FireEye Denies the ‘Hack Back’ of the Chinese Hacking Group

According to the new book published by David Sanger, it would seem that the company called Mandiant, currently owned by FireEye, used ‘hack back’ technique during the unmaking of Chinese hacking group known as Unit 61398. The hack back supposedly occurred back in 2013, and the researchers managed to hack into the original hackers’ webcams. FireEye denies these allegations.

A cybersecurity reporter for The New York Times by the name of David Sanger has recently published a new book called The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age. According to the book, while the reported collected the information about the book, he witnessed a hacking attack by China’s hacking group called Unit 61398.

Sanger describes the experience as ‘remarkable’, but the part that caused a large controversy comes after that, where he claims that Mandiant’s researchers used a technique called ‘hack back’ to hack into the attackers’ webcams.

The technique basically includes the use of the network to reach the computers that are attacking someone else. Not only is this very unsafe and unwise, but some go as far as to call it ‘the worst idea in cybersecurity’.

Because of the unsafe nature of the technique, there has been a lot of debate regarding Mandiant researchers’ actions. After discovering the claim, FireEye denied that their researchers ever did such a thing, or that they managed to gain access to hackers’ webcams. According to the company, the researchers only followed standard procedures regarding the forensic investigation of the Unit’s attack.

The firm continued to claim that their researchers did not perform hack back technique, neither on this or any other occasion. They also commented on the book, and stated that the claims provide within its pages are likely a result of the author misunderstanding the consensual network monitoring. In other words, the author supposedly only witnessed company’s videos on various protocols regarding the earlier attacks, but not live to monitor of what the hackers were doing.

Richard Bejtlich, the company’s previous chief security officer also claimed that the company never approved of, or performed the activities described in the book. According to him, performing hack backs is against the company’s policy , and the researchers would never perform such acts. He even claimed to have contacted his old team, which had no knowledge of any such activities performed by the other researchers.

As a response, a lot of individuals tweeted that Sanger couldn’t have misinterpreted seeing leather jackets that he describes. According to them, the author either completely made up the story, or he witnessed it first-hand, there cannot be anything in-between.

Some believe that the hack back did occur and that the insight gained by the event allowed the US government to criticize Chinese military hacking more vocally. This theory gathered a lot of strength, considering that FireEye is known for being close to the US government.

One interesting thing includes the last year’s bill that the US Congress introduced, in which they basically allow the hacking victims to go on the offensive in case of hacking . Individuals and companies alike have the permission to perform the hack back if they are trying to disrupt the attack, monitor it, or destroy the files that were stolen from them.