Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So, I'm a big fan of the cheesy 90's movies about hacking (read Hackers). I've been using computers all my life, which has brought me to university studying in Computer Engineering. The other day I was watching a familiar cheesy hacking movie and the super-smart-teenager-guy-who-works-for-the-FBI-and-was-hired-to-catch-the-hacker had caught the hacker on his system. He continued to enter some commands and was able to trace ALL the computer hops the bad guy had made before making a connection to the hacked computer.

My question is simple: is this possible? I know you can traceroute packets and see where they have been, but can the same be done for active connections to a computer? How do security firms and big-shot organizations like the FBI "trace" a hacker back to his destination. Assuming of course he's using several proxies around the world and maybe even the tor network.

Moreover, how would one go about removing the possibility of traceback or making it very difficult for others. The obvious answer would be hopping through as many computers as possible before getting to your destination.

To the moderators: I don't believe this question is off-topic. I'm asking about actual procedures and uses of current technologies.

share|improve this question
    
Movies have absolutely nothing in common with the real world of tracking down hackers. Sophisticated brilliant hackers are never caught. They only get caught if they are sloppy and leave tracks behind. –  Moab Jul 8 '11 at 14:47
    
@Moab, I know movies are completely out there when it comes to seriousness. However, I'm more asking about the "methods" used in real life compared to the movies. –  MaxMackie Jul 8 '11 at 14:54
    
I am not a hacker, so they might know more, but if they go through someone else's server or infected computer along the way, I always thought that unless it was a real honeypot, with tracking software on it, there would be no way to trace it further. –  KCotreau Jul 8 '11 at 15:24
1  
Almost every system has logging of some sort. Good hackers will know how to wipe or modify the logs. –  music2myear Jul 8 '11 at 20:43
    
Voting to close as not constructive. This isn't a question that can be answered in it's current form. The subject is way to broad and would probably require a degree in computer security to and more space that is suitable here on SU to answer. –  Nifle Jul 8 '11 at 21:07

3 Answers 3

up vote 4 down vote accepted

Please have a look at this question over on Security Stack Exchange for some discussion on why this sort of tracing is often impossible. It can be done if the attackers are sloppy or boastful, but generally the way most attackers are traced is by following the money - the same way it has always been done.

share|improve this answer
    
Brilliant! Thanks for this. –  MaxMackie Jul 11 '11 at 11:25
    
Yay for RICO laws. –  music2myear Jul 11 '11 at 14:42

The best hackers have steps, habits, processes they follow each and every hack that usually involve various combinations of proxies, compromised computers, timing differentials, and countries with laissez faire legal policies regarding technology security.

By employing all of these steps in different orders and with planned specific deviations they can mislead investigators, obfuscate their path, create multiple dead ends, and generally make it very difficult to trace them successfully.

Most successful hackers have incredible patience and take a long view of their attack. While some attacks appear to be quick, the setup behind a successful attack never is.

<rabbit trail>

Have you seen the Lockheed cyber security tv ad? I have no idea why they created such a hollywood-esque scenario for this 30-second spot that I assume is supposed to make them look like competent technology security people.

The only people it would impress are those who think hollywood offers accurate portrayals of technology and security.

</rabbit trail>

share|improve this answer
1  
Here is the cyber Lockheed ad mentioned in the post youtube.com/watch?v=gT7r1D1iYiU Here is the full ad youtube.com/… –  Scott Chamberlain Jul 8 '11 at 16:41
    
Jim: Omg, they're attacking the main frame. I need to get to the poorly lit datacenter and press on buttons pretending I'm fixing it. Oh!? Whew, it was just a simulation. –  MaxMackie Jul 8 '11 at 20:26
    
Anybody see Eagle Eye? Frankly I thought the super computer depicted in there was one of the most embarassing, offensive computer systems ever devised by a hollywood studio. If you want overly brilliant computer than is at least plausible, go with the one portrayed for I, Robot. It wasn't pretty, but at least it wasn't ugly like the Eagle Eye one was. Infrared transmission in the computer? Come on! –  music2myear Jul 8 '11 at 20:42
    
There's basically 4 ways to follow such a trail. Social engineering to either exploit the hacker's ego or infiltrate their group, examining the compromised hosts used to bounce through, examining the network traffic on the compromised hosts, or large scale electronic eavesdropping. The last of which is only going to be an option for governments and only when national security is on the line. Ego, trust, sloppiness, curiosity, and underestimating what resources can/will be used against them are the mistakes that have to be exploited for a successful trace. –  Stephanie Jul 10 '11 at 17:28
    
My favorite script kiddie comuppence tale: ars.userfriendly.org/cartoons/?id=20010523 –  music2myear Jul 11 '11 at 14:41

You can easily see all active connections to your computer, assuming it isn't infected. On linux, use "netstat -ta". On Windows, use Process Hacker, or some other task manager. If the hacker is using a proxy, then you would need access to the proxy to view its active connections. This is generally not possible, unless you happen to have access to a proxy the hacker is using.

If you're interested, read this: http://www.cert.org/archive/pdf/02sr009.pdf sections 8-12. The first half of the report basically says it's really difficult to trace because of how the internet works.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.