There is something that I can not understand. If you are preparing, building up an attack from a public place (coffee shop, restaurant ect.). How can you be tracked by law enforcement? I'm asking this because the public IP address will be the one from the public place (sub-network) from where you are performing the attack. Once you are done with the attack. The law enforcement can only find out that the attack came from the public place(after gathering the required info.). After you come to your home get another IP address by the DHCP server which has no correlation to the public place network IP you were.

My question is, how would the attacked person get to you (reveal your identity)?

1 Answer 1


Theoretically speaking, public WiFi networks do provide some level of anonymity. You are right in that since tons of people are behind a single public IP address, it is harder to trace malicious activity to an individual.

Practically though, a public network alone really doesn't provide enough anonymity to hide someone from law enforcement - mostly because unless you're really, really careful and know exactly what you're doing, you're probably going to leak information that allows the malicious activity to be traced back to you. It may help you get away with some run-of-the-mill illegal stuff (copyright violations, illegal torrents, that kind of thing), but if it's something serious that prompts a full-fledged law enforcement investigation, you're pretty much screwed if all you're relying on for anonymity is the fact that the network is public.

Most public networks will (or at least should!) keep some logs of network activity. Usually they record pretty basic information such as MAC addresses (essentially hardware ID numbers) of computers that connect, IP addresses that users communicate with, and possibly URLS that are visited, along with timestamps. This information is generally not enough to identify someone, but it can provide law enforcement with a starting point in an investigation.

So how might this work? Well, let's say your computer has a MAC address of A1:B1:C1:D1:E1:F1, and you decide to use the public WiFi network at a coffee shop to hack a website located at IP address At this point, the website admin would of course look at the website logs and see that the attacks are coming from the coffee shop's IP. Law enforcement would then visit the coffee shop and request to see the logs of the public access point. They might see something like this:

02/21/2015 11:20:05 AM - Client A1:B1:C1:D1:E1:F1 connected to network
02/21/2015 11:23:31 AM - Client A1:B1:C1:D1:E1:F1 sent data to

It provides some key information - they now know that the attack was definitely performed by someone who used the coffee shop's wifi, that the MAC address of the attacker is A1:B1:C1:D1:E1:F1, and that the attack occurred at around 11:23 AM on Feb 21. But it's still not enough to identify you.

But let's say you get a bit careless, and you decide to check your Gmail from the same computer. Now, the logs will look something like this:

02/21/2015 11:20:05 AM - Client A1:B1:C1:D1:E1:F1 connected to network
02/21/2015 11:23:31 AM - Client A1:B1:C1:D1:E1:F1 sent data to
02/21/2015 11:25:01 AM - Client A1:B1:C1:D1:E1:F1 sent data to (google).

It may seem like a pretty harmless action, but now there's enough information to identify you. At this point, law enforcement would probably get a court warrant and ask Google, "We are trying to trace some malicious activity from [coffee shop's IP]. Did anyone log in to their account from [coffee shop's IP] at 11:25 on Feb 21?" Of course, Google would then check their logs and say, "Yep, someone logged in to an account belonging to [your name]," and your identity would be revealed.

Even if you were careful and didn't log in to your Gmail account manually, programs running on your computer could do essentially the same thing. Email clients, cloud storage sync clients, chat clients, and even your browser could automatically log you in to something that reveals your identity in this manner.

There's also browser fingerprinting. When you visit websites, your browser provides a string of text (called a user agent) to the site that identifies the browser and operating system version. This is mostly so that websites can improve user experience by providing different versions of the site for different browsers. In addition to the user agent, websites can request additional information such as the types of compression supported, plugins that are installed, etc. etc. Together, a website can gather so much information that your browser is essentially unique. If you want to see this for yourself, you can visit this site to see the information that your own browser is providing.

Browser fingerprinting could be used for tracking in various ways, but let's say that the website you hacked fingerprinted your browser. Then you go home, and at some later point in time (maybe months later), you decide to visit the website you hacked from your home connection, using the same computer/browser. The website admin would notice that your browser's fingerprint matches the earlier attacker's exactly, and now they have your home IP address.

Finally there's the physical aspect - chances are, the coffee shop's customers are pretty much limited to people who live close to it. If law enforcement can't find the attacker with digital evidence, they can always revert to old school forensics and check transaction records, narrow down suspects, interview people in the area, etc.

Obviously there are other ways beyond the one's I've mentioned, but hopefully this gives you an idea of how it might be done. Mostly, it comes down to linking the various traces that you leave on the Internet combined with diligent old-fashioned forensics work.

  • 1
    @esc You can take measures to make it harder like spoofing your browser fingerprint, spoofing your MAC address, etc. etc. but if you're willing to go though that much effort, you might as well just do all that from home and use multiple proxies to hide your IP address. That is why hackers don't often try to launch attacks from public hotspots. The amount of anonymity they provide can easily be replicated (and surpassed) by using proxies, VPNs, and anonymity networks like Tor. No need to go to the coffee shop and risk someone watching over your shoulder.
    – tlng05
    Feb 22, 2015 at 15:11
  • 1
    (1) Never visit a public access twice. (2) Don't stay online long while there. (3) Park far away. (4) Avoid cameras. (5) Use a fresh OS install on a burn laptop with the MAC spoofed. -- Basically good habits.
    – LaJmOn
    Feb 22, 2015 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .