We often hear about evidence, hackers being caught, and other operations that allege to prove who the culprit is. We immediately hear that the NSA, CIA, FBI, (insert alphabet agency) is on it and will have an answer soon. As someone who actually has been using the internet for a long time, and who deals with security issues on a regular basis I believe most of this is the media being used to pull the wool over the eyes of the people due to their ignorance of how the internet actually works.

I've written about this before specifically focused on the Russian hackers. This post I instead want to try to demystify some of what it actually would take to catch the actual "hacker".

If the Hacker is stupid

If the hacker is stupid and does not know what they are doing, or are perhaps simply a script kiddy (someone who uses tools made by other people to do all the work and may not actually be able to do it themselves without those tools) then you might be able to prove who that hacker was and what they were doing from a single incident. It should be noted that script kiddy does not mean stupid. Why make your own tool if there is already one out there that works? This frees your time up to focus on making tools that can do more, or other things. So my use of the term was not intended as "derogatory" but more describing a difference between those that make their own tools, and those that use tools made by others.

When you make a connection over the internet it will show the port you came in on, and the IP address you originated from. There are other details too, but most of those you do not need to know for this simple explanation.

So this stupid hacker would jump from their OWN location, or a location they frequently are at and the IP address could lead back to them.

The other method is if they leave their name or something that identifies them in all of the commands and files they manipulated in the server. That would be like me saying "Deva Winblood" was here. Using a handle and leaving something like "CoolBadAss" is stupid too, because if you use that handle anywhere else it can be something to eventually use to identify you. It is kind of like leaving "Gucifer 2.0" in the files somewhere. It is tagging. That is stupid if your goal is not to get caught.

It should be noted that the presence of this data is not definitive proof either. If I was a hacker and was pissed at another hacker I could do the equivalent of SWATTING and plant your name and handle in my hack. Thus, I put another hacker in the spot light by using their name when I hack.

Let's assume they are not that dumb

So what type of evidence can we collect?

IP ADDRESSES, PORTS, and TIMES.
We can also look at logs to try to determine what activities and actions they did when they were on the system, assuming they did not clean up after themselves. Yet this will be them typing commands. It will not be them saying "Hi, I'm Gucifer 2.0" unless they are stupid (see my earlier post).

The IP Addresses will be owned by someone. The IP Address blocks are usually registered at ARIN if you are in North America, and other countries have a different registry. Using a WHOIS tool you can see who owns that IP address. It will be part of a block. The smallest block a company can register is a /24. This is 256 addresses.

So that IP Address will come back as COMCAST.NET or something like that.

You can then reach out to COMCAST and see who has that and they can check their records and say it is a specific client if it is a static IP (doesn't change). If it is DHCP (assigned dynamically and can change) they can use the time the IP was used with logs and likely tell who that client was.

The client might have a block of IPs they get from Comcast. The client also might be something like a Starbucks or a Motel. Now you know the general location it supposedly happened at, but it is a site that serves many people and they likely connect through local DHCP... so odds of you knowing who it actually was is unlikely. This is true in terms of piracy as well as hacking.

Yet if they know what they are doing and they are hacking then this location will actually have NOTHING to do with the hacker.

What the smart hacker does

The smart hacker will have over the weeks, years, etc have spent time in hacking into as many places as they can AROUND THE WORLD. They will keep a list of machines they have compromised. It is very likely they will have gotten some level of login access to some machines or devices.

The smart hacker will login to one of those devices (possibly in a completely different country) and use something like SSH or TELNET to then attempt to hack their desired target. Their desired target will see the IP address of the device/location they are SSHing from.

Yet they can take this further. They can connect to a device they have compromised, from there SSH/Telnet into another device, from there another, and another, and then go for their target. This means even if you attempt to trace the IP back by finding where it happened, painfully examining logs, security cameras, and anything else all you'll find is the next IP. You'll need to repeat these steps.

Wait it get's better

If you get enough access you can use a Virtual Private Network (VPN) in part of your travels and some VPN clients intentionally are designed to drop all logs. Once the trace hits that node in the trail the trail goes cold, because you no longer know the next IP address. This is how TOR, Onion Routers, and the Darknet, etc. operate. They use routers that were intentionally design to pass traffic but keep NO RECORD of it.

So they claim to have evidence?

Based upon my knowledge such a claim is unlikely unless their target is really stupid and inexperienced. It is far more probable that the story being presented is a bullshit cover, or smear story.

How can they catch them?

Basically, they need to catch them making a mistake. This will not be from examining a compromised machine. It would require a coordinated sting, and setting up things like Honey Pots (machines intentionally designed to be compromised that then allow you to monitor and attempt to trace the hacker while they are performing activities on the machine).

You can then get the general area and might trace it to a final IP, yet even that does not prove it was a specific person. You would need to continue your sting, and eventually execute something like a search warrant, and you would need to find the incriminating material on an actual device owned by the person, or burst in while they are in the ACT. Then you will have caught your hacker.

If the hacker does something like blackmailing someone for money, etc then you can trace the money too. Yet if there were no money transfers done related specifically to the hack you cannot use that method.

What does this say about the Russian Hack?

I truly believe it is total fabricated bullshit. It is a smear campaign and they have no actual evidence. If they had the evidence it would not compromise national security to share it. The very best information they likely could get is the IP ADDRESS of the first hop that accessed the server, and a log of the commands that were typed in (if those were not wiped).

Yet that would require them having access to the servers, which reportedly the FBI has not been given. So is it possible they have EVIDENCE in such a situation? Not real evidence. It is not possible under those conditions. They could have FAKE made up evidence.

Now as I said in my post. Let's say they provide a Russian IP address... That is meaningless. A stupid hacker would use that. If I compromise a Russian machine from my house I can then SSH from that machine back to the U.S. and it will say the hacker had a Russian IP address. It by itself is meaningless. Proof in the hacking world requires a VERY STUPID mistake, or catching them red handed AT THEIR LOCATION PHYSICALLY in the act.

You decide who you think is pedaling the #fakenews...

Steem On!