How does the hacker protect himself when using reverse_tcp?

Question

A reverse TCP is a connection that starts from the victim back to the attacker, which in fact opens the 'door' for the attacker to hack the target system.

This connection is being triggered normally by a malware that contains the attacker address or some other address, and when the victim starts that malware, it initializes a road for the attacker to enter.

My question is how the attacker spoofs his address and protect himself from being tracked. Are there some sites that provide any kind of back-end terminal to be used by the attacker, or are there other ways?

Answer 1

"Spoof" may be a poor term that will lead you down unhelpful paths.

You want to obfuscate your location. Dynamic DNS or pivoting off of another server that you have cracked are ways to put layers in between yourself and the target and not expose yourself directly.

So, the victim connects to a static address (Dyn DNS or static IP of another hacked server), and then the attacker connects to this intermediate layer with a changing IP (free wifi, large network with NAT like a school, etc.).

Answer 2

I think a hacker would buy a stolen credit card in the dark net, rent a linux server in China or Russia with that credit card and then maybe establish a Tor SOCKS tunnel to her own box. Not 100% sure about the Tor thingy but since you can send nmap traffic through Tor FROM the attacker TO the client I don't see why the opposite direction shouldn't be possible.

Answer 3

The ways I know are : 1. Connect via a HSPDA modem - it can be threw away but it can be traced and in some countries the mobile networks are monitored. 2. Connect via tor - nowadays it isn't a really good choice. The NSA and other agencies can identify tor users. 3. Connect via a proxy chain of servers in hostile countries - By hostile countries I mean north korea, iran, iraq, and maybe china or russia. The chances that they will cooperate with other agencies are slims.

in my opinion the third way is the best way nowadays to get an internet access anonymously. Nowadays there are plenty of know vulnerabilities/exploits that can be uses to gets servers around the world without paying for it.