Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

China Hack Attacks: Play Offense Or Defense?
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
User Rank: Apprentice
3/12/2013 | 6:20:43 PM
re: China Hack Attacks: Play Offense Or Defense?
Both sides have merrit. However, I advocate a three pronged strategy:
* If you have something worth stealing, assume that someone will try. This necessitates defense.
* Do cooperate with authorities to identify intruders and thieves.
* Assume that someone will eventually succeed in stealing information. With this in mind, follow a divide and conquer strategy of separating related pieces of data or keeping details needed to process the information separate from the information. By the time the thieves realize what is missing you may be a step ahead of them. Even better, provide fake data that appears to be the missing part and make that data somehow an embarrassment to the thieves.
Dave D
Dave D,
User Rank: Apprentice
3/12/2013 | 6:31:29 PM
re: China Hack Attacks: Play Offense Or Defense?
In following up with John's football anology, sometimes your best offense is not always a great defense. I think there needs to be a balance between defensive and offensive cyber attack strategies. Both sides make good points however, I believe while keeping abreast of the latest protective techniques, some energy should be directed toward offensive initiatives to curb cyber attacks.
User Rank: Moderator
3/12/2013 | 11:16:47 PM
re: China Hack Attacks: Play Offense Or Defense?
Unlike other readers, I can speak with a bit more insight, since we've been under a cyber attack since last December.
I agree with John, in that your system should be as near hack-proof as you can make it. To date, not a single attack vector has succeeded, so we must have done something right.
We minimise the impact on ourselves, by getting our IDS to immediately generate a new firewall rule, for every identified hack attempt. It also generates an email to the ISP, identifying the IP address of the attacking zombie, and a clue as to where to find the malware (eggdrop bot/psybnc).
Our offence strategy, if you can call it that, is in the form of an abuse file, sent back by apache, containing 1500 lines of 'Attempted Abuse' messages which, at least, delay the next line of the hack script, long enough for the firewall to be in a position to stop it. For good measure, the last line of the abuse file is a series of ANSI escape codes, designed to screw up any ANSI terminal running a script.
Having had little joy from communicating with CERT, in the 51 countries from which attacks are emanating, we recently contacted SANS and, at least, get the impression that they know what they're doing.
Drew Conry-Murray
Drew Conry-Murray,
User Rank: Ninja
3/13/2013 | 12:02:55 AM
re: China Hack Attacks: Play Offense Or Defense?
I agree with Shawn Henry that the private sector can do more to share actionable security information within appropriate verticals, but it also seems like both sides are arguing, correctly, that businesses should focus on creating a robust set of defenses, and let law enforcement and government agencies handle prosecution or retaliation.

Drew Conry-Murray
Editor, Network Computing
Andrew Hornback
Andrew Hornback,
User Rank: Apprentice
3/13/2013 | 4:06:10 AM
re: China Hack Attacks: Play Offense Or Defense?
As much as I'd like to say that I agree with playing offense here, you can't play offense until you've got a strong defense. It's an absolute must to keep everything as current as possible - OS patches, application patches, security appliance firmware, and user knowledge.

All of the latest and greatest security technology in the world can be defeated if the "man in the loop" fails to act in a secure manner. As long as users are involved, there is a risk of failure, period.

If you assume that the enemy is within your perimeter already, do you block ingress or egress? How do you determine if the enemy is there - given sufficient time and sophistcated attacks, can you depend on any system you have detecting that they're there? At that point, do you shut everything down and do a full security sweep? Hardly - business has to keep running, especially when a global economy dictates it.

From the play offense point of view, your INFOSEC folks are always going to be seen as playing catch-up and while that may be true in some instances... I think that from a management point of view, you're adding more stress to a group that's usually quite well enough stressed as it is.

Andrew Hornback
InformationWeek Contributor
User Rank: Apprentice
3/13/2013 | 12:46:22 PM
re: China Hack Attacks: Play Offense Or Defense?
Stealing is stealing, stolen assets should be retrieved, and thieves should be punished. If you have valuable physical assets to protect, you place them in a secure location and lock the doors. And if a thief breaks in and steals them, you catch the thief, retrieve the stolen assets, and administer justice. How is this so different? Of course you have to have good defense, but the thieves have broken in and stolen valuable assets. How about we retrieve the value of that which was stolen by our government not repaying loans from the offenders? How about we administer justice by having ICANN remove the offenders connectivity from the Internet altogether for some period of time? The thieves have been identified, so let's recover the value of what was stolen and punish the thieves.
User Rank: Apprentice
3/13/2013 | 6:37:50 PM
re: China Hack Attacks: Play Offense Or Defense?
Why not direct these comments to the Republicans and the Chamber of Commerce, who opposed a bill in Congress that would have promoted a government/private sector partnership in this area.
Destroying Angel
Destroying Angel,
User Rank: Apprentice
3/13/2013 | 6:45:59 PM
re: China Hack Attacks: Play Offense Or Defense?
Shawn Henry is PART of the way there. The rest of the way involves congressionally bonded and licensed cyber privateers. The deterrence factor would cover not only cyberthieves but rogue governments as well. You want absolute proof that deterrence works? Notice how those zany pranksters at Anonymous backed down from attacking drug cartels. Maybe something about seeing body parts (theirs, their families', and their friends') scattered in public places made them reconsider.
User Rank: Apprentice
3/14/2013 | 4:38:51 AM
re: China Hack Attacks: Play Offense Or Defense?
I don't think it's one or the other. It's both at the same time. You should absolutely have the lasted patches, virus definitions, firewall defenses, etc. in place. That is a fundamental part of IT's job in any company. But there needs to be a much better offensive component as well. If there is no penalty for the attacker other than they just didn't get any data (because of good defenses), there is no deterrent for future attempts. We need specialized law enforcement groups that actively counter hack threats. I also like the idea in another comment of licensed privateers that are hired to go after specific targets.
User Rank: Apprentice
3/14/2013 | 4:42:57 PM
re: China Hack Attacks: Play Offense Or Defense?
Espionage is an older human profession and pasttime than prostitution. In fact, the Garden of Eden story is about a God spying on an Adam and Eve as they tried to hack the Tree of Knowledge!
And so, the distinction between offense and defense in this "game of life" is as relative and moot as the illusory distinction between good and evil itself. It all depends on viewpoint of the side you are presently playing for.
The simple premise is that if you have something worth protecting, you will have to protect it. And if you hire a CFO or a Guardian Angel that is stupid enough to follow a phishing link in an email, then you probably aren't very good at protection and you deserve to get hacked.
Page 1 / 2   >   >>

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-10-02
In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
PUBLISHED: 2022-10-02
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
PUBLISHED: 2022-10-01
SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete.
PUBLISHED: 2022-09-30
### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end use...
PUBLISHED: 2022-09-30
Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service.