1

I stumbled upon an interview with "the grugq" in which he is talking about how hackers anonymize their traffic, i.e. hide their original ip address (- this is also what I will mean by "anonymizing" in what follows). He states that

The old idea was to have a lot of boxes in different countries so that it was legally very difficult to get all the records together. These days, things are more sophisticated than those old style bounces, though. Before you used to have do log-ins to loads of boxes to do your bouncing. Now there’s packet routing software, so that rather than running a session from box A to box B to box C, you install software on a load of boxes, and then you have some packets which get routed from box A to C to target, and the other packets go from box B to box D to box A to target, and so on. (http://www.csoonline.com/article/2121184/network-security/where-is-hacking-now--a-chat-with-grugq.html)

Since I'm rather a programmer than a network expert I would like to know:

  1. What kind of routing software is he talking about? Do you need "special" software for that kind of routing or can you achieve that with standard linux tools (given that you can load necessary kernel modules, change iptables rules etc.)?
  2. Are there any special routing algorithms that bounce traffic with the aim to anonymize it? As far as I see most routing algorithms aim at finding the "best", i.e. fastest (or, more abstract, "cheapest"), routes between source and target what may not be needed when your aim is to bounce traffic between different nodes to hide its origin.

The routing reminds me of what Tor is doing, but there are probably other solutions than Tor for that kind of task, since Tor would seem to be a kind of overhead here (and is limited to 3 nodes).

Thanks!

Improve this question
5
  • 1
    What do you mean exactly when you say TOR is limited to 3 nodes? He seems to be talking about a zombie/bot network, so in example with 'ABCD' half the packets go to A then to C END, half to B to D to A to END. Full packet load is being delivered to A eventually, and then to target. In the end the source IP would end up as A for full packetload. This sounds like TOR honestly. Yes TOR is slower. This has some other distributed network examples.
    – No Time
    Commented Aug 8, 2014 at 2:57
  • With "TOR is limited to 3 nodes" I mean that TOR-traffic passes usually three nodes, entry, relay and exit node (torproject.org/docs/faq.html.en#ChoosePathLength). The TOR network consists of many more nodes, of course.
    – Michael Helwig
    Commented Aug 8, 2014 at 7:03
  • 1
    You can rebuild TOR to use more nodes but why would you need more than 3 nodes for anonymity? 4 nodes doesn't make you more anonymous, it just slows down your connection. I don't see how splitting packets up and forcing fragmentation/reassembly will speed up your connection.
    – RoraΖ
    Commented Aug 8, 2014 at 11:41
  • I know I probably could do that. But I don't want to use TOR (nor speed up my connection) but to simply route pakets to their destination (let's assume encryption is not even necessary). It seems to me that using a higher number of nodes for paket routing makes it harder to get to the origin of the traffic, especially if traffic takes different routes within the network, since every node involved could be the possible source of the traffic. And the higher the number of nodes, the higher the number of potential originators. Am I wrong here?
    – Michael Helwig
    Commented Aug 8, 2014 at 13:30
  • Btw, TOR people argue that more nodes does not help to anonymize you because if somebody controls entry and exit node they can deanonymize your traffic. But if I would manually select the nodes involved in my paket bouncing network and would be able to assure that there are no 2 nodes owned by the same party, this argument does not apply.
    – Michael Helwig
    Commented Aug 8, 2014 at 13:33

1 Answer 1

Reset to default
2

Tor fulfills both your requirements quite nicely.

Additionally, for your first point, there was no routing protocol used, as such - attackers would literally connect to a 2nd machine, and from there connect to a third etc - using plain old TCP/IP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .