-1

I have read a bit about Internet infrastructure recently. I have figured out how the IT crimes are easy to cover and quite confident way to perform any attack without traces. I got suprised that is like this and wanted to know if I understood the topic wrongly or there is some techniques that can be used to prevent IT abuses.

So main fact which one suprised me a lot is that MAC address is not going out from our LAN network. So on the lowest layer there is MAC address sent just to the main router in the LAN which is broadcasting all the data. Usually this router is runned by our internet provider. So usually there are some law enforcements that require storing the MAC addresses (which are the ones can identify our computer) together with our internet data.

Because the only way to identify us for someone from out of our LAN network is to get IP of the data came to him or her, what is equal to the IP address of our Internet Provider and then using some law or police enforcement query him what exactly computer was sent such a data with for example exploit. The only way I have figured out Internet Provider can identify us is the MAC address, I assume is network card MAC address, not our CPU MAC address. So what if Internet Provider do not have an infrastructure to store such an amounts of data ? For how long is realistic they keep our internet cache data ? What if we have VPN to some wild country where there are no such enforcements and Internet Provider do not cache anything ?

And the other scenario is that an attacker could easily (I guess) break WIFI password of neighborough and sent exploit as he or she. Even if we go to some public place with internet with no camera at. From perspective of attacker - we can sent exploit easily and vanish. To be sure an attacker can destroy network card. This is not so expensive hardware.

Is that what I described the facts and real world or did I missed something in topic of global internet security issues and detecting the hackers ? Please educate me a bit or leave me with the link where I can get more info and fill my knowledge gaps.

  • 2
    I have not read your question, but as a tip, a title of "Please do a security review of my thing" will not get many clicks -- most of us charge money for that in our day jobs. Instead, can you extract the main thing that you are unsure of and make the question (and title) about that? – Mike Ounsworth Sep 15 '18 at 13:16
  • What is a "CPU MAC address"? – forest Sep 18 '18 at 2:49
  • @forest I was thinking that our Computer have few physical addresses called also MAC addresses. The one is surely MAC address of our network device, but I believed that there are the other ones like processor or motherboard physical address which I shortly called CPU MAC address. While someone is profiling us, I guess he or she can use this uniquely identyfing addresses. Am I wrong ? – GuessMe Sep 20 '18 at 0:59
  • @GuessMe A MAC address is specific to network devices. Perhaps you are thinking of some other generic serial number? CPUs do have a serial number, though it isn't exposed through software. – forest Sep 20 '18 at 1:02
  • If you open Device Manager under Windows and check a processor device you can read its properties. There is for example values called like: class guid, bus type guid, driver key and some others. I believed (maybe wrongly) one of this or other value could identyfiyng our cpu or motherboard uniquely. – GuessMe Sep 20 '18 at 1:09
1

First of all, an ISP will likely not use your routers MAC to identify you. ISP knows which port on his router is connected to your house, so if you change your router, you will not loose internet access.

Second of all, it is even simpler than that. If you download Tails OS, it will generate random MAC each reboot without destroying network cards. Then you can just connect through an open, public or compromised WiFi and use a VPN and/or Tor for good measure and anyone below the NSA level have zero chance of tracing your IP.

That being said, there are other tricks law enforcement can try to identify you. FBI have notoriously been using malware to identify suspect computers, browser fingerprinting is a huge thing and many other simple ways you may accidentally reveal your identity.

Preventing IP trace is easy. Preventing all the other little tricks is hard.

For example, a very large cybercriminals have been caught because they logged into their personal account (Facebook, mail, etc.) from the same IP they used for hacking.

