Copyright 2002. Published in the Proceedings of the IEEE International Symposium on Technology and Society (ISTAS), Raleigh NC.

USA, June 2002. Personal use of this

material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or
redistribution to servers or lists, or to reuse any copyrighted component of this work in other works, must be obtained from the IEEE. Contact: Manager, Copyrights and
Permissions / IEEE Service Center / 445 Hoes Lane / P.O. Box 1331 / Piscataway, NJ 08855-1331, USA. Telephone: +Intl. 732-562-3966.

Internet Hack Back:

Counter Attacks as Self-Defense or Vigilantism?

Vikas Jayawal* William Yurcik** David Doss*

*Illinois State University
{vrjayas,dldoss}@ilstu.edu
**University of Illinois at Urbana-Champaign
[email protected]

Abstract compromised systems remotely controlled by servers, all

of which provides attack anonymity. The compromise of
The poor state of security on the Internet calls for more innocent systems occurs through the means of a hacker
effective ways to protect networked systems from attacks. releasing a seemingly benign program. An unknowing
One solution is to be able to counter attack with offensive user installs a program that infects his/her computer and
capabilities. With attacker information available, provides a backdoor to their computer for the future use
companies find themselves in a dilemma – counter attack of the hacker.
for immediate self-defense, retaliate for future deterrence, While Internet attacks are using more sophisticated
inform the appropriate law enforcement authorities, or do tools, system administrators: (1) are overwhelmed trying
nothing. We examine justification for the hack back self- to keep up with patches to known vulnerabilities; (2) are
defense and deterrence arguments in the context of too busy or unable to recognize if their systems are
current technology and legal framework. This paper compromised; and (3) barely able to understand the
extends discussion of issues surrounding using offensive complexity of their systems [2]. Automated scripts are
capabilities for defensive purposes to the now identifying and compromising vulnerable systems
civilian/commercial Internet context beyond information and covering their tracks all in a matter of seconds per
warfare. system. At the same time, DDoS networks of thousands
of compromised systems (zombies) can target a particular
system or network and disable it for a couple of hours to a
1. Introduction couple of days.
One solution is the ability to counterattack with
Computer systems today are under an inprecedented offensive capabilities. There are clear indications that
threat from Internet attacks from “hackers”.1 Attacks can Internet security is shifting beyond passive firewall
be launched from virtually anywhere in the world and the protection to a more active defense [9]. About two-
impact level of attacks are larger. This situation calls for thirds of one vendor’s customers are looking for ways to
effective ways to protect networked systems from attacks. gain leverage over attackers including tracing, trapping,
One example is the number of recent Denial-of- and counterattacking; “I’m not sure about fighting back in
Service (DoS) attacks against high profile E-commerce terms of counterattacking, but in terms of defending
companies such as Yahoo and E-bay. These attacks are yourself we’re just beginning to scrape the surface of
characterized by large amounts of traffic which overload defensive measures and tools.” Ruth Lestina, Predictive
a victim site and can be coordinated from multiple Systems [8]
sources (distributed DoS or DDoS). Tracing a DDoS The timing of the decision to hack back is crucial with
attack can be extremely difficult as a result of the nature the mobility of the attacker and economic losses
of the attack. The attacks are launched from systems mounting. In addition, since September 11 2001, an
across the Internet unified in their efforts or by Internet attack may actually be considered a terrorist act
or an act of war.
The Pentagon’s current passive policy of prohibiting
1
While acknowledging the distinction between the original term the U.S. military from mounting a counterattack was
“hacking” to denote an appropriate application of extraordinary criticized by a 1999 report issued by the National
ingenuity such as writing clever computer code and the term “cracking” Research Council (NRC) stating it may result in “severe
referring to accessing protected computer systems without permission, consequences for U.S. military capabilities” [6,14]. Under
this paper uses the term “hackers” as in common usage which is
unfortunately a negative connotation for “someone who breaks into this policy, the U.S. military can only track Internet
