Feeds

Firms turn to vigilante tactics against crackers

Cyber-anarchy looms

  • alert
  • submit to reddit

Protecting users from Firesheep and other Sidejacking attacks with SSL

Firms are becoming prepared to adopt vigilante tactics against crackers in response to a rise in cybercrime that law enforcement measures alone cannot be expected to control.

That was the conclusion of a panel of security experts at London's Infosecurity show yesterday who warned that the reluctance of business to use the law when they are subject to Internet attack is leading to a state of "cyber anarchy".

Bob Ayers, former Head of the US Information Warfare Programme, said that a survey by Infowar.com suggests that 70 per cent of companies who have suffered a hack attack said they would fight back.

"The private sector is adopting vigilante tactics to respond to cybercrime," said Ayers.

Ayres, who is now director of security consultancy Para-Protect, cited other studies which suggest that 32 per cent of Fortune 500 companies had installed counter-offensive software, which he suggested had similar capabilities to the tools crackers themselves use.

Whether this 'counter-offensive' software refers to intrusion detection software or something more nefarious wasn't clearly explained but the argument firms might take the law into their own hands is fairly persuasive.

Peter Sommer, a security expert from the London School of Economics, said that in the same way that routine burglaries don't warrant the use of a lot of police resources, many cases of hacking are unlikely to be fully investigated by police, whose resources are limited.

If firms report hacking attacks to the police they risk public disclosure of their problems and are embarking on a uncertain legal process which might tie a great deal of their resources. Even if a cracker is arrested and convicted his punishment courts are reluctant to levy out heavy sentences or fines.

Also the police can only act after an attack, which might cause thousands of even millions of dollars of damage to a firm and its reputation, has taken place.

These factors might lead firms to take the law into their own hands and hire shadowy "information brokers" to hunt down hackers or authorise their own staff to strike back at crackers by trying to disable their machines through mounting a denial of service attack.

But by taking up information warfare tactics firms could fall foul of laws like the UK's Computer Misuse Act. It's also possible they might hit back at the wrong target.

Commodore Patrick Tyrrell, deputy chief executive of the UK's Defence Communication Services Agency, a group in the Ministry of Defence, said we may be headed for what he described as "short term cyber-anarchy".

Whether the situation will improve in the longer term was left unclear at the end of the debate, which emphasised the need for firms the get their security infrastructure robust enough to frustrate attacks in the first place. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.