I stumbled upon an interview with "the grugq" in which he is talking about how hackers anonymize their traffic, i.e. hide their original ip address (- this is also what I will mean by "anonymizing" in what follows). He states that
The old idea was to have a lot of boxes in different countries so that it was legally very difficult to get all the records together. These days, things are more sophisticated than those old style bounces, though. Before you used to have do log-ins to loads of boxes to do your bouncing. Now there’s packet routing software, so that rather than running a session from box A to box B to box C, you install software on a load of boxes, and then you have some packets which get routed from box A to C to target, and the other packets go from box B to box D to box A to target, and so on. (http://www.csoonline.com/article/2121184/network-security/where-is-hacking-now--a-chat-with-grugq.html)
Since I'm rather a programmer than a network expert I would like to know:
- What kind of routing software is he talking about? Do you need "special" software for that kind of routing or can you achieve that with standard linux tools (given that you can load necessary kernel modules, change iptables rules etc.)?
- Are there any special routing algorithms that bounce traffic with the aim to anonymize it? As far as I see most routing algorithms aim at finding the "best", i.e. fastest (or, more abstract, "cheapest"), routes between source and target what may not be needed when your aim is to bounce traffic between different nodes to hide its origin.
The routing reminds me of what Tor is doing, but there are probably other solutions than Tor for that kind of task, since Tor would seem to be a kind of overhead here (and is limited to 3 nodes).