Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 118 guests and 7 members online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Otherarrow Not sure where to put this; Can someone identitfy beyond WHOIS look up + bkstory
EH-Net
February 10, 2012, 07:49:56 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Not sure where to put this; Can someone identitfy beyond WHOIS look up + bkstory  (Read 4458 times)
0 Members and 1 Guest are viewing this topic.
Bozzums
Newbie
*
Offline Offline

Posts: 5


View Profile
« on: June 25, 2009, 09:54:12 AM »

Recently, somebody claimed I leaked information on the web. I did not. I did however, find it on usenet and was distributing via p2p, not realizing this would be a problem...

The claim is that they traced my IP. I use a major ISP which claims that they would not divulge short of a court order, or without notifying me, unless it came from a governmental agency.

The rub is that there is a log file with the files that indicates hardware I don't own, but beyond that, I don't believe them.
There was a physical security failure at an event, and because I had my laptop, they blame me (imho). I found the files several days later and did not know the files are the ones they were using at the event (because I was working as facilities staff-lights operator, not actually using the files at the event).
Now, beyond all the potential failure points in their chain, could they have actually identified anyone via an IP? My guess from perusing these forums is no.
 
I do use a static internal IP after the ISP modem to facilitate open ports for certain connectivity. They do not have attys, and are not likely involved in a police investigation.

The only reason I ask is because of countless stories of 'Anonymous' tracking peoples identities via forum posts et cetera...
They do it somehow....
Logged
BillV
Hero Member
*****
Offline Offline

Posts: 1790


View Profile WWW
« Reply #1 on: June 25, 2009, 10:20:53 AM »

I really have no idea what you're trying to explain.

You start off on information leakage, then go to IP tracing, then start talking about this 'event' ...

I'm a bit lost Huh
Logged
viruz
Jr. Member
**
Offline Offline

Posts: 50


View Profile
« Reply #2 on: June 25, 2009, 10:42:25 AM »

I really have no idea what you're trying to explain.

You start off on information leakage, then go to IP tracing, then start talking about this 'event' ...

I'm a bit lost Huh

Lol bro, i think he asked a question and his main purpose of posting is to ask the questions but think if he frames it well, it will yield him replies.

the question he actually asked in the long story is "CAN SOMEBODY BE TRACED USING HIS IP ADDRESS"

@Bozzums, to me the answer is YES, you said you are on a static IP which means it do not auto change, it remains the same, if a whois is conducted on your IP, it will display the range, the location, your ISP, emails, phone numbers and many other things....an attacker can call or send an email with a report to your isp to reporting your IP address, your ISP have all your information used in registering for your account, this which they can reveal to the attacker and there you are, no more anonymous because your identity is revealed.

that is why many people use vpn and spoof their ip to hide their original ip given to them by the ISP.

Logged
Bozzums
Newbie
*
Offline Offline

Posts: 5


View Profile
« Reply #3 on: June 25, 2009, 10:45:25 AM »

my precise question is :
Is it possible to trace an identity with an IP gathered via a p2p connection that utilizes a static internal IP and an open port?

The main IP is via a dhcp modem, and while the external IP remains unchanged for days, it is not static nor registered to me. The internal one is static for port forwarding. My tracing (traceroute, whatsmyip, et cetera) dead ends at the ISP.

I'd say no, but it seems nefarious types (like 'Anonymous') can get average citizens identities all the time, and there could be IT savvy people involved...
« Last Edit: June 25, 2009, 10:57:19 AM by Bozzums » Logged
unsupported
Sr. Member
****
Offline Offline

Posts: 318


Unofficial Newbie Moderator


View Profile
« Reply #4 on: June 25, 2009, 11:34:52 AM »

So, you were working at an event, where there was some kind of situation with physical security.  You had a laptop with you at the time of the event.  After the event you downloaded information regarding the event from USENET and shared it out via p2p.  Now someone related to the event is claiming that you are responsible for the situation with physical security?

First off, dude, you sound way too guilty.  Second, it does not matter if they "could" track your IP address to you.  I am sure they did (hint: there are a lot of coincidences in your story).  It would not take your ISP top figure this out.  Opening a p2p connection with someone else reveils a lot of information about you and your computer.  That is why people mentioned using VPNs, anonymizers, or otherwise spoof IPs.  Anyway, if "they" do not have an attorney or have involved law enforcement, then why are you worried?

If you are guilty, get yourself a lawyer who knows about computers and related laws.  If you are not guilty, then... well... stop doing poop which may lead you into trouble.
Logged

-Un
CISSP, GCIH, GCIA, C|EH, Sec+, Net+, MCP
Bozzums
Newbie
*
Offline Offline

Posts: 5


View Profile
« Reply #5 on: June 25, 2009, 01:32:30 PM »

well, whatever. My dvd drive is broken (thinks all cds and cd-rs are blank), and a lot of people know this.
I think this is why I've only heard of this through scuttlebutt. Also, the files are somewhat different (as I understand it) which is also why they haven't heard from them-they have my phone number. Friends have told them to use secure thumb drives from now on...
I'm guessing I won't hear about this...

and believe me, I will more thoroughly research anything I down and share.