computer systems without authorization.” attacks and when the attacker is identified must transfer
the responsibility of prosecution to law enforcement 2. Technology
officials. Both [21,22] show how maintaining a credible
ability to use force on the Internet is lawful and a
2.1. Traceback
fundamentally important aspect of deterrence.
There have been two documented accounts of hack
While in the past companies may have taken weeks or
back incidents. The first documented hack back occurred
even months to trace an attacker, recent technological
in September 1998 when the Pentagon reacted to a
traceback capabilities seek to identify the course of an
browser-based denial-of-service attack by the Electronic
Internet attack within seconds. It is generally too late if
Disruption Theater (hactivist organization) by using
an attack is already impacting a system or has stopped.
offensive applets to shut down the attacking browsers
Systems in this position have no recourse but to filter
[13]. However, this offensive strike against hackers was
attack packets and try to reconfigure their system in real-
against a military prime directive which forbids the
time. Without effective intrusion source tracing, no
military from taking unilateral actions within the U.S. and
effective countermeasures such as containment,
against U.S. citizens and was unapproved by Pentagon
redirection, or back-hacking can be implemented. The
lawyers since the net effect is that both attacker (original
attacker can log-in through a series of hosts (chained
DoS) and victim (back-hacking) broke the law.
connections) before attacking the eventual victim, making
The second documented hack back happened during
it extremely difficult to traceback the real source.
the World Trade Organization (WTO) summit in January
Therefore, the reason for lack of active back-hacking at
2000. The WTO server hosted by Conxion Inc. (of San
present is the lack of source tracing but this is changing
Jose CA. USA) was hit by a denial-of-service attack
rapidly.
launched by the self-proclaimed Electrohippies (E-
The fundamental problem is that most Internet attacks
hippies), a U.K.-based online activist group. Conxion
are very short which leaves very little time for traceback.
traced the IP trail directly back to the E-hippies server
Manual intrusion source tracing in Internet is extremely
and read postings encouraging E-hippies to mail-bomb
difficult, if not impossible, yet most current intrusion
the WTO. Instead of filtering these incoming packets at
detection systems have left traceback untouched and
the router in a typical defensive firewall tactic to stop
primarily a manual effort. Most computer emergency
denial-of-service attacks, Conxion redirected the mail
response teams (CERTs) make little or no effort to
bomb packets back to the E-hippies server disabling it for
traceback an attack to the source once an intrusion has
several hours. Conxion was so proud of its defensive
been reported to them (usually they traceback one hop to
tactics that it issued a press release [8].
identify zombies used in the attack). The remainder of
A typical counterattack would be to cut off the attack
this section summarizes current traceback research.
as close to the source as possible by contacting relevant
Firewalls or intrusion detection systems have the
Internet Service Providers to filter specific packets once
capability to capture all incoming IP addresses (in a
these packets are identified. A counterattack designed
revolving storage) that can be used to start a trace. The
especially for deterrence may consist of the following:
problem is that most Internet attacks are not direct but
sending a “message” to the identified attackers that you
instead come indirectly from other compromised
detect an attack, you do not welcome the attack, you
computers owned by innocent and unaware participants.
know the identity and virtual/physical locations of the
Thus tools are needed to untangle an attack path back to
attackers, and if you attack us again you will be
the ultimate IP packet source given indirect, spoofed, and
prosecuted.
encapsulated packets coming from compromised
The remainder of this paper examines the use of
computers. If all Internet Service Provides (ISPs) were to
back-hacking in more depth and is organized as follows:
coordinate mechanisms for preventing IP source spoofing
Section 2 describes the state-of-the-art in technology that
(which is technically possible) then IP traceback or
determines available hack back options. Section 3
source identification would be solved but unfortunately
outlines the major problems with a hack back option.
this is not the case and may never be the case.
Section 4 speculates on social ramifications of
