5
3
So, I'm a big fan of the cheesy 90's movies about hacking (read Hackers). I've been using computers all my life, which has brought me to university studying in Computer Engineering. The other day I was watching a familiar cheesy hacking movie and the super-smart-teenager-guy-who-works-for-the-FBI-and-was-hired-to-catch-the-hacker had caught the hacker on his system. He continued to enter some commands and was able to trace ALL the computer hops the bad guy had made before making a connection to the hacked computer.
My question is simple: is this possible? I know you can traceroute
packets and see where they have been, but can the same be done for active connections to a computer? How do security firms and big-shot organizations like the FBI "trace" a hacker back to his destination. Assuming of course he's using several proxies around the world and maybe even the tor
network.
Moreover, how would one go about removing the possibility of traceback or making it very difficult for others. The obvious answer would be hopping through as many computers as possible before getting to your destination.
To the moderators: I don't believe this question is off-topic. I'm asking about actual procedures and uses of current technologies.
1Movies have absolutely nothing in common with the real world of tracking down hackers. Sophisticated brilliant hackers are never caught. They only get caught if they are sloppy and leave tracks behind. – Moab – 2011-07-08T14:47:18.477
@Moab, I know movies are completely out there when it comes to seriousness. However, I'm more asking about the "methods" used in real life compared to the movies. – n0pe – 2011-07-08T14:54:11.617
I am not a hacker, so they might know more, but if they go through someone else's server or infected computer along the way, I always thought that unless it was a real honeypot, with tracking software on it, there would be no way to trace it further. – KCotreau – 2011-07-08T15:24:05.637
1Almost every system has logging of some sort. Good hackers will know how to wipe or modify the logs. – music2myear – 2011-07-08T20:43:29.877
1Voting to close as not constructive. This isn't a question that can be answered in it's current form. The subject is way to broad and would probably require a degree in computer security to and more space that is suitable here on SU to answer. – Nifle – 2011-07-08T21:07:49.453
@Nifle: You're suggesting to close this on account of the SU community not being able to answer? Come on. I am asking a pretty pointed question here: "How can someone be traced back to the original computer?" – n0pe – 2011-07-08T21:15:22.287
1@Max - No I'm voting to close because noone can answer it in a way that fits the SE formula. You would need a research level paper to discuss all the different ways to achieve this. – Nifle – 2011-07-08T21:21:30.830
1@Nifle - better off migrating to security stack exchange, where this is very on-topic – Rory Alsop – 2011-07-11T08:48:11.870
@Nifle, try answering first, then migrating, and only then closing. Otherwise you quickly make yourself PNG. – music2myear – 2011-07-11T14:43:35.683