Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a critical thinker, I'm unable to control my curiosity to dig out how exactly they are doing this? Frankly, this group really scares me.

One thing that I don't understand is how they haven't been caught yet. Their IP addresses should be traceable when they DDOS, even if they spoof it or go through a proxy.

  • The server with which they are spoofing should have recorded the IPs of these guys in its logs. If the govt. ask the company (which owns the server) don't they give the logs?
  • Even if it is a private server owned by these guys, doesn't IANA (or whoever the organization is) have the address & credit card details of the guy who bought & registered the server?
  • Even if they don't have that, can't the ISPs trace back to the place these packets originated?

I know, if it was as simple as I said, the government would have caught them already. So how exactly are they able to escape?

PS: If you feel there are any resources that would enlighten me, I'll be glad to read them.

[Update - this is equally appropriate when referring to the Lulzsec group, so have added a quick link to the Wikipedia page on them]

share|improve this question
The can't catch Anonymous because the name is appropriate - it's not a group of people, it's basically just like-minded individuals coming together without any real command structure for a cause the believe in. You can catch individual members (and they have), but because there is no group, you can't catch it. – Phoshi Feb 22 '11 at 12:00
@Phoshi that is, by definition, a group. Just an unstructured group. – Steve Feb 22 '11 at 13:35
@Steve; Well, yeah, at any one point there is an "Anonymous", but people join and leave freely with no record, and as all "investigation" is by definition reactionary, the singular group that made any attack no longer exists. You can, and they have, arrest individuals, but you can't catch a group that never stays consistent. – Phoshi Feb 22 '11 at 13:43
“this group really scares me.” – On the danger of getting political … but at the moment it should really be the enemies of “Anonymous” that should scare you. Anon are basically a bunch of punks. But the others … they are the real boogeymen. If Anon hadn’t hacked the HBGary emails … whoa! Grisham, Ludlum, Clancy … they’re nothing compared to that. – Konrad Rudolph Feb 23 '11 at 22:23
@mrnap Anonymous is not a group with an organized hierarchy. It consists of people, and those people are free to do whatever they want. If a member wants to bark orders, they are free to do so, but nobody is obligated to listen to those orders. Similarly, some may be subservient, but only because they choose to be. The fact that there is little or no organization whatsoever is highly apparent when one looks at all of the infighting. Anonymous is no more organized than your average high school lunchroom. – Michael Aug 21 '11 at 3:19

13 Answers 13

up vote 58 down vote accepted

My answer pokes at the original question. What makes you think that they don't get caught?

The CIA and DoD found Osama bin Laden.

Typical means include OSINT, TECHINT, and HUMINT. Forensics can be done on Tor. Secure deletion tools such as sdelete, BCWipe, and DBAN are not perfect. Encryption tools such as GPG and Truecrypt are not perfect.

Online communications was perhaps Osama bin Laden's biggest strength (he had couriers that traveled to far away cyber-cafes using email on USB flash drives) and Anonymous/LulzSec's biggest weakness. They use unencrypted IRC usually. You think they'd at least be using OTR through Tor with an SSL proxy to the IM communications server(s) instead of a cleartext traffic through an exit node.

Their common use of utilities such as Havij and sqlmap could certainly backfire. Perhaps there is a client-side vulnerability in the Python VM. Perhaps there is a client-side buffer overflow in Havij. Perhaps there are backdoors in either.

Because of the political nature of these groups, there will be internal issues. I saw some news lately that 1 in 4 hackers are informants for the FBI.

It's not "difficult" to "catch" anyone. Another person on these forums suggested that I watch a video from a Defcon presentation where the presenter tracks down a Nigerian scammer using the advanced transform capabilities in Maltego. The OSINT capabilities of Maltego and the i2 Group Analyst's Notebook are fairly limitless. A little hint; a little OPSEC mistake -- and a reversal occurs: the hunter is now being hunted.