While there has been work focused on detecting DoS
legitimizing hack back. Lastly we close with a summary
attacks and mitigating their effects upon the victim, these
and conclusions in Section 5.
approaches do not eliminate the problem or deter
potential attackers. However, there have recently been a
number of technical papers attempting to solve the
problem of tracing the physical source of a DoS attack.
Knowledge of the source of a DoS attack via a traceback
capability has the possibility to both deter and eliminate
DoS attacks altogether with prosecution and/or counter- from other uncompromised routers and hence subvert the
attack. destination machine’s path reconstruction. Even worse,
ISPs typically manage and monitor their networks the destination machine will not be able to tell a router is
from a centralized network management system. DoS compromised just from the information in the packet it
attacks would manifest themselves as unexpected receives. [16] addresses this problem with a
increases in traffic based on long-term trend analysis. [5] computationally efficient authenticated marking scheme
proposes an SNMP MIB (Management Information Base) that preserves traceback integrity such that even a
variable be created so standard network management compromised router cannot forge or tamper markings
tools could track DoS attacks by querying the MIB status from other uncompromised routers.
within devices. ISP UUNET proposes an IP tunnel
overlay network for logging “interesting datagrams” 2.2. Current “Anti-Hack” Products
directly to a mesh network of special tracking routers
[17]. This solution, referred to as CenterTrack, may be First note when marketing products with counterattack
feasible for a single provider’s backbone network but has capabilities, the term “anti-hack” is used as opposed to
high storage and processing overhead. The MCI Security “back-hack” for liability reasons. While security vendors
Team uses a program to detect DoS attacks that starts on would not publicly recommend a counterstrike using their
border router and propagates to neighboring routers until product, privately they boast that their product has
the source of a DOS attack or the bordering ISP is significant retaliation capabilities that, if used correctly,
identified [5]. can have devastating impact.
While network routers can be used to reconstruct a Some Linux products, as well as FreeBSD, ship tools
packet’s path through the network if detailed logging is that can be used to counterattack such as Trojan horses
enabled (and the logs themselves are not attacked and (hidden executable programs) and port scanners.
erased), packet marking is viewed as a form of “stateless However these tools can also be very dangerous if
logging” greatly reducing the amount of overhead misconfigured or directed at an innocent party.
necessary to traceback. Deterministic packet marking puts FutureVision of Sante Fe New Mexico has unveiled a
source information permanently within each outgoing IP security system it calls Blitzkrieg that is designed to
packet. The significant drawback of this approach is the retaliate against an attacker [11,19]. Blitzkreig is
increasing packet header size requirement that grows installed on a central server from where it places small
linearly with hop count [7]. In probabilistic packet “daughter” programs on machines that are part of the
marking [12] and router stamping [3], each router network it is meant to protect. There are separate
probabilistically inscribes partial path information onto business and military versions of Blitzkrieg: the business
traversing packets during packet forwarding. This version hacks back with a DoS designed to overload the
corresponds to probabilistically “sampling” the attack attacking machine; the military version goes one step
path using a constant packet header, independent of hop further by also launching a virus counterattack in an
count. [7] shows that probabilistic packet marking can attempt to destroy data on the attackers computer.
localize possible attackers to between 2-5 sites given Laurence Wood, Chief Scientist of Network Waffen Und
single source attacks but not under distributed DoS Munistionsfabriken (Network Weapons Munitions
attacks. [20] proposes an active intrusion response Factories subsidiary of FutureVision) and Blitzkrieg’s
technique called “sleepy watermark tracing” which inventor states, “Out internal system exercises show that a
becomes active upon detection of an attack signature to collective Blitzkreig server offensive is similar to an
inject watermarks into a backward connection with attack of a biological killer virus with an overall
collaborating routers along the attack path to traceback to collective objective and agenda” [11].
