Feeds

Firms turn to vigilante tactics against crackers

Cyber-anarchy looms

  • alert
  • submit to reddit

Remote control for virtualized desktops

Firms are becoming prepared to adopt vigilante tactics against crackers in response to a rise in cybercrime that law enforcement measures alone cannot be expected to control.

That was the conclusion of a panel of security experts at London's Infosecurity show yesterday who warned that the reluctance of business to use the law when they are subject to Internet attack is leading to a state of "cyber anarchy".

Bob Ayers, former Head of the US Information Warfare Programme, said that a survey by Infowar.com suggests that 70 per cent of companies who have suffered a hack attack said they would fight back.

"The private sector is adopting vigilante tactics to respond to cybercrime," said Ayers.

Ayres, who is now director of security consultancy Para-Protect, cited other studies which suggest that 32 per cent of Fortune 500 companies had installed counter-offensive software, which he suggested had similar capabilities to the tools crackers themselves use.

Whether this 'counter-offensive' software refers to intrusion detection software or something more nefarious wasn't clearly explained but the argument firms might take the law into their own hands is fairly persuasive.

Peter Sommer, a security expert from the London School of Economics, said that in the same way that routine burglaries don't warrant the use of a lot of police resources, many cases of hacking are unlikely to be fully investigated by police, whose resources are limited.

If firms report hacking attacks to the police they risk public disclosure of their problems and are embarking on a uncertain legal process which might tie a great deal of their resources. Even if a cracker is arrested and convicted his punishment courts are reluctant to levy out heavy sentences or fines.

Also the police can only act after an attack, which might cause thousands of even millions of dollars of damage to a firm and its reputation, has taken place.

These factors might lead firms to take the law into their own hands and hire shadowy "information brokers" to hunt down hackers or authorise their own staff to strike back at crackers by trying to disable their machines through mounting a denial of service attack.

But by taking up information warfare tactics firms could fall foul of laws like the UK's Computer Misuse Act. It's also possible they might hit back at the wrong target.

Commodore Patrick Tyrrell, deputy chief executive of the UK's Defence Communication Services Agency, a group in the Ministry of Defence, said we may be headed for what he described as "short term cyber-anarchy".

Whether the situation will improve in the longer term was left unclear at the end of the debate, which emphasised the need for firms the get their security infrastructure robust enough to frustrate attacks in the first place. ®

Intelligent flash storage arrays

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.