Tag Info

Hot answers tagged

52

My answer pokes at the original question. What makes you think that they don't get caught? The CIA and DoD found Osama bin Laden. Typical means include OSINT, TECHINT, and HUMINT. Forensics can be done on Tor. Secure deletion tools such as sdelete, BCWipe, and DBAN are not perfect. Encryption tools such as GPG and Truecrypt are not perfect. Online ...


36

From some experience with law enforcement and forensics, I can say one of the biggest issues is that ISPs really don't want to have to track users. Once they get beyond a certain level of management they lose 'common carrier' status and become liable for an awful lot of what their customers may do. Also, many countries do not want to pass on information to ...


27

One of the most important aspects of an attack like this is covering your tracks. There are lots of different ways to do this, as it depends on the technology. To address your specific questions: When they DDoS: If the flood was coming from their own machines, then it would be fairly easy to track them. The problem lies in the fact that they aren't using ...


18

In addition to the answers that have already been given, another reason it is so hard to catch anonymous is because anonymous can be anyone, literally. I mean this in two ways. First, hackers can use a combination of malware, spyware, and bots to access and use/loop through other peoples computers anywhere in the world; thus, making any computer, ...


16

You are correct when you say an attacker spoofing IP may not receive traffic back, but they may not want to. They may want traffic sent to another IP address - possibly for denial of service attack on that IP. Alternatively, there are attacks which just require the initial part of the handshake to take down your defences (you mentioned SYN flood) Less of a ...


16

There are NUMEROUS ways for a hacker to cover their tracks.. Here is one very generalized example: A hacker can compromise a third party machine and use it to do attacks on the hackers behalf. Because the system is compromised, the hacker can delete/modify logs. A hacker can also piggyback machines, such as, log into machine A, from machine A log into ...


15

Well I responded to some posts above that had incorrect information, but I figured I should just post my own response to better explain. Anonymous is made up of basically 2 subgroups: Skiddies (script kiddies) and newbies who have only the most basic security knowledge, and just sit in their IRC and basically be the pwns for the attack. These are the ...


12

Use whois: http://tools.whois.net/whoisbyip/ Or/and you can try IP address geolocation services, like: http://www.ip2location.com/ http://www.digitalenvoy.com/ http://www.maxmind.com/app/ip_locate http://www.ip2country.com/ http://www.hostip.info/ http://www.atelierweb.com/iploc/ http://www.ip2country.net/ http://www.quova.com/


12

While I am sure there are, in fact, firewalls that may do that, I am not off-hand aware of any that operate this way. There are packet spoofing detection mechanisms, although they tend to act a little different. Bogon Filters A bogon is defined as bogus IP address. Specifically, it is the list of all IP addresses that have not been allocated by IANA, by a ...


11

When you send a request to the server, the server need to know where to answer, it's with your ip address. This is directly based on the TCP/IP protocol and in a lower slice than web servers. For the reason why Firebug doesn't show your IP address, it's like when you receive mail (paper), you have your address written in front, and the sender in the back. ...


11

Set up a web server and send them a link to something on it. Once they click the link, their IP address will be logged in your web server's access logs. You could also host an image on said web server and trick a user into loading it through a third party's website. Some social networking sites allow you to upload snippets of HTML including image tags. ...


11

Full IP spoofing is hard for the commoners. Everything in IP is made of packets. Each packet has a source address and a destination address. IP spoofing is about sending packets with a wrong source address. Sending such a packet is simple enough with a few lines of code (it tends to require local Administrator / root rights; on Linux, this is a matter of a ...


10

Short answer: no. Longer answer: yes, if you control a router device close to the target device (it has to be on the path between the the real source IP address and the target, and on the path between the faked IP address and the target) or if the target network/host accepts source-routed packets.


10

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001. UPDATE Cloudflare blog entry about DNS Amplification DDoS, and follow-up ...


10

A spoofed packet is a packet with a fake source IP address. To detect an incoming packet as spoofed, firewalls try to apply "local rules": they reject the packet if its coming from a link which is nominally incompatible with the alleged source address. For instance, if a firewall is between an internal network, with a known IP range, and the wide Internet, ...


10

Defining a spoofed packet First off, there's the concept of ownership of an IP range. I'll say anything that isn't coming from the registered owner or delegate of an IP block from IANA (and the subsidiaries, and the delegating ISPs) is a spoof. It's all about routing There are a few things to consider when talking about spoofing. The first is that you can ...


10

This code allows an attacker who knows the victim's X-Forwarded-For: header and the victim's session ID to login as that user. If the victim doesn't have an X-Forwarded-For: header, the attacker can put the victim's IP address in his header and the code will use that value as his legitimate IP address instead of his actual IP address. This is the ...


10

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this ...


9

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...


9

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead. for If you generate the page dynamically to contain an image located at a domain that you control, e.g. <img src="http://123123.deanonymize.mydomain.com"/> ...


9

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...


9

First of all, I need to emphasize that IP address can never be used to authenticate a user, it can only be used to (attempt to) validate a host. Even if IP address were perfectly tied to an exact computer on an exact network port, we'd still have no guarantee that a particular user was at the console of that computer at that time. So if you are trying to ...


8

1) There doesn't appear to be a usual policy. Many ISP's do now drop packets with spoofed addresses, but there are still loads that do not. 2) When NAT'ing, a correctly configured router will have a small list of rules which define the IP address which will be attached, so the usual attack is to send from a location where this doesn't happen. 3) One of the ...


8

The deal is that dnsadvantage.com is being used as at least one of your name servers and ak1s.abmr.net had a failed dns lookup (oops). dnsadvantage provides free DNS lookups in exchange for doing a MITM attack for domains that it cannot find. The page that it serves for these failed lookups is search.dnsadvantage.com and it displays google ads. So try ...


8

Yes. If the user alters the HTTP_X_FORWARDED_FOR header, or any of the user-supplied headers you're checking with that code, they can forge the source IP. Ignore those headers and just use the REMOTE_ADDR value.


8

Running as root with raw sockets will let you set whatever IP address you wish on your outgoing packets. Tools like hping3 include this functionality. You could write the binary GET request and feed it as an option to hping3, then specify the source address (or even --rand-source). That won't get you all the way, though. Since we're talking about completing ...


8

Essentially it depends on the attacker and what resources they have available. Ordinary home-users or attackers who aren't very dedicated might be deterred by source IP address blocking, but more advanced/determined attackers have a number of ways to get round this. The obvious one is to use one of the wide range of proxy services available on the ...


8

Sometimes the connection information inside a packet is predictable. TCP initial sequence numbers, for example, can be an issue if they are not random. See http://www.networkcomputing.com/unixworld/security/001.txt.html for one example. The same thing can also happen with DNS request ids. Usually these attacks don't work on the first try, but will with ...


8

I'd say you're right! They don't seem to have kept in mind that the HTTP header X-FORWARDED-FOR might return '; DROP TABLE users;--. They suggest this in order to also lock sessions for people behind proxies, and name Tor as example. This is sort of stupid; Tor never forwards the original IP for obvious reasons. Moreover, it doesn't (shouldn't?) even look ...



Only top voted, non community-wiki answers of a minimum length are eligible