Opinions

Many people fear them, but most hackers are no more than simple point and click operators (the basic script kiddie) that are incapable of anything but using tools created by others.

Like any other software developer, those who do create the tools being used by the script kiddies are not immune to coding errors and poor development practices. In a presentation at RSA 2008 by BitSec researcher Joel Eriksson, demonstrated a practical example where a 'white hat' hacker was able to utilise weaknesses in a 'black hat' tool in order to counter-hack the attacker's system. Even with updates to the hacker's tool, there were significant weaknesses that remained which allowed Eriksson to continue to access the systems of those who were using the tool actively.

This concept is one that is beginning to gain traction amongst researchers, with a number of Web security experts looking at different methods to identify and potentially attack the system that is launching an attack against a site or local system.

As the techniques in use are not overly complex (they are a lateral application of existing, logical functionality), it will only be a matter of time before there are tools readily available to automate the process of 'reverse-hacking'.

Introducing the ability to identify the source system, even through a network of proxies and local networks, when the attack is underway, is an opportunity that will be extremely valuable for later reconstruction, forensic analysis, and possible prosecution -- once the tools are designed and built.

While the techniques that are being discussed at the moment are focussing on the enumeration and discovery of where and what is launching an attack, it doesn't take much to theorise an active defensive system that neutralises the attack platform.

Although this process is bound to be fraught with legal uncertainty and danger, it poses an ethical problem for the white hat -- do they take the opportunity to neutralise the problem when it is first identified, given that they are now reaching beyond their network perimeter and directly affecting another system (bound to be illegal in most jurisdictions), or do they ignore the capability that they have recently developed, and the attacker continues on without fear of reciprocation?

Even if most researchers do not implement the capability to attack, there will be those who do write tools with such capability and they will be readily available for those who want them.

The techniques being described at the moment are dependent on the attacker's system providing the default responses to queries being made of it. With increased knowledge that reverse probing and attack is possible, the arms race will continue and there will be greater use of response customisation by skilled attackers to redirect attention to innocent systems.

As with most crime, the skilled and careful attacker will continue to evade detection and capture. What is now being looked at is another set of tools to identify and capture the lesser skilled.