the source using correlation. Two startup companies, Mazu Networks in Boston
The Internet Engineering Task Force (IETF) ICMP and Asta Networks in Seattle, have proprietary
Traceback working group (itrace) created in March 2000 autodetection software that stops a DoS attack at the ISP
and chaired by Steve Bellovin is considering a proposal level. The Mazu/Asta approach is to detect and contain a
for routers to generate authenticated traceback messages DoS attack before its leaves an ISP and impacts a
(with low probability) to be sent along to the destination destination victim (Ecommerce server) [18]. Since ISPs
[1]. With enough traceback messages from enough can withstand DoS attacks due to large capacity
routers along the path the ultimate IP source and packet backbones (with some degradation of service), then an
path can be reconstructed. There is the possibility that attack can be stopped before it creates a problem. The
some or all traceback messages could follow a different Mazu/Asta approach has two drawbacks: (1) it requires
path from the attack path and be blocked by a firewall or ISPs to purchase their autodetection software at an edge
other policy routing device. There remains the possibility or point-of-presence (POP) router – an extra cost that
that if a router is compromised, it can forge markings ISPs may not feel is justified and (2) identifying the
distinction between attacks and normal traffic based on illegal. Forward-looking retributions are popularly
packet characteristics. One classic example of a DoS associated with self-defense and prevention. But the goal
attack signature is numerous packets simultaneously of prevention also raises the practical question: What
heading to one server but there are legitimate packet means may be employed to prevent (an Internet attack)?
streams that also have these characteristics – website We can imagine stopping Internet attacks in a degree of
contests, streaming media, E-Trade after an unexpected violence that would be excessive and reprehensible. “By
business announcement. any means necessary” is not an adequate answer.
Bindview sells a tool called Zombie Zapper to respond
to DoS attacks. Instead of returning the DoS attack back “If … functioning solely within their own system to
to the closest zombie, it impersonates the “master” of the take preventative action during an attack, there should
zombie and sends an order to those slaves to stop sending be no problem. Rejecting mail is a normal system
DoS packets [10]. Of course an order could also be given administration function. … Returning ‘mail to sender’
does not constitute a crime. … Now if they were
to send DoS packets back at the source. inserting their own mail and sending that back to the
RSA Laboratories is developing a protocol that can be … site, you may have a problem.”
classified as both defensive and offensive in response to a - Chris Malinowski, the retired lieutenant commander
well-known class of DoS attack called the “TCP SYN of the New York Police Department’s Computer
flood connection depletion attack” [4]. A connection Crime Squad [8,10].
depletion attack is one in which the attacker seeks to
initiate and leave unresolved a large number of 3.1. Incorrect Identification
connection requests to a server, exhausting its resources
and rendering it incapable of servicing legitimate A main concern is accidentally slamming innocent
requests. The “client puzzle” protocol under sites through which hackers have routed their attacks to
development does nothing under normal circumstances conceal their identity [8]. This is a problem that will not
but when under attack the server sends each client disappear with advances in technology since it is an
wishing to make a connection a unique client puzzle escalating game between an attacker and the pursuer.
based upon time, server secret, and client request
information [4]. In order to have server resources “My fear is that U.S. government agencies [involved
allocated to it for a connection, the client must submit to in information warfare] will build in react capabilities.
the server a correct solution to the puzzle within a time- A smart hacker will launch a [denial-of-service] attack
out period [4]. Thus while legitimate clients will using those agencies IP addresses and they all start
experience only a small degradation in response time, attacking each other. The worst case is Amazon
attacking clients (loaded with puzzles) will be disrupted. shoots eBay who shoots the IRS who shoots Cisco
Cryptographic puzzle challenge-response protection has who shoots . . . ”
- John Pescatore, Gartner Group Analyst [8]
also been proposed for defending against junk mail.

