How to trace a hacker

Question

So, I'm a big fan of the cheesy 90's movies about hacking (read Hackers). I've been using computers all my life, which has brought me to university studying in Computer Engineering. The other day I was watching a familiar cheesy hacking movie and the super-smart-teenager-guy-who-works-for-the-FBI-and-was-hired-to-catch-the-hacker had caught the hacker on his system. He continued to enter some commands and was able to trace ALL the computer hops the bad guy had made before making a connection to the hacked computer.

My question is simple: is this possible? I know you can traceroute packets and see where they have been, but can the same be done for active connections to a computer? How do security firms and big-shot organizations like the FBI "trace" a hacker back to his destination. Assuming of course he's using several proxies around the world and maybe even the tor network.

Moreover, how would one go about removing the possibility of traceback or making it very difficult for others. The obvious answer would be hopping through as many computers as possible before getting to your destination.

To the moderators: I don't believe this question is off-topic. I'm asking about actual procedures and uses of current technologies.

Answer 1

Please have a look at this question over on Security Stack Exchange for some discussion on why this sort of tracing is often impossible. It can be done if the attackers are sloppy or boastful, but generally the way most attackers are traced is by following the money - the same way it has always been done.

Answer 2

The best hackers have steps, habits, processes they follow each and every hack that usually involve various combinations of proxies, compromised computers, timing differentials, and countries with laissez faire legal policies regarding technology security.

By employing all of these steps in different orders and with planned specific deviations they can mislead investigators, obfuscate their path, create multiple dead ends, and generally make it very difficult to trace them successfully.

Most successful hackers have incredible patience and take a long view of their attack. While some attacks appear to be quick, the setup behind a successful attack never is.

<rabbit trail>

Have you seen the Lockheed cyber security tv ad? I have no idea why they created such a hollywood-esque scenario for this 30-second spot that I assume is supposed to make them look like competent technology security people.

The only people it would impress are those who think hollywood offers accurate portrayals of technology and security.

</rabbit trail>

Answer 3

You can easily see all active connections to your computer, assuming it isn't infected. On linux, use "netstat -ta". On Windows, use Process Hacker, or some other task manager. If the hacker is using a proxy, then you would need access to the proxy to view its active connections. This is generally not possible, unless you happen to have access to a proxy the hacker is using.

If you're interested, read this: http://www.cert.org/archive/pdf/02sr009.pdf sections 8-12. The first half of the report basically says it's really difficult to trace because of how the internet works.