Attribution of cyberattacks is getting easier, but we’re still bad at the next step: retribution. A case in point is Brian Krebs’s clever investigation of a new antivirus company, Anvisoft. He offers compelling reasons to believe that Anvisoft is run by a notorious Chinese hacker who helped attack a DoD contractor and others several years ago, according to an iDefense report. The hacker, Tan Dailin, is pictured on the right.
If Brian’s suspicions are correct, this is a great case for retribution. After all, Anvisoft is offering its software for download in the United States. The company has subjected itself to US jurisdiction, and it probably needs the US market if it’s going to succeed globally. This is an opportunity for the US government to demonstrate that hacking US companies isn’t something we’re likely to forget or forgive. Indeed, if the government were taking foreign government hacking seriously, it would already be investigating Anvisoft.
To be a bit more pointed about it, where the hell is the Federal Trade Commission when we need it? It sure sounds like consumer fraud for an anti-US hacker to try to sell security software to Americans while hiding his past.
Of course, the FTC is resource constrained. But it’s spending boatloads of money litigating with Wyndham Hotels, claiming that the hotel chain didn’t do enough to keep hackers from breaking into the hotel network and stealing credit card numbers.
Jon Leibowitz, call your office. Given a choice, I think we’d all be happier, and safer, if you devoted your scarce enforcement resources to investigating the perpetrators of crime before suing the victims.