share|improve this answer
I like this answer, and will vote it up in 2 hours (sorry reached my vote limit for the day:-) - it's a good point. Spanish and Turkish law enforcement have arrested people they say are members of Anonymous. However, as members don't necessarily know any other members it is not likely this will lead to all members being caught. Especially as members may be able to join at will - there is no 'membership' as such, so the group can continue as long as people claim to be in it. – Rory Alsop Jun 15 '11 at 21:03
Strangely appropriate user pic. – StrangeWill Dec 15 '11 at 18:33
Truecrypt, if used correctly, is not perfect? What about hidden volumes? – Marek Sebera May 18 '12 at 17:28
This answer is somewhat misleading. Tools such as TrueCrypt, DBAN, may not be theoretically perfect, but they're perfect enough to end any investigation trail 100% of the time. From what information we have, no one has ever exploited a fault in one of these two products in anything other than a carefully-controlled and limited academic setting. People get caught in the exact same ways that the attackers use to exploit their victims. – tylerl Sep 15 '12 at 21:41
@atdre Could you maybe link to the video if you still know where to find it? I would be much interested in watching it! – Kevin Voorn Jan 23 at 14:57

From some experience with law enforcement and forensics, I can say one of the biggest issues is that ISPs really don't want to have to track users. Once they get beyond a certain level of management they lose 'common carrier' status and become liable for an awful lot of what their customers may do.

Also, many countries do not want to pass on information to another country - especially countries which may be opposed to western culture or western interference.

And it is extremely easy to hide almost anything on the internet.

Regarding your three points:

  • Server should have IP addresses - No - this is simple to spoof or erase
  • Private server - Not likely, although possible - but it wouldn't be their credit card used
  • ISP's trace - Not going to happen - it doesn't affect ISP's negatively, and is way too difficult

update It might happen after all -

share|improve this answer
Any server that is setup by a decent security professional would constantly mirror their logs to another server or servers, which makes them very difficult to erase by the attacker. Then again, any good attacker would never attack a box with their own IP. – mrnap Feb 23 '11 at 17:13
@mrnap - +1 absolutely – Rory Alsop Feb 23 '11 at 19:32
@rox0r "Then again, any good attacker would never attack a box with their own IP." Case in point. – mrnap Feb 25 '11 at 4:38
@mrnap thats a wonderful point – Karthik Feb 1 '12 at 11:46

One of the most important aspects of an attack like this is covering your tracks. There are lots of different ways to do this, as it depends on the technology. To address your specific questions:

When they DDoS: If the flood was coming from their own machines, then it would be fairly easy to track them. The problem lies in the fact that they aren't using their own machines. They are either a) taking control of someone elses without permission, or b) getting someone to do it on their behalf. The latter is what happened with the Wikileaks attacks. People signed up to to do it.

Things start getting hinky when servers are in countries that don't generally respond to requests for logs. If the company that is being attacked is in the US, it's fairly easy to get a court order if the attack can be proven to originate in the States. What happens if it's a US target, but the attack is originating in Russia or China? The same thing goes for purchase records.

As for being scared... there are quite a few of these sorts of groups out there. Most of them are (I don't want to say harmless, but...) harmless. In this particular case, someone poked the bear and the bear got pissed.

EDIT: Not that I condone their actions, blah blah blah.

share|improve this answer
+1 Good point about foreign machines, and the botnets for DDoS which I overlooked. – Purge Feb 21 '11 at 19:12

In addition to the answers that have already been given, another reason it is so hard to catch anonymous is because anonymous can be anyone, literally. I mean this in two ways. First, hackers can use a combination of malware, spyware, and bots to access and use/loop through other peoples computers anywhere in the world; thus, making any computer, theoretically, a point from which anonymous can work. Secondly, true to the name anonymous, any hacker, anywhere, using any method or style, using any random pattern of activity, can make their attack and call themselves anonymous. Thus, it is extremely difficult for a government/authority to track activity by pattern or style or signature, because it is always changing due to the varied nature of the attacks since it can, as I said before, literally be coming from anyone.


Anonymous is not one person... Anonymous is not one group...

Anonymous is anywhere and everywhere... Anonymous could be everyone or no one...

Unfortunately, that is the nature, uniqueness, and genius of the name.

share|improve this answer

There are NUMEROUS ways for a hacker to cover their tracks..

Here is one very generalized example:

A hacker can compromise a third party machine and use it to do attacks on the hackers behalf. Because the system is compromised, the hacker can delete/modify logs. A hacker can also piggyback machines, such as, log into machine A, from machine A log into machine B, from machine B log into machine C, from machine C attack machine D, then cleanse the logs for machines C, B, then A making tracking the hacker more difficult.

This doesn't even take into account hacked internet accounts (so even if traced back they point to a different person), open proxies, etc etc etc..

I know the above isn't flawless, but like I said this is just a VERY VERY general example. There are many many ways to cover your tracks.

That said, what makes you so sure certain 3 letter agencies don't already know who many of them are, but don't make a move on them so that those individuals can lead them to others?