  • Thanks for comment. This is really great anwser. This looks anyway funny that public/compromised/open wifi + tails is compeletely intreceable, this is not hard. Logging to mail or facebook from same environment (even hardware) is a extremely lame. I guess that professionals do not do that. Summarizing - it is easily to harm someone and do not take responsibility. – GuessMe Sep 16 '18 at 15:45
  • One more question - do internet provider set all my activity to one port ? How he does it ? The optical fibre connecting my home is set as single port in his hardware ? About FBI etc - this is easy - just load clear image of OS each time I turn on my environment to get off their malicious or run virtual machine each time someone want to do harrasment. Then fingerprint is easy as well, for normal activity run yoru favourite browser (ex firefox), then for suspicious activity open another one (ex safari with different screen resolution). I guess that there are other tools they can use.. ? – GuessMe Sep 16 '18 at 15:49
  • 1
    @GuessMe Browser fingerprints are trickier than that. Browsers that are not configured correctly may even reveal hardware IDs of your computers components. Neverthless, Tails uses Tor browser by default which is configured pretty well and Tails does not allow writing to HDD, which means you don't even need to reinstall all the time in theory. As for the guys who got caught, in a way they were big fishes, so in a way they were proffesionals. The problem is not necessarily that they were stupid, but that they got complacent. After doing what they do for years, the were not that careful anymore. – Peter Harmann Sep 16 '18 at 18:48
  • 1
    @GuessMe as for the port that the ISP use, I don't mean a TCP/UDP port. I mean the physical slot your fiber optic cable is plugged into their router. They likely take note of where they plugged the cable from your house when they connect you and it is not as if you could walk into their data-center and change it. – Peter Harmann Sep 16 '18 at 18:48
  • Thanks a lot, that is clear for me right now. You are so helpful and patience. All the best for you ! – GuessMe Sep 16 '18 at 21:58
1

So usually there are some law enforcements that require storing the MAC addresses (which are the ones can identify our computer) together with our internet data.

The service provider may be required to store IP vs. customer for some period of time, but I am not aware of this requirement extending beyond that in any western countries. Anyway, MAC addresses are trivial to change.

Because the only way to identify us for someone from out of our LAN network is to get IP of the data came to him or her, what is equal to the IP address of our Internet Provider and then using some law or police enforcement query him what exactly computer was sent such a data with for example exploit.

With NAT commonplace a IPv4 address does not identify the computer. It at most identifies the connection to the internet that was used. In a civil suit this may be enough; in a criminal matter better proof is generally required to convict someone of a crime.

The only way I have figured out Internet Provider can identify us is the MAC address, I assume is network card MAC address, not our CPU MAC address.

CPU's does not have MAC addresses. And the MAC of your network card typically never leaves your house.

So what if Internet Provider do not have an infrastructure to store such an amounts of data ? For how long is realistic they keep our internet cache data ? What if we have VPN to some wild country where there are no such enforcements and Internet Provider do not cache anything ?

It's not a large amount of data. With broadband customers tend to stay connected most of the time. If we have a ISP with 1M customers, which each get a new IP once a week, it's 1M*(32 bytes + 10 bytes) in broad terms - IP and customer number. That's 300MB a week, or 16GiB/year. That's hardly a lot.

And the other scenario is that an attacker could easily (I guess) break WIFI password of neighborough and sent exploit as he or she.

Sure. That's why the originating IP doesn't prove anything. Or the attacker can buy access in Microsoft, Google or Amazons clouds. Or they can infect random PC's with malware, and use them to attack...

Even if we go to some public place with internet with no camera at. From perspective of attacker - we can sent exploit easily and vanish. To be sure an attacker can destroy network card. This is not so expensive hardware.

Or simply set a random MAC.

Is that what I described the facts and real world or did I missed something in topic of global internet security issues and detecting the hackers ? Please educate me a bit or leave me with the link where I can get more info and fill my knowledge gaps.

Most attacks today are automated. It's less interesting to find out who's behind them in most instances; law enforcement across borders are at best difficult. At worst, the attackers are state sponsored, and can operate with immunity in their home country.

Not the answer you're looking for? Browse other questions tagged or ask your own question.