Hack back is a bad idea

guest · Nov 6, 2021

Hack back is a bad idea
November 6, 2021
https://betanews.com/2021/11/06/hack-back-is-a-bad-idea/

On almost an annual basis we see policy proposing the authorization of private-sector hack back, the latest of which has been legislation from two US senators. One of the main issues with policy proposals for hack back is that they rarely address how it would work in reality and how opportunities for abuse or unintended harm would be handled.

To address this, Senators Daines and Whitehouse have proposed that the US Department of Homeland Security (DHS) "conducts a study on the potential benefits and risks of amending section 1030 of title 18, United States Code (commonly known as the 'Computer Fraud and Abuse Act') to allow private entities to take proportional actions in response to an unlawful network breach, subject to oversight and regulation by a designated Federal agency."
Click to expand...

The wealth of reasons why hack back is a bad idea
Hack back can be likened to homeowners defending their property against criminals breaking in, arming themselves and standing bravely in defense. However, the reality is more akin to spraying bullets and hoping to hit the intruder, and even if you do manage to reach your attacker, you’re additionally risking terrible collateral damage. The problem is, the internet doesn’t operate in clearly or neatly defined boundaries.
Click to expand...

In all, the potential negative consequences of a hack back gone wrong could be far-reaching, catastrophic and costly, including expensive legal proceedings, reputational damage, and loss of trust.

Hack back can lead to disruption to operations, damage to systems, or loss of data. In some cases, hack back could even create diplomatic implications. This should both concern lawmakers and disincentivize participation in hack back.
Click to expand...

guest · Nov 8, 2021

Experts Analyze Proposed Bill Allowing Private Entities to 'Hack Back’
November 8, 2021
https://www.securityweek.com/experts-analyze-proposed-bill-allowing-private-entities-hack-back’

The ‘hack back’ controversy is like a well-rooted weed. No matter how often it is cut down, it always comes back. The latest iteration is a bi-partisan bill (S. 2292) introduced this summer that would require the DHS to weigh up the potential benefits and risks of allowing private entities to ‘hack back’.

If the average American has the right to defend his home by striking back, why cannot he or she defend the network in a similar fashion?
Click to expand...

S. 2292 is cited as the “Study on Cyber-Attack Response Options Act”. It was introduced on June 24, 2021 by senators Sheldon Whitehouse, D-R.I., and Steve Daines, R-Mont.
This is different to earlier attempts to legalize hacking back. Instead of demanding the right, it is asking the DHS to justify – in some detail – why private entities should not have that right.

With relatively weak arguments against hacking back, the rest of the Act simply says, ‘OK, how should we implement and regulate hacking back?’ For opponents of a general right to hack back, this Act is possibly more dangerous than it first appears.
Click to expand...

While indictments might name members of Russian intelligence and the Chinese military, the cases will never come to court and the action has zero effect on continuing aggressive cyber activity.
Click to expand...

guest · Nov 18, 2022

Australia's Hack-Back Plan Against Cyberattackers Raises Familiar Concerns
By Jai Vijayan @jaivijayan - November 18, 2022

The Australian government's defiant proclamation recently that it would hack back against hackers that sought to target organizations in the country represents a break from the usual cautious manner in which nations have approached international cyber threats.
Click to expand...

How effective the country's newly announced "joint standing operation against cybercriminal syndicates" will be remains an open question, as does the issue of whether other nations will follow suit. Also unclear is how far exactly law enforcement is willing to go to neutralize infrastructure that it perceives as being used in cyberattacks against Australian entities.
Pressure for Hack-Back Legislation May Be Mounting
"As it becomes more obvious that the majority of organizations are poorly prepared to defend themselves, I think it is justifiable for well-resourced governments to step in," says Richard Stiennon, chief research analyst at IT-Harvest. "I fully expect hack-back legislation to pass in response to some devastating attack that is visible to lots of voters. But I do not expect it to have teeth or change the landscape much."
Click to expand...

The government launched the initiative following two major cyberattacks — one on telecommunications company Optus and the other on health insurer Medibank — that together exposed personally identifiable information (PII) and other sensitive information belonging to more than one-third of Australia's total population of some 26 million people.

US lawmakers have on a few occasions attempted — and failed — to pass bills that would offer some legal backing for organizations that hack back against cyberattackers.
The initiatives failed amid controversy, largely around concerns that innocent entities could be caught in the crossfire.
Click to expand...

The Need for Caution
Security researchers too have long advocated the need for caution around proactive efforts to disrupt criminal infrastructure — or to hack back against operators — because of the difficulties around attribution and collateral damage.

Innocent organizations, for instance, can get disrupted from the takedown of a hosting provider that a threat actor might have used to launch attacks. The ability for threat actors to launch attacks that appear to originate from somewhere else is another reason why critics have noted hack-back initiatives are dangerous.
Click to expand...

There are also potential legal landmines to consider. A law that Georgia's state legislature passed in 2018 — but which the Governor later vetoed — contained a provision that in essence would have protected a company against legal liability if it conducted a hack-back operation against another entity so long as it was part of "active defense."

As Rapid7 has noted, the term "active defense" as used in the bill could have been interpreted in any number of ways, leading to potential misuse and unintended consequences.
Click to expand...

Log in or Sign up

Hack back is a bad idea

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hack back is a bad idea

guest Guest

guest Guest

guest Guest

Useful Searches