There is a new twist on the DDOS (distributed denial-of-service) attack vector which has been used for taking down servers on the internet.
This newest version sends data packets targeting memcached software that is utilized on many servers.
Now an article in thehackernews.com describes a possible solution to this form of attack. Paragrah 5 in the article 'Kill Switch' to Mitigate Memcached DDoS Attacks — Flush 'Em All (available here) says that
However, the good news is that researchers from Corero Network Security found a technique using which DDoS victims can send back a simple command, i.e., "shutdown\r\n", or "flush_all\r\n", in a loop to the attacking Memcached servers in order to prevent amplification.
This solution would essentially amount to sending commands back to the server that is attacking your server.
I have a couple of questions I would like to ask about this:
- Are there laws in USA against attacking a server that is attacking your servers?
- If such laws exist, do they include attacks executed by humans or would it be legal for a "self-defense" bot to autonomously undertake such attack?