I'm sure others will chime in who can explain more thoroughly, but I think the ultimate lesson to be learned is to concern yourself less with specific hackers and hacking groups, and more with your own security. The fact that their latest claim to fame originated from something as TRIVIAL to fix as a SQL Injection vulnerability (which is nothing new, very well documented and understood) is a huge discredit to the unnamed "security firm" who was hacked. rant over

share|improve this answer

Well I responded to some posts above that had incorrect information, but I figured I should just post my own response to better explain.

Anonymous is made up of basically 2 subgroups:

  1. Skiddies (script kiddies) and newbies who have only the most basic security knowledge, and just sit in their IRC and basically be the pwns for the attack. These are the people that the FBI was knocking down their doors.

  2. Anonymous core leadership, a group with some hacking knowledge that owned hbgary, but also got owned recently by ninja hack squad. You won't be able to trace this subgroup unless you are a security guru.

How do they hide their tracks?

Like a previous answerers mentioned,

  1. Through proxy servers like TOR
  2. by compromising boxes and launching attacks from those boxes (basically masquerading as that person's IP), or
  3. by using a VPN that's in a foreign country and keeps no logs. With the VPN, all your traffic is relayed through it so wherever you connect it can only track back the IP addy to the VPN itself and no further (unless the VPN is keeping logs in which case you shouldn't use it anyways).

Hope this helps clarify a bit.

share|improve this answer
@Sparkie I haven't had any involvement in "researching" anon on my own, and have no current investment in the situation one way or another. However, (owned and exposed issue 2) from 12/2010 seems to suggest that they do. Do you have more reliable info than that or are you just perpetuating the propaganda? :) – mrnap Feb 23 '11 at 22:32
Just to be clear. There may be groups with a hierarchy that call themselves anonymous and claim to speak on behalf of anonymous, and they may even be anonymous - but anonymous is not that group. Anonymous is anyone - you, me, the person next to you. There is no prerequisite to being anonymous other than being anonymous. You don't need an invite to create your own website, anonymously, and get other anonymous individuals to join your cause. Read Eli's answer. – Sparkie Feb 23 '11 at 23:34
Ah. I see what you are saying, and in theory I agree. However, the OP was specifically talking about the hacker group Anonymous and how "this group really scares me", which was a core group of leadership behind these exploits (see th3j35t3r's blog as well), so talking about the theory behind what anonymous means is pretty irrelevant in this context. – mrnap Feb 23 '11 at 23:42
It's not irrelevant. The "hacker group" you talk about is only one group, and there are others like it. You could be your own hacker anonymous group. The point is, if anyone managed to infiltrate and take down that group, they are not taking down Anonymous. Another Anonymous group will replace it. That's why it's impossible to take down anonymous. You can only take down a small part, and since there is no ultimate hierarchy, you can't dismantle the "structure" - there is none. – Sparkie Feb 23 '11 at 23:49
@Sparkie that small part would be the core leadership. It's not like there are tons of knowledgeable, organized groups in the hacker scene calling themselves "anonymous". Yes, anyone can do it, but in this case (see linked wikipedia article) it's basically one focused group. Again, Read th3j35t3rs blog for more info on what I'm talking about. Knowledgeable "anonymous" groups referring to themselves by that mantra don't just spring up overnight. In theory you're right, in implementation and this instance it's a different story. – mrnap Feb 25 '11 at 4:43

The thing about a DDoS is that you use other people's IPs, not your own. It's relatively simple to become untraceable on the Internet -- just route your traffic though a host that is not keeping traffic logs. As someone who frequently has to try to track these people down, I can tell you what an impossible nightmare it is. Here's the pattern I frequently see:

  1. Select a relatively recent exploit in some web software package (e.g. joomla extension).
  2. Use google to find an appropriately vulnerable attack target
  3. From some location that can't be traced to you (e.g. coffee shop), execute the attack to gain control over the vulnerable server, but don't do anything else that would draw attention to yourself. (bonus points, fix the vulnerablity so no one comes in behind you). Delete any logs that might trace back to your presumed location.
  4. Repeat the above, relaying your traffic through the previously compromised server. Repeat again several times until you're removed multiple steps from the machine that will be behaving as your proxy. Ideally these servers should be located in countries like China, India, Brasil, Mexico, etc., where datacenter techs tend to be uncooperative toward investigations, and should all be located in different countries as to create jurisdiction and communication nightmares for the people trying to track you.

