This Labrea thing is basically a pile of poop. So the system crashes. The admin reboots it, and life goes on (sans patch, with infection). Plus there is the legal issue, you are intentionally trying to mess up a remote systems ability to work, and while yes the "attacker" is liable you are now taking actions that also make you potentially liable (not a good thing if it can be avoided). Attacking back is often a very bad idea. Kurt Seifried, kurt@seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/security/

Actually, I think the idea is to keep the infected system busy for as long as possible, so that it wastes time dealing with one box that it would otherwise spend messing with thousands and thousands of other systems. And it does zero configuration changes to the machine that hits it. If the infected machine does happen to crash, one can always hope that the admin will take it as a prompt to scan for virii and worms.

This may or may not work for existing worms, and newer worms will probably take it into account.

For the admin of the infected machine, he can come in in the morning and thank god his box hit somebody running LaBrea, because that means his machine only hit a hundred other systems instead of ten thousand.

Er. yeah. Potentially the box has now crashed. Because of your system. Not something I wanna get be potentially liable for.

Bear

-Kurt

No, his box crashed because he was allowing it to engage in illegal activity.

You may want to take a business class that deals with liability.

I have a right to do anything I want with a malicious connection made to my machine, EVEN sending it a ton of viri, but Labrea does not do that, it just keeps on hanging on.

No, no you do not. While there are laws regarding things like home intruders and the use of deadly force for example in some countries there are no laws AFAIK making it ok to attack people back online. IF you know of laws allowing such behaviour in a country I would love to know about it.

You have perhaps a more effective solution?

Yes. firewall it. Do not send anything back.

J.Andersen

-Kurt

On Sun, 23 Sep 2001, Kurt Seifried wrote:

...

I have a right to do anything I want with a malicious connection made to my machine, EVEN sending it a ton of viri, but Labrea does not do that, it just keeps on hanging on.

Any you want to fix your broken mailer do not break quoting with senseless line wraps.

While there are laws regarding things like home intruders and the use of deadly force for example in some countries there are no laws AFAIK making it ok to attack people back online. IF you know of laws allowing such behaviour in a country I would love to know about it.

Heck, if his systems are in the process of flooding mine, I can hold them. Assuming the LaBrea.README is true, all the thing does is set up tarpits on unused IPs via ARP spoofing on "request". These tarpits supposedly send a SYN|ACK packet in response to a SYN packet, and ignore the rest of the conversation until it times out.

...

You have perhaps a more effective solution?

Yes. firewall it. Do not send anything back.

Oh. Very effective if you don't know who's the next to toss out the worm again. Very useful if you have a web server up and running. </IRONY> Seriously, LaBrea does not send spamloads back or something, it just accepts the connection from the scanner. I cannot see how that would be illegal. No-one says you must not lie to the scanner. BTW, for Germany, see §§ 32, 34, 35 (Title IV) of the Strafgesetzbuch (Penal Code), a translation of which is available at http://wings.buffalo.edu/law/bclc/germind.htm - German text (claimed up-to date) for example at http://dejure.org/gesetze/StGB/32.html I cannot see how LaBrea would be unlawful in Germany. The "attacker" is free to abort the connection at any time and advance to the next "victim". However, sending things back may be considered sabotage if it breaks the box, and this breakage may outweigh the gain, particularly if the own systems are not susceptible to the virus that is replied to with "crash code".

Yup,

On 23-Sep-01 Kurt Seifried wrote:

...

...

No, his box crashed because he was allowing it to engage in illegal activity.

You may want to take a business class that deals with liability.

...

I have a right to do anything I want with a malicious connection made to my machine, EVEN sending it a ton of viri, but Labrea does not do that, it just keeps on hanging on.

No, no you do not.

While there are laws regarding things like home intruders and the use of deadly force for example in some countries there are no laws AFAIK making it ok to attack people back online. IF you know of laws allowing such behaviour in a country I would love to know about it.

...

You have perhaps a more effective solution?

Yes. firewall it. Do not send anything back.

$0.02:

if I may jump in here - without any intention to prolong the discussion about paragraphs and legit/illicit active responses to attacks - Nimda exploits bugs in an operating system (Win), and its effectiveness stems from bugs brought to you by Microsoft, from things like ignorance, misinformation or just laziness from admins and/or from home users who don't care much for their system's health. Patches are available, antivirus tools are available, too, people running vulnerable Win installations just need to read a thing or two and can then proceed to update their systems in order to be safe from Nimda, Code Red and its relatives. A matter of information, as usual.

By counterattacking Nimda/Code Red-infected boxen you will gain nothing, just another down'ed box, several aggravated admins/users, a possible law suit and more bits of fun. The key is information about Nimda, about MS bugs and how to plug these holes; counterattacking is counter-productive, as it may put

I have to agree with Boris. I also have to add that it really isn't a counter strike, but just a net bogger. If it were to be a counter attack one would at least have to attack. Since nobody knows who wrote the virus and nobody knows anyone who is helping the person(s) who wrote the virus at this moment unless they have been caught already; then any measure against an organization who has been comprimised is not the honorable thing to do. If the organization wrote the virus or had something to do with the fact that it exists, this is a different story. Hince the reason my nation is going to retaliate against those who have caused unjust pain and death, or those that have supported the agenda of those who have. Don't attack the perpetrated. Attack the perpetrators. The authorities will take care of these individuals. Attacking other people that are not criminals is not the answer. May God Be With America. USA! Wade Chandler Metro IT Solutions Lead Programmer http://www.metrotriad.com/wchan http://www.metrois.com wade.chandler@metrois.com 336-725-1621 Ext. 1015 ----- Original Message ----- From: "Boris Lorenz" To: Sent: Monday, September 24, 2001 3:55 AM Subject: Re: [suse-security] Is it possible to return something, so Nimda the

focus on your attacks, not the very problem itself: The virus/worm.

Counterattacks are like Aspirine - they cure your personal headaches, but do nothing good to the system. It's protection of systems we're talking about in here, not destruction.

...

...

J.Andersen

-Kurt

Boris Lorenz ---

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

crash a box is never a good thing. but there is a simpler (?) way I'm very newbie in firewall use and an't do that myself, but I beg it's easy to get the firewall send a message to the offending machine administrator "you are sending worms" I sometime do that manually, but it's a pain. I think if an admin receive thousands of such letters, he must feel concerned? and such mail seems perfectly legal. jdd -- http://www.dodin.net mailto:jdanield@dodin.net WHO'S THAT GUY ? Help me found it Russia & South america help needed http://www.dodin.net/serge/index.html

It is clearly stated in American law at least that "Self Defense" is only applicable in circumstances where there is a "Reasonable cause for bodily injury". This doesn't mean injury of personal possessions. Therefore, if you had to go to court over this, you wouldn't have much legal ground to stand on. So I'd be very careful before implementing any type of script to exploit Nimda's vulnerabilities. Especially considering that, under American law, you could be prosecuted just as equally as the person that wrote the virus originally. Just some thoughts. -Mike Reaves ----- Original Message ----- From: "Alexey N. Solofnenko" To: Sent: Sunday, September 23, 2001 2:06 PM Subject: RE: [suse-security] Is it possible to return something, so Nimda would crash?

Maybe this is the best way to handle it, because usually people do not know if their computers are infected. I think it is possible to write root.exe or default.ida script that will send increasingly rude messages back to webadmin every week the script gets a hit.

Sincerely, Alexey Solofnenko. _____

< http://members.home.com/asolofnenko/ > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually)

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Hi,

first in other countries you may prevent any illegal action against yourself and others with *reasonable* meassures under the "selfdefense" regulations.

But in the case of LaBrea you do not do anything against the other computer. It is more like your neighbour allways parks his car in your garage and you make the entrance smaller so that your car will still fit in but his car will not. I do not think you have to pay for the demages on his car if he again tries to illegally park his car in your garage.

Claiming ignorance ("I didn't know Labrea would crash his PC") will be tricky as in many courts with a civil suit you have to prove your innocence. None of this "beyond a reasonable doubt" stuff/etc as with a criminal case. I wouldn't want to be on the receiving end of a fortune 500 companies lawsuit after all their web servers or whatever got hosed by my machine. Try to remember here, these attacks are NOT intentional. This is a Socual/Policy issue, NOT really a technology issue. Anyways I'm done on this topic for now. BTW analogies suck. This is nothing like car parking/trespassing.

mike

-Kurt

On Sun, 23 Sep 2001, Kurt Seifried wrote:

Claiming ignorance ("I didn't know Labrea would crash his PC") will be

I wouldn't want to be on the receiving end of a fortune 500 companies lawsuit after all their web servers or whatever got hosed by my machine. Try

OTOH, claiming ignorance does not protect them either, particularly not if Nimda hits them while Code Red & Co. had so much unfortunate publicity recently. However, just discarding excessive logs is usually the most time-saving response if some virus plays with your longanimous Apache httpd ;)

On Mon, 24 Sep 2001, Thomas Michael Wanka wrote:

the problem with this long logs is that maybe less experienced admins will have problems processing them with a little script befor they are fed to their favorite loganalizer. If I would be a hacker, I

Their business. But it's also their business to install patches as they are available, and I'd really like to see penal codes extended to prosecute careless admins who don't install security patches in a reasonable time. Aid to Computer Sabotage or something.

On Monday 24 September 2001 12:02 pm, Alexey N. Solofnenko wrote:

Is it possible to retrieve administrator's email address from IIS? Or there is always a standard admin address.

No, it provides nothing that I could get to. I tried a couple times emailing the administrator, security, abuse and all the other usual addresses. The problem is that although IIS is installed by default on Win2K boxen, an SMPT package is not (automatically) installed. So you can't even email root at bad.ip.number. -- __________________________________________ J.Andersen

On Sunday 23 September 2001 10:21 am, Mike Reaves wrote:

It is clearly stated in American law at least that "Self Defense" is only applicable in circumstances where there is a "Reasonable cause for bodily injury". This doesn't mean injury of personal possessions.

Interesting you can state this with such pontifical certaintee, considering American law is composed of massive amounts of federal law, 50 disparate bodies of state laws and thousands of local laws. Thats some impressive law degree you have there. Your assertion that I can not act to protect my property is simply not the case. That every person must stand aside and let the arsonist burn their house is totally absurd, and not the law anywhere with the exception perhaps of Massachusettes. Still, your arguments are totally off base, in that LaBrea does no more damage than leaving the phone on the table rather than hanging up when the pestering salesman calls, leaving him to pay the long distance charges. -- __________________________________________ J.Andersen