sb-au logo
Story image

Expert says Germany’s ‘hack back’ proposal is a slippery slope

09 Oct 2017

Late last week German intelligence officials urged lawmakers to grant them more legal authority to ‘hack back’ in the event of international cyberattacks.

This comes in the wake of various attacks, including the May 2015 hacking of the German lower house of parliament, the Bundestag, which German officials blamed on APT28, a Russian hacker group that is said to have ties to Moscow.

Head of the BfV domestic intelligence agency, Hans-Georg Massen proclaimed to the parliamentary oversight committee that they should be legally equipped to destroy data that is stolen from German servers and moved to foreign servers – thus preventing cybercriminals and foreign powers from misusing it.

In a similar way to which human agents are used for counter-espionage, Massen argued it would be logical to ‘infect’ foreign servers with software that would then provide for improved visibility and surveillance of any malicious operations targeted against German cyber targets.

“In the real world, it would be like turning a foreign intelligence agent and getting them to work for us ... Something like this should be possible in the cyber world too,” Maassen told the committee in its first public hearing.

“These are ‘hack back’ instruments, but they are below the threshold of destroying or incapacitating a foreign server,” Maassen said.

CEO of web security company High-Tech Bridge, Ilia Kolochenko says while at first glance a hack back concept sounds fair and reasonable, he believes it may be a slippery slope as in the digital world the counterattack principle may be very different from its common notion.

“On the Dark Web, one can easily purchase access to hacked systems of governments, law enforcement agencies and police. Cybercriminals and nation-state actors may just buy compromised systems of their rivals andup them,” says Kolochenko.

“Afterwards, genuine attackers will use an alleged breach as an excuse for well-prepared attacks on their victims. Legal questions intertwined with the hack back are much less complicated compared to practical problems we may face.”

Kolochenko asserts the solution needs to be approached with care.

“Therefore, we should rigorously conceptualise and analyse the hack back principle with the game theory in mind. Otherwise, we will unavoidably create a parade of horrors detrimental for all civilized states."

Germany’s BND chief, Bruno Kahl told the committee that its foreign intelligence agency already has the expertise to destroy foreign servers, but lacks the legal authority.

However, Kahl says at the end of the day, such decisions have to be made by politicians.

Story image
CrowdStrike integrates with ServiceNow program to bolster incident response
As part of the move, users can now integrate device data from the CrowdStrike Falcon platform into their incident response process, allowing for the improvement of both the security and IT operation outcomes.More
Story image
High-tech heist: why fending off ransomware attacks is more challenging than ever in 2020
The COVID-19 crisis has unleashed a wave of sophisticated and disruptive ransomware attacks, and the onus is on businesses to ramp up their security measures if they’re to avoid falling victim, writes Attivo Networks regional director for A/NZ Jim Cook.More
Story image
Kaspersky releases new report on consumer’s approach to digital services
COVID-19 related restrictions and the necessity to stay indoors has influenced the way people approach digital services, making them more aware of how securely both they, and their housemates, use the internet.More
Story image
Plugging the gaps: Australian organisations are leaving their defence barriers wide open
Cybercriminals are are walking through the gaping holes in Australia’s organisational defences – gaps that leadership teams don’t even realise are there.More
Story image
Report: Rushing into cloud migration directly related to security issues
A new report from Radware highlights the impact of COVID-19 on organisations compelled to digitally transform in order to maintain business continuity. More
Link image
Webcast series: The necessary tools to secure a remote workforce
Experts from across the A/NZ region discuss the best security practices in a remote working world - with sessions available on the first Thursday of every month.More