sb-as logo
Story image

Expert says Germany’s ‘hack back’ proposal is a slippery slope

09 Oct 2017

Late last week German intelligence officials urged lawmakers to grant them more legal authority to ‘hack back’ in the event of international cyberattacks.

This comes in the wake of various attacks, including the May 2015 hacking of the German lower house of parliament, the Bundestag, which German officials blamed on APT28, a Russian hacker group that is said to have ties to Moscow.

Head of the BfV domestic intelligence agency, Hans-Georg Massen proclaimed to the parliamentary oversight committee that they should be legally equipped to destroy data that is stolen from German servers and moved to foreign servers – thus preventing cybercriminals and foreign powers from misusing it.

In a similar way to which human agents are used for counter-espionage, Massen argued it would be logical to ‘infect’ foreign servers with software that would then provide for improved visibility and surveillance of any malicious operations targeted against German cyber targets.

“In the real world, it would be like turning a foreign intelligence agent and getting them to work for us ... Something like this should be possible in the cyber world too,” Maassen told the committee in its first public hearing.

“These are ‘hack back’ instruments, but they are below the threshold of destroying or incapacitating a foreign server,” Maassen said.

CEO of web security company High-Tech Bridge, Ilia Kolochenko says while at first glance a hack back concept sounds fair and reasonable, he believes it may be a slippery slope as in the digital world the counterattack principle may be very different from its common notion.

“On the Dark Web, one can easily purchase access to hacked systems of governments, law enforcement agencies and police. Cybercriminals and nation-state actors may just buy compromised systems of their rivals andup them,” says Kolochenko.

“Afterwards, genuine attackers will use an alleged breach as an excuse for well-prepared attacks on their victims. Legal questions intertwined with the hack back are much less complicated compared to practical problems we may face.”

Kolochenko asserts the solution needs to be approached with care.

“Therefore, we should rigorously conceptualise and analyse the hack back principle with the game theory in mind. Otherwise, we will unavoidably create a parade of horrors detrimental for all civilized states."

Germany’s BND chief, Bruno Kahl told the committee that its foreign intelligence agency already has the expertise to destroy foreign servers, but lacks the legal authority.

However, Kahl says at the end of the day, such decisions have to be made by politicians.

Story image
Five things ANZ businesses should know about storing customers’ data
Businesses need to correlate events intelligently across multiple threat surfaces, application layers, and time spans to connect event A, to event B, to event C — even if they are months apart.More
Story image
Users becoming more savvy with COVID phishing scams
“With COVID-19 being around for over a year now and employees becoming more aware of the types of scams that have come out related to the pandemic, cyber criminals are having less success with related phishing attacks."More
Story image
New wormable Android malware discovered through auto-replies in WhatsApp
Check Point Research has discovered new malware on Google’s Play Store that could spread through WhatsApp messages. More
Story image
ABB and Nozomi Networks extend collaboration, deliver improved OT security solutions
"With Nozomi Networks solutions added to our cybersecurity portfolio, our customers gain proven network monitoring and threat detection technology."More
Story image
Kroll completes Redscan acquisition, expands cyber risk portfolio
With the addition of Redscan and its extended detection and response (XDR) enabled security operations centre (SOC) platform, Kroll expands its Kroll Responder capabilities to support a wider array of cloud and on-premise telemetry sources.More
Story image
rhipe acquires emt Distribution, with aim to expand into enterprise market
The acquisition will enable rhipe to deliver a comprehensive portfolio of end-to-end security capabilities to its partners, the company says.More