3. Problems with Back-Hacking 3.2. Liability

There have traditionally been two different Most company executives with fiduciary
justifications for retaliation – one is a backward-looking responsibilities to their stockholders, government
approach and one is a forward-looking approach. The regulators, and attorneys would never expose themselves
backward-looking approach justifies retaliation purely in to civil and criminal charges by allowing counterattacks.
terms of meting out punishment. The idea is that one who In general, if it is illegal for someone to attack you, it is
does harm deserves to suffer appropriate punishment in also illegal for you to attack them. Just because a victim
order to “right the wrong” and restore the moral balance. hack backs an attacker does not make it any less of a
The forward-looking approach justifies retaliation as a crime in the eyes of the law.
means of bringing good consequences such as preventing
“Launching a counterattack is very difficult because
or deterring further violence or (in some cases) reforming
of all the liability issues that come up. …What if the
and/or rehabilitating the wrongdoer. For both approaches attack comes from a boundary outside the United
there is also a requirement to punish only the guilty and to States and I act against it?”
do so in proportion to the crime. - Pete van de Gohm, Director of Information Asset
There is, however, a fine line between reactive Protection at Enron Energy Services Inc. [8]
forward-looking self-defense and aggressive backward-
looking countermeasures. Hack back combines both “Don’t hack back. If you do anything that can be
elements. Backward-looking retributions are popularly perceived as intrusion or denial-of-service and you
associated with revenge and vengeance and strictly
 contact the police, you’ve just made it really easy for electronic trail by examining packets. This can range in
the police to arrest you.” time from several hours to 48 hours. Every hour the
-Ira Winkler, President of Internet Security Advisors security expert spends trying to find the attacker and cut-
Group[8] off the attack is another hour the victim is off the Internet
accumulating huge losses along with a stigma attached to
Following an IP address across the Internet means company stability/reliability. The result is often the
passing through every server the attacker has identification of a zombie used by the attacker but the not
compromised. Since each of these servers is privately the source attacker.
owned you need permission or else you are trespassing. If you do report the crime to the police, be prepared to
In his book, Tangled Web, Richard Power asserts that as show law enforcement that the cost of the crime meets the
far back as 1994 when the U.S. Air Force Research investigative threshold that varies depending on the law
Laboratory in Rome New York was under attack, agents enforcement involved. For this reason, despite the
grappled with tracking attackers through a maze of difficulty you must quantify your loss in monetary terms.
private servers. Unless your company is a large organization –
Anti-hack vendors have considered trespassing when multibillion-dollar company that is publicly traded and
designing their tools but the effectiveness of their tools is frequently in the media – whatever help is forthcoming
questionable. In order to traceback and identify the from agencies like the FBI will take a relatively long time
attacker, traces must occur during a live connection. The especially in “Internet time”. Acting as your own
solution for Recourse Technologies ManHunt product is forensic security analyst can accomplish more in less time
to pass a digitally signed Email message upstream to if qualified staff is available.
predestinated points-of-contact which requests the
recipient to read the mail and respond. Of course this
response and time constraints limit the value of this
4. Future Scenarios
approach. If, however, the upstream service provider
were running ManHunt software already, traces could The effects of legitimizing hack back as self-defense
occur in real-time. can be categorized into two extremes: protected E-
Lastly, the compromised machines or zombies are in a commerce and public access to information versus a
unique position: they are both victims and culprits. The chaotic Wild West scenario.
question is – Are they victims that could have protected In the optimistic scenario, legal hack back provides
themselves? No one appears yet to have sued a third- deterrence and remedy for Internet attacks. Attacks are
party site for being used to perpetrate an Internet attack. not initiated since retaliation is severe and certain.
Because most hackers are presumed to be judgment- Prevention of attacks will rely more on protecting
proof, there is a consensus that it is only a matter of time innocent systems from being used remotely as zombies
before companies that suffer damage from attacks start to than protecting target systems. Legal remedies will exist
“move up the food chain” [15]. The issue in such a suit but will not be frequently used because everything is
would be whether the computer owner had a duty of care handled at the time of attack. Part of this scenario is
to the ultimate victim(s). There have as yet been no test already happening.
cases. In the pessimistic scenario, legal hack back
“Whether there’s a duty depends on whether the encourages vigilante action over legal remedies in an
courts think there should be. As the damage to analogy to the Wild West. Companies protect
others increases, I think courts will have less and themselves using hired gunslingers (Wells Fargo private
less patience for the argument that there’s no security) to hack back at attackers since the law is too
duty…. People hacked into these computers slow and not much of deterrence. Innocent bystanders
using known holes in most cases. If you (zombie computers) are treated as accomplices worthy of