Also, I think its a seeder in a FIOS network...I have some evidence of this.

Thanks though, I was just curious if they were trying to intimidate my friends w/ bs.

But I agree it looks odd. I'd gladly let them see my hardware and sys logs.... if they bother to call. I think they won't...
This all went down a week and a half ago and they may have since found the real leaker...
Logged
unsupported
Sr. Member
****
Offline Offline

Posts: 318


Unofficial Newbie Moderator


View Profile
« Reply #6 on: June 25, 2009, 02:31:46 PM »

So, nobody has even contacted you directly about the alleged files?  Sounds like you friends are pulling your leg on this one.

You remind me of Joey from Hackers.  It is the scene where he says he hacked a server and then he hears on the news that an ATM started spewing out $20s all over the street, but they are BOTH related incidents.

I found it at 3:47: http://www.youtube.com/watch?v=Xy0NU-rAlT8
Logged

-Un
CISSP, GCIH, GCIA, C|EH, Sec+, Net+, MCP
Bozzums
Newbie
*
Offline Offline

Posts: 5


View Profile
« Reply #7 on: June 25, 2009, 03:47:46 PM »

Oh I think its related and I was being an idiot. I just never ripped them or walked of with a copy. They brought two and left with two. The physical security issue is they lost a copy for a minute (a blue lighting gel was laying on it). Nobody left or entered the room b4 it was found though.
I was seeding later, after all.
and w/o researching.
bad.

Actually, I did run into the sound guy and he told me they thought it was me... that was a week and a half ago.

The event was two weeks ago.

As far as p2p security, I don't usually get involved in anything new or in theaters or often stuff that's easily available. Netflix, last FM and Hulu make it all kind of pointless.
I'm more interested in stuff thats old and rare. Ergo Usenet, I know that new stuff leaks there too, but that isn't generally the nature of my interest. I was hoping to help my ratio in this instance. And usenet isn't available through my ISP anymore (lame!), only at that job (they use a small ISP i've never heard of). I was even so busy at the event that I didn't recognize the files, because I wasn't operating that computer and I do so many events that I tend to only know what I need to...

Thanks for the info. I'll keep my nose clean.

Hackers is a silly movie, btw. Grin

Logged
aweSEC
Hero Member
*****
Offline Offline

Posts: 1090


View Profile
« Reply #8 on: June 26, 2009, 12:29:20 AM »

my precise question is :
Is it possible to trace an identity with an IP gathered via a p2p connection that utilizes a static internal IP and an open port?

I would say yes, it is.

Not sure if I understood everything correctly but as youself were not contacted by any lawyer or similar I wouldn't be so nervous about it (?). However, if you are in doubt I would contact a lawyer who is specialised in computer laws.
Logged
BillV
Hero Member
*****
Offline Offline

Posts: 1790


View Profile WWW
« Reply #9 on: June 26, 2009, 05:43:18 AM »

my precise question is :
Is it possible to trace an identity with an IP gathered via a p2p connection that utilizes a static internal IP and an open port?

I would agree with the above reply to this as well. The internal IP and open port don't really matter (unless you're on a large network). Your public IP is going to be visible in the p2p network. There have been a variety of vulnerabilities found with p2p software, so if you have it open there's a chance someone could get access to the rest of the machine. Or maybe get access to just other documents that have your name in them, etc. For example, it doesn't do you any good if you have a Word document that's shared/available and in the properties the author field says "Joe Smith."
Logged
Bozzums
Newbie
*
Offline Offline

Posts: 5


View Profile
« Reply #10 on: June 26, 2009, 03:02:16 PM »

thought about the Joe Smith thing today, and noticing that my tinfoil hat behaviors kind of make this moot. Everything 'File Vault' encrypted and my machine thinks my name is a pseudonym (not linked to me).

I suppose someone could get the mac address of a machine, which isn't registered anywhere any way (other than at manufacturer and point of sale).

Which brings me to another thought; What is everybody so worried about then?
If someone wanted to own a network, wouldn't leaving a usb stick to be 'found' by a fool or samaritan that plugs it in at work, releasing software coded to open something up be far more effective than attacking open ports in a firewall?

Getting an IP via a yahoo messenger connection is neet and all, but ultimately gives no real info, and it just seems to me that most of this revolves around better safe than sorry. I'd like to know what sort of 'identifiable information' can be seen by a general p2p connection beyond the possibility of viewing documents and a random yet real mac address

BTW, the amount of info on this site is wonderful.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.233 seconds with 23 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge Training: Build Security Skills to Protect and Defend

offsec_130x200-2_jan-feb2012.png
Offensive Security
AWE Live in the Caribbean!
March 5 - 9, 2012

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: Refer_EHN
Including SANS Phoenix 2012, SANS 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.