington should seek to address when and how companies should counter attacks from hackers, and if any offense should be left to the national security experts. Would be helpful to have some clearly defined roles to get everyone on the same page working against the current threats that are out there.
Tonyvo
50%
50%
Tonyvo,
User Rank: Apprentice
3/14/2013 | 4:42:57 PM
re: China Hack Attacks: Play Offense Or Defense?
Espionage is an older human profession and pasttime than prostitution. In fact, the Garden of Eden story is about a God spying on an Adam and Eve as they tried to hack the Tree of Knowledge!
And so, the distinction between offense and defense in this "game of life" is as relative and moot as the illusory distinction between good and evil itself. It all depends on viewpoint of the side you are presently playing for.
The simple premise is that if you have something worth protecting, you will have to protect it. And if you hire a CFO or a Guardian Angel that is stupid enough to follow a phishing link in an email, then you probably aren't very good at protection and you deserve to get hacked.
Sacalpha1
50%
50%
Sacalpha1,
User Rank: Apprentice
3/14/2013 | 4:38:51 AM
re: China Hack Attacks: Play Offense Or Defense?
I don't think it's one or the other. It's both at the same time. You should absolutely have the lasted patches, virus definitions, firewall defenses, etc. in place. That is a fundamental part of IT's job in any company. But there needs to be a much better offensive component as well. If there is no penalty for the attacker other than they just didn't get any data (because of good defenses), there is no deterrent for future attempts. We need specialized law enforcement groups that actively counter hack threats. I also like the idea in another comment of licensed privateers that are hired to go after specific targets.
Destroying Angel
50%
50%
Destroying Angel,
User Rank: Apprentice
3/13/2013 | 6:45:59 PM
re: China Hack Attacks: Play Offense Or Defense?
Shawn Henry is PART of the way there. The rest of the way involves congressionally bonded and licensed cyber privateers. The deterrence factor would cover not only cyberthieves but rogue governments as well. You want absolute proof that deterrence works? Notice how those zany pranksters at Anonymous backed down from attacking drug cartels. Maybe something about seeing body parts (theirs, their families', and their friends') scattered in public places made them reconsider.
philburton
50%
50%
philburton,
User Rank: Apprentice
3/13/2013 | 6:37:50 PM
re: China Hack Attacks: Play Offense Or Defense?
Why not direct these comments to the Republicans and the Chamber of Commerce, who opposed a bill in Congress that would have promoted a government/private sector partnership in this area.
beachman14
50%
50%
beachman14,
User Rank: Apprentice
3/13/2013 | 12:46:22 PM
re: China Hack Attacks: Play Offense Or Defense?
Stealing is stealing, stolen assets should be retrieved, and thieves should be punished. If you have valuable physical assets to protect, you place them in a secure location and lock the doors. And if a thief breaks in and steals them, you catch the thief, retrieve the stolen assets, and administer justice. How is this so different? Of course you have to have good defense, but the thieves have broken in and stolen valuable assets. How about we retrieve the value of that which was stolen by our government not repaying loans from the offenders? How about we administer justice by having ICANN remove the offenders connectivity from the Internet altogether for some period of time? The thieves have been identified, so let's recover the value of what was stolen and punish the thieves.
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
3/13/2013 | 4:06:10 AM
re: China Hack Attacks: Play Offense Or Defense?
As much as I'd like to say that I agree with playing offense here, you can't play offense until you've got a strong defense. It's an absolute must to keep everything as current as possible - OS patches, application patches, security appliance firmware, and user knowledge.

All of the latest and greatest security technology in the world can be defeated if the "man in the loop" fails to act in a secure manner. As long as users are involved, there is a risk of failure, period.

If you assume that the enemy is within your perimeter already, do you block ingress or egress? How do you determine if the enemy is there - given sufficient time and sophistcated attacks, can you depend on any system you have detecting that they're there? At that point, do you shut everything down and do a full security sweep? Hardly - business has to keep running, especially when a global economy dictates it.

From the play offense point of view, your INFOSEC folks are always going to be seen as playing catch-up and while that may be true in some instances... I think that from a management point of view, you're adding more stress to a group that's usually quite well enough stressed as it is.

Andrew Hornback
InformationWeek Contributor
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
3/13/2013 | 12:02:55 AM
re: China Hack Attacks: Play Offense Or Defense?
I agree with Shawn Henry that the private sector can do more to share actionable security information within appropriate verticals, but it also seems like both sides are arguing, correctly, that businesses should focus on creating a robust set of defenses, and let law enforcement and government agencies handle prosecution or retaliation.

Drew Conry-Murray
Editor, Network Computing
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
3/12/2013 | 11:16:47 PM
re: China Hack Attacks: Play Offense Or Defense?
Unlike other readers, I can speak with a bit more insight, since we've been under a cyber attack since last December.
I agree with John, in that your system should be as near hack-proof as you can make it. To date, not a single attack vector has succeeded, so we must have done something right.
We minimise the impact on ourselves, by getting our IDS to immediately generate a new firewall rule, for every identified hack attempt. It also generates an email to the ISP, identifying the IP address of the attacking zombie, and a clue as to where to find the malware (eggdrop bot/psybnc).
Our offence strategy, if you can call it that, is in the form of an abuse file, sent back by apache, containing 1500 lines of 'Attempted Abuse' messages which, at least, delay the next line of the hack script, long enough for the firewall to be in a position to stop it. For good measure, the last line of the abuse file is a series of ANSI escape codes, designed to screw up any ANSI terminal running a script.
Having had little joy from communicating with CERT, in the 51 countries from which attacks are emanating, we recently contacted SANS and, at least, get the impression that they know what they're doing.
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27652
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27653
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27654
PUBLISHED: 2020-10-29
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
CVE-2020-27655
PUBLISHED: 2020-10-29
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
CVE-2020-27656
PUBLISHED: 2020-10-29
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.