We've all heard of the concept of some geek bouncing their internet connection over a number of servers to hide their trail when doing something secretive. I'm curious about why this is done. I know the raw basics of TCP and SSL, but it isnt clear to me how tracing someone's internet connection even works.
Let's say I'd like to run a black market online
I place my web server in a shack purchased under a fake name in a country where it's hard for outside authorities to legally act/investigate.
I want to remotely connect to this web server to manage my market, but I'm worried about the NSA or CIA or FBI catching onto my market and tracing the server back to me, at my house in the USA.
So I could connect via an SSL encrypted connection, but if my packets are intercepted, the headers are going to still show the origin of my packets, even though they can't see the contents. That's enough to associate me with the illegal market run on the web server, and I'm in prison.
So, I need to encrypt not only the contents of my packets, but the headers too. This is where my knowledge ends. I'll note my current research on the subject to highlight where my confusion is:
If the authorities know about my server, and want to find who it is connecting to it, to nail their culprit, they'll need to intercept my packets between the server and an unknown location. Where do they hook into the network and how do they know which packets are originating at the server? I suppose they could cut the wire coming from the server's location, place a machine that reconnects the two ends, and sends data through but watches the contents, where they can read the origins of my remote connection via the TCP headers. But that seems extreme. Do they run to the nearest ISP data center and plug into the servers? Is that where they look into the traffic and pinpoint any packets coming to/from my server?
Tor manages to encrypt the headers so that's taken care of right? That can be done either via Tor or via my own software design.
But next, the common idea is that I would next route my packets through a bunch of different servers. Tor does it, or I could do it via my own set of proxy servers. Perhaps 300 personal computers that I've compromised around the world, I could reflect my packets from each of them as my remote commands are sent to the server and responded to by the server.
And so here is/are my question(s):
- Why, if it's possible to encrypt my TCP headers, do I need to bounce my packets all over the place as if to give authorities the slip.
- How do internet ISP servers know where to route my packets if their headers are encrypted?
- And what is the result of me bouncing my packets somewhere else before they reach me? What do authorities now have to do to follow the route of my packets, exactly? And why does it matter if the TCP headers can be encrypted?
In other words: Why do connection relays strengthen anonymity?