There is a new twist on the DDOS (distributed denial-of-service) attack vector which has been used for taking down servers on the internet.

This newest version sends data packets targeting memcached software that is utilized on many servers.

Now an article in thehackernews.com describes a possible solution to this form of attack. Paragrah 5 in the article 'Kill Switch' to Mitigate Memcached DDoS Attacks — Flush 'Em All (available here) says that

However, the good news is that researchers from Corero Network Security found a technique using which DDoS victims can send back a simple command, i.e., "shutdown\r\n", or "flush_all\r\n", in a loop to the attacking Memcached servers in order to prevent amplification.

This solution would essentially amount to sending commands back to the server that is attacking your server.

I have a couple of questions I would like to ask about this:

  1. Are there laws in USA against attacking a server that is attacking your servers?
  2. If such laws exist, do they include attacks executed by humans or would it be legal for a "self-defense" bot to autonomously undertake such attack?
  • 1
    I suspect that 18 U.S.C. § 1030 would be applied here, even in the case of self-defense. However, I couldn't find any specific examples of the CFAA being applied to a case like this, much less the outcome of such a case. – phyrfox Mar 13 '18 at 9:00
  • 1
    I believe there were talks about creating "hack back" laws which allowed entities to attack in self defense. theregister.co.uk/2017/10/13/us_hack_back_law – Digital fire Mar 13 '18 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.