Congratulations, you're now anonymous on the Internet. It's a bit like TOR, except none of the nodes know they're participating. Usually these attackers set up and use backdoors on servers for which no logs or records are kept (since the backdoor presumably doesn't exist). Once the attacker disconnects, that link becomes permanently untraceable.

One hop drops your chances of detection dramatically. Two hops makes detection almost impossible. Three hops and it's not even worth the effort.

share|improve this answer

Ars Technica just posted an article: "How the FBI investigates the hacktivities of Anonymous". It contains some information about how they go about tracing the members, and why it's hard.

share|improve this answer

Maybe you should read this PDF. They are not so anonymous. The LOIC tool used for DDOS, leaks the original IP of the person using it. You can use the browser (javascript) version of the same tool, maybe hiding behind TOR.

HBGary Federal exposed their names and addresses in that PDF. That is why they attacked his site, email, wipe his ipad, took over his twitter etc.... Search the #hbgary hashtag on twitter for more info on that.

share|improve this answer
Actually, you are incorrect, HBGary is just a power hungry moron. Read this: – mrnap Feb 23 '11 at 17:01
You should also point out that the names "exposed" in the HBGary investigation and in that PDF were never confirmed. – jamiei Feb 23 '11 at 17:32
Good luck linking an IP address to a RL person and having it stick in court... It's so easy to anonymously connect to the Internet with nothing more than a WiFi equipped laptop... – Bruno Rohée Apr 23 '11 at 20:37

Several post discuss the technical difficulties in finding the persons behind these groups. It is not at all easy to backtrack their activity when using many machines to create a sense of anonymity.

Another very important aspect is that the police, the intelligence communities around the globe and the different counties legislation is not really constructed to handle these situations. So if you find a server in one country that has been used to hop to a server in another country it takes too long to go through the proper channels to get the local police to get hold of the information. Even if you do the information such as logs are not always kept for longer periods of time.

It's easy to unlawfully hop around the Internet, but much much slower to hop around the Internet in a lawful way. This is a very prohibiting factor when trying to find these groups.

share|improve this answer

Here is an article asking (and answering) just that very question from the Scientific American site posted this month. The short answer to the question is spoofing of source addresses and the use of proxies.

share|improve this answer
welcome to the site! Instead of just posting a link, can you add some summary or even quotes (IF the source site allows content to be copied). Please see the FAQ, and also How to Answer... – AviD Jun 15 '11 at 18:44

There is one thing that hasn't been mentioned yet: the human factor.

These groups do not have a hierarchy as such, instead they form around a set of ideas. Most of the time, the only idea in common is "the governments are wrong, we must do justice by hacking", which is probably a feeling that's only getting stronger, with the current pressure the US gov (itself pressured by corporations) is putting in other countries below the covers to pass draconian laws against free speech that could harm the aforementioned corporations.

So the great appeal here, especially by Anonymous, is that if you have the knowledge and hate the government (who doesn't?), you can join them by yourself and on your own account and risk.

In order to see where this thinking comes from, I recommend the movie/comic novel "V for Vendetta", from which they took that mask you see so often.

Some groups, of course, have much less heroic intentions. LulzSec was "all for the lulz".

The bottom line is that yes, they might get a few members of each group, but more will show up.

share|improve this answer
I think that greatly depends on the sentences that the ones that were recently caught get. It's one thing to wreak havoc knowing that nobody will ever get to you, another knowing the end of the road is 15 years in federal prison... – StasM Mar 20 '12 at 17:16
@StasM I think the actual hardcore hackers will be hired by the feds instead. They arrested a bunch of teenagers, I suspect they've actually arrested a few 4chan wannabes and trumpeted victory over the group not to look so lame. – Camilo Martin Mar 20 '12 at 17:24

Hackers can be caught, Anonymous cannot. Anonymous is such a lose collective that it is not materially hurt by law enforcement striking out at its individual hackers. However, it does respond violently against any organization that attempts to do so. This means

  • Its very hard to strike down Anonymous just by catching its members.
  • Anonymous will make life hard on anyone who tries.

All Anonymous has to do is continue to be "not worth the effort" to go after its members en masse and it will continue to be free. However, they play a dangerous game. If the public ever decides they are a sufficient nuisance, then it will suddenly be worth the cost to track down and catch its members, enduring the counter-hacks by Anonymous as they go.

share|improve this answer

protected by Rory Alsop Feb 1 '12 at 13:16

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.