Most of those working in the security field (or not) did used some sort of strikeback tehniques...

For example a few months ago due to a disagreement on a IRC channel some guy started flooding me from a linux with vulnerable SSL... it wasn't his machine... he hacked it in order to use it for DoS... Yes, I hacked into the machine stoped the flood and I sent a mail to the admin.

But... doing this process automatic it's pretty dangerous... what will consider such a strikeback utility as a threat ? A worm ? If I would strike-back on every nimda/red-code/iis worms who scanned my system I would be probably end up hacking 24/7 turning my machine into an automated hacking bot. Portscans are generally considered legal and I don't consider portscans or cgi scans as a threat for my system. I do consider DoS attacks as a threat because no mather how secure your network is DoS and DDoS attacks are harmfull... Should one strike back if he's system is flooded... my choice is YES ! But this is up to everybody (maybe if my OC3 is flooded by a couple of DSL machines I won't panic)... Automating this process is a very very very BAD ideea... how can a script determine the intensity, the danger of a DoS... sometimes strikeback is not the best defense. For example the recent .bugtraq used communication between infected systems... If your network had an infected machine and you patched it, the rest of infected clients continued to send UDP requests and since your machine never answered they continued "flooding"... Hacking into all of them would be pretty painfull and bandwith consuming... filtering them out would be a much smarter choice... so... unless you don't have some super-inteligent script which could take good decision... you have to forget about strikeback techniques... at least not automatically

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/134/17647#17647