5

Having read this article, one line in particular caught my attention:

The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the devices used in the hacking.

The following quote was more in line with what I was expecting to see:

A mobile phone and hard drive were also seized and the IP address... matched the intrusions into the organisation.

I am aware that TCP/IP packets will contain headers which expose the source IP address and that the IP address could be used to trace back to an individual network (such as the house from which the hack was conducted from).

What I'm more interested in is the first quote. Why would a laptop serial number be present in network packets leaving the machine? Is this a common "feature" used by some well known application or protocol such as SSH?

Improve this question
2
  • 2
    broken into the company's mainframe a number of times raise my eyebrow, the writing is old school.
    – mootmoot
    Commented Aug 17, 2018 at 15:57
  • 1
    "A prosecutor told the court..." you can't take the quote at face value as you have non-technical people talking to other non-technical people. They could have simply meant the IP address or any other data, not necessarily the device's hard-coded serial number as we understand it. .
    – schroeder ♦
    Commented Nov 14 at 13:14

1 Answer 1

Reset to default
4

It was probably likely that by 'serial numbers' they were referring to the MAC addresses of the devices, rather than the physical security numbers of the device.

A prosecutor told the court: "A mobile phone and hard drive were also seized and the IP address... matched the intrusions into the organisation.

There is a protocol known as ARP, or the Address Resolution Protocol that converts IP addresses to MAC addresses, so that traffic knows which address to send given data to, and is commonly used as an identifier for where attacks originate from, what machines have egressed to a given network, where malware originated from within a company, etc. etc.

But to answer your question, there isn't any need for a physical security number to access a network for two reasons.

  • MAC addresses serve as individual identifiers
  • Numbers, like MAC, IP, and hypothetically serial numbers can all be spoofed.

If you need more info on any of these topics leave a comment and ill do my best to answer your questions.

Improve this answer
6
  • 7
    MAC addresses do not propagate beyond a single router... There is no way they would have gotten the MAC address just because he connected to their servers, unless he connected directly via Ethernet at their very datacenter. I highly doubt the MAC addresses were responsible.
    – forest
    Commented Aug 17, 2018 at 10:00
  • @forest Maybe if he VPN-ed in?
    – user1133275
    Commented Aug 17, 2018 at 10:49
  • @user1133275 OpenVPN at least sets the MAC address to all 0s.
    – forest
    Commented Aug 17, 2018 at 10:50
  • 2
    He may have exploited one of Apple's proprietary protocols like find my laptop which would have contained all the information necessary to find him
    – user1133275
    Commented Aug 17, 2018 at 10:58
  • 1
    @user1133275 That's very possible, though I don't know anything about Apple's protocols. My point is just that I disagree with this answer and think that it is most probably not the MAC address.
    – forest
    Commented Aug 17, 2018 at 11:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .