Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
China Hack Attacks: Play Offense Or Defense?
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
3/14/2013 | 11:51:51 PM
re: China Hack Attacks: Play Offense Or Defense?
In theory, such enforcement is provided by the CERT organisations in each country. In practice, the cooperation you get from them varies enormously.
I know precisely where the C&C for this botnet is, - hiding behind 200 dynamically allocated IP addresses in Turkey - but I can't get any cooperation from the Turkish Telecom company, or a reply from the CERT office.
Even if there were a private cyber hit team, they couldn't trace dynamic IP addresses from the outside, so there is no offensive action that can be taken.
Jonathan_Camhi
50%
50%
Jonathan_Camhi,
User Rank: Apprentice
3/14/2013 | 8:20:44 PM
re: China Hack Attacks: Play Offense Or Defense?
I'm not sure if it should be left up to each business to decide on its own how to deal with the situation. Any cyber security legislation coming from Washington should seek to address when and how companies should counter attacks from hackers, and if any offense should be left to the national security experts. Would be helpful to have some clearly defined roles to get everyone on the same page working against the current threats that are out there.
Tonyvo
50%
50%
Tonyvo,
User Rank: Apprentice
3/14/2013 | 4:42:57 PM
re: China Hack Attacks: Play Offense Or Defense?
Espionage is an older human profession and pasttime than prostitution. In fact, the Garden of Eden story is about a God spying on an Adam and Eve as they tried to hack the Tree of Knowledge!
And so, the distinction between offense and defense in this "game of life" is as relative and moot as the illusory distinction between good and evil itself. It all depends on viewpoint of the side you are presently playing for.
The simple premise is that if you have something worth protecting, you will have to protect it. And if you hire a CFO or a Guardian Angel that is stupid enough to follow a phishing link in an email, then you probably aren't very good at protection and you deserve to get hacked.
Sacalpha1
50%
50%
Sacalpha1,
User Rank: Apprentice
3/14/2013 | 4:38:51 AM
re: China Hack Attacks: Play Offense Or Defense?
I don't think it's one or the other. It's both at the same time. You should absolutely have the lasted patches, virus definitions, firewall defenses, etc. in place. That is a fundamental part of IT's job in any company. But there needs to be a much better offensive component as well. If there is no penalty for the attacker other than they just didn't get any data (because of good defenses), there is no deterrent for future attempts. We need specialized law enforcement groups that actively counter hack threats. I also like the idea in another comment of licensed privateers that are hired to go after specific targets.
Destroying Angel
50%
50%
Destroying Angel,
User Rank: Apprentice
3/13/2013 | 6:45:59 PM
re: China Hack Attacks: Play Offense Or Defense?
Shawn Henry is PART of the way there. The rest of the way involves congressionally bonded and licensed cyber privateers. The deterrence factor would cover not only cyberthieves but rogue governments as well. You want absolute proof that deterrence works? Notice how those zany pranksters at Anonymous backed down from attacking drug cartels. Maybe something about seeing body parts (theirs, their families', and their friends') scattered in public places made them reconsider.
philburton
50%
50%
philburton,
User Rank: Apprentice
3/13/2013 | 6:37:50 PM
re: China Hack Attacks: Play Offense Or Defense?
Why not direct these comments to the Republicans and the Chamber of Commerce, who opposed a bill in Congress that would have promoted a government/private sector partnership in this area.
beachman14
50%
50%
beachman14,
User Rank: Apprentice
3/13/2013 | 12:46:22 PM
re: China Hack Attacks: Play Offense Or Defense?
Stealing is stealing, stolen assets should be retrieved, and thieves should be punished. If you have valuable physical assets to protect, you place them in a secure location and lock the doors. And if a thief breaks in and steals them, you catch the thief, retrieve the stolen assets, and administer justice. How is this so different? Of course you have to have good defense, but the thieves have broken in and stolen valuable assets. How about we retrieve the value of that which was stolen by our government not repaying loans from the offenders? How about we administer justice by having ICANN remove the offenders connectivity from the Internet altogether for some period of time? The thieves have been identified, so let's recover the value of what was stolen and punish the thieves.
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
3/13/2013 | 4:06:10 AM
re: China Hack Attacks: Play Offense Or Defense?
As much as I'd like to say that I agree with playing offense here, you can't play offense until you've got a strong defense. It's an absolute must to keep everything as current as possible - OS patches, application patches, security appliance firmware, and user knowledge.

All of the latest and greatest security technology in the world can be defeated if the "man in the loop" fails to act in a secure manner. As long as users are involved, there is a risk of failure, period.

If you assume that the enemy is within your perimeter already, do you block ingress or egress? How do you determine if the enemy is there - given sufficient time and sophistcated attacks, can you depend on any system you have detecting that they're there? At that point, do you shut everything down and do a full security sweep? Hardly - business has to keep running, especially when a global economy dictates it.

From the play offense point of view, your INFOSEC folks are always going to be seen as playing catch-up and while that may be true in some instances... I think that from a management point of view, you're adding more stress to a group that's usually quite well enough stressed as it is.

Andrew Hornback
InformationWeek Contributor
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
3/13/2013 | 12:02:55 AM
re: China Hack Attacks: Play Offense Or Defense?
I agree with Shawn Henry that the private sector can do more to share actionable security information within appropriate verticals, but it also seems like both sides are arguing, correctly, that businesses should focus on creating a robust set of defenses, and let law enforcement and government agencies handle prosecution or retaliation.

Drew Conry-Murray
Editor, Network Computing
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
3/12/2013 | 11:16:47 PM
re: China Hack Attacks: Play Offense Or Defense?
Unlike other readers, I can speak with a bit more insight, since we've been under a cyber attack since last December.
I agree with John, in that your system should be as near hack-proof as you can make it. To date, not a single attack vector has succeeded, so we must have done something right.
We minimise the impact on ourselves, by getting our IDS to immediately generate a new firewall rule, for every identified hack attempt. It also generates an email to the ISP, identifying the IP address of the attacking zombie, and a clue as to where to find the malware (eggdrop bot/psybnc).
Our offence strategy, if you can call it that, is in the form of an abuse file, sent back by apache, containing 1500 lines of 'Attempted Abuse' messages which, at least, delay the next line of the hack script, long enough for the firewall to be in a position to stop it. For good measure, the last line of the abuse file is a series of ANSI escape codes, designed to screw up any ANSI terminal running a script.
Having had little joy from communicating with CERT, in the 51 countries from which attacks are emanating, we recently contacted SANS and, at least, get the impression that they know what they're doing.
Page 1 / 2   >   >>


Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2412
PUBLISHED: 2020-02-17
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-4531. Reason: This candidate is a duplicate of CVE-2012-4531. Notes: All CVE users should reference CVE-2012-4531 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental u...
CVE-2014-4981
PUBLISHED: 2020-02-17
LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.
CVE-2014-7236
PUBLISHED: 2020-02-17
Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.
CVE-2014-8089
PUBLISHED: 2020-02-17
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
CVE-2015-8751
PUBLISHED: 2020-02-17
Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.