IT Employment

Ask something
Discussion Locked

Moral Implications of CounterAttack

0 helpful
2 replies

by itblackbelt

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Time to test the water out there...

SITUATION: A machine is executing ongoing script-based attacks on your network servers.

You know, by analysis of the traffic hitting your servers from the machine that it is infected with "X". You also know that machines infected with "X" have given full control to anyone on the Internet who knows how to take it.

This attacker is significantly degrading your Internet capabilities as a businessand your livelihood.

The machine's owner has been notified and has failed to take appropriate action to stop the attacks (Within 24 hours).

SOLUTION? Use the established security hole in the machine to set it to automatically shutdown on every boot-up and then issue a shutdown command to the machine (effectively removing it from its ability to attack you and impded your businesses success.

Would this be protecting your business, or lowering one's self to the level of the person who compromised the server in the first place? Where do you stand?

2 replies

by generalist

It is a hard ethical question.

It would be best if you had the appropriate authorities do the job. They could collect enough data to prove that there is a problem and then temporarily shut down the problem.

Of course, there may not be an 'appropriate authority' that can respond fast enough at this time. We may need a rapid response web organization to handle such things if the problem becomes a lot more common.

Barring the appropriate authorities, documenting the attack and then doing a limited strike would be in the grey zone of ethical. If the strike just kept things shut down and was recoverable, you would be on the 'good' side of the grey zone. If you also notified the authorities and provided them with hard evidence of what was happening and how you did it, you would still be on the 'good' side, but you might be in danger of using 'excessive force' in a response.

If your response was to 'nuke' their machine so that nobody could recover from it, you're dropped downto their level.

by admin

You've got one identified machine attacking you? Why not just block it. It's non-intrusive, a good defense, and you're not going to lose much.

This discussion is closed to new replies.