maintain security against known hacker attacks, retribution if their security allows an attack to be directed
then it’s much more difficult to plant the code through their machine. The biggest gunslinger may well
that allows your server to be turned into a
be a sanctioned ethical hacker (Wyatt Earp) but there are
zombie.”
- Stewart Baker, Partner in the Law Firm Steptoe too few to monitor the entire territory (Internet). A small
and Johnson LLP and former General Counsel number of traveling judges on horseback (virtual
for the NSA [15] organization) may hear cases that are prosecuted but this
is not a high percentage of cases. In most cases (those
businesses that cannot hire a gunslinger and the public-at-
3.3. Law Enforcement Option
large) victims pool their resources (form a posse) to track
down the attackers and provide justice themselves. Other
Typically, the website owner calls in a security expert
Wild West market-based solutions include insuring assets
after an attack and this expert starts following the
in terms of armored cars (hardened sites) and “hacking
insurance”. Part of this scenario is already happening.
[5] K. Moriarty, “DDoS Incident Handling: Management
One window on the future may be a popular current Information Base to Trace Incidents – Revision 1,” IETF
game called Hack.Back: “The City is in danger … An Internet Draft, March 2000. draft-moriarty-ddos-mib-00.txt
evil hacker is on the loose … You are the only one who [6] National Research Council, Computer Science and
can stop him!” 2 Telecommunications Board, Realizing the Potential of C4I:
Fundamental Challenges, National Academy Press, 1999.
5. Conclusions [7] K. Park and H. Lee, “On the Effectiveness of Probabilistic
Packet Marking for IP Traceback under Denial of Service
So what is the solution to Internet attacks? This paper Attack,” IEEE Infocom, 2001. (an earlier version is Purdue
posits that one solution is to build an offensive posture. If University, Network Systems Lab and CERIAS, Department of
legalized, industry will design a set of hack back tools Computer Sciences, Technical Report CSD-TR-00-013, June
2000.)
that will stop Internet attacks. Is it not self-defense to
protect your assets under attack even if it means striking [8] D. Radcliff, “Should You Strike Back?” ComputerWorld, Nov.
your attacker? But is this the right direction? Future 13, 2000.
Internet scenarios from the widespread use of back- [9] D. Radcliff, “Can You Hack Back?” NetworkWorld, June 1,
hacking vary from peace to chaos. If not legalized, hack 2000.
back tools will continue to evolve and be used covertly
[10] D. Radcliff, “Hack Back” NetworkWorld, May 29, 2000.
since legal remedies against attackers do not yet exist on
“Internet time”. [11] C. Robinson Jr., “Make My Day Server Throws Gauntlet to
We have identified several significant technical Network Hackers,” Signal Magazine, May 1998.
problems (traceback) with back-hacking that make it [12] S. Savage, D. Wetherall, A. Karlin, and T. Anderson, “Practical
impractical at present but technology is advancing rapidly Support for IP Traceback,” ACM SIGCOMM, Stockholm Sweden,
and these problems may disappear. The more challenging 2000, pp. 295-306. (an earlier version exists as Department of
problems are social – identification, legal liability, and Computer Science and Engineering, University of Washington,
law enforcement. Technical Report UW-CSE-2000-02-01)
There are certainly some cases when hack back is [13] W. Schwartau, “Honeypots Wreak Sweet Revenge Against
permissible – when life is threatened (maybe the “life” of Cyber Intruders,” Network World, Dec. 4, 2000, p. 63.
a shut down Ecommerce dot.com), however, the worse
[14] W. Schwartau, “Can You Counter-Attack Hackers?” Network
case scenario beyond the Wild West analogy is self-
World, April 7, 2000.
destruction. With hack back tools legalized and
attacks/counterattacks rampant, the integrity of the [15] R. Shepherd, “Getting Hacked Could Lead to Getting Sued,”
Internet may be undermined. Current attacks on websites American Lawyer Media News Service, March 2, 2000.
may turn to infrastructure attacks on entire business [16] D. X. Song and Adrian Perrig, “Advanced and Authenticated
sectors. Applying common law to the Internet to Marking Schemes for IP Traceback,” IEEE Infocom, 2001. (an
distinguish an illegal counter attack from a valid self- earlier version is Computer Science Division (EECS), University of
defense is needed. California at Berkeley, Report No. UCB/CSD-00-1107, June 2000)
[17] R. Stone, “CenterTrack: An IP Overlay Network for Tracking
6. References DoS Floods,” 9th USENIX Security Symposium.
[18] R. Tadjer, “Detect, Deflect, Destroy,” InternetWeek, Nov. 13,
[1] S. Bellovin, “ICMP Traceback Messages,” IETF Internet 2000.
Draft, March 2000. draft-bellovin-itrace-00.txt
[19] M. Ward, “Don’t Hack Back,” New Scientist, May 30, 1998.
[2] D. Dittrich, “Fighting the Rising Tide,” excerpted from an
article appearing in Information Security, November 2000. [20] X. Wang, “Survivability Through Active Intrusion Response,”
IEEE/SEI/CERT 3rd Information Survivability Workshop, October
[3] T. W. Doeppner, P. N. Klein, and A. Koyfman, “Using 2000, pp. 173-176.
Router Stamping to Identify the Source of IP Packets,” 7th ACM
Conference on Computer and Communications Security (CCS), [21] D. Welch, Nathan Buchheit, and Anthony Ruocco, “Strike Back:
Athens Greece, 2000, pp. 184-189. Offensive Actions in Information Warfare,” ACM New Security
Paradigm Workshop, Ontario CA, 1999, pp. 47-52.
[4] A. Juels and J. Brainard, “Client Puzzles: A Cryptographic
Countermeasure Against Connection Depletion Attacks,” [22] W. Yurcik, “Information Warfare Survivability: Is the Best
Network and Distributed System Security Symposium (NDSS), Defense a Good Offense,” Ethics and Technology Conference
Internet Society Press, 1999, pp. 151-165. (Ethics’00), Loyola University Chicago, June 2000.

2
http://hbz.ocregister.com/games/hackback/hack.b.html