Home > Archives > July 2006 >

Machine Shop

Searching for Mr. Wrong

Trying to trace Internet attacks backward to find the perp is an interesting exercise—but potentially fruitless.

By Simson Garfinkel

E-mail this article  |  Printer friendly

Advertisers

Somebody is targeting one of your employees. First they sent a chatty message to Jack in accounting, posing as a coworker, asking Jack to e-mail confidential documents to a Hotmail account. Jack didn’t bite. Next they tried sending a message with a “zero-day” exploit for Microsoft Outlook. That attack failed because you run Notes in the office and Joe has a Macintosh at home. But the attacker isn’t giving up, and you’d like to know who it is. “Traceback” is your goal: That’s the term for using various tools and techniques to follow Internet connections or content back to their point of origin.

A naive analysis of the Internet protocol might lead you to believe that traceback should be easy. After all, every packet that’s sent over the Internet contains the IP address of both its destination and its source. So when packets containing nasty attacks or hostile content show up at Jack’s computer, you should be able to determine the guilty party just by capturing a few packets and then looking at the source address in their packet headers.

Alas, traceback runs into an increasing number of snags, depending on how thoroughly the attacker has covered his tracks.

Return to Sender

First, you can’t trust the source address in the packet header. Most operating systems allow programs to fill in any address that they want. Denial-of-service (DoS) attacks are commonly based on the “ping” capability of the Internet common messaging protocol (ICMP) or on the user datagram protocol (UDP), because the Windows and Unix operating systems make it possible for any program to forge the return address. And since ICMP is frequently used for debugging network problems and UDP is used for streaming media like music and video, most organizations don’t want to block these packets.

Forgery is less of an issue with attacks that use the transmission control protocol (TCP). TCP is a bidirectional protocol that’s used for transmitting Internet traffic like webpages and e-mail. Because the protocol requires that both sides be able to communicate, an attacker who forges his source address with TCP usually won’t be very successful, because he won’t know what to send back to the victim computer to allow the connection to progress. But as it turns out, even though it’s very difficult for an attacker to forge an IP address with TCP, it’s still possible for him to hide his location rather effectively.

One way to do so is to bounce the attack through an intermediary, using simple techniques like finding an open proxy server, or complicated ones like renting time on a ‘bot net’—that is, a network of compromised machines. This creates a chain of return addresses. Although you can try tracking backwards one jump at a time, such tracing is difficult and slow and will be problematic if there is an uncooperative ISP somewhere in the middle.

Given the limitations of using the return address, there are other ways that you can try to get the IP address of the attacker. You can send the attacker an e-mail message with a Web bug in it. Web bugs are very small images that monitor and report on who is reading a message or viewing a page. If the attacker is careless enough to open the e-mail on his computer, the Web bug can reveal the attacker’s location. Web bugs can also be embedded into Microsoft Office documents, so another tactic you can try is to leave a booby-trapped Word file where your attacker will discover it, and then wait to see if anybody triggers the embedded tracking device.

Unfortunately, getting somebody’s IP address is often just the first step of a traceback exercise. On today’s Internet, just about every IP address is assigned to an Internet service provider, a company, a governmental organization or a university. By consulting databases run by the Internet registries, you can pretty easily figure out the organization to which any given IP address belongs. But going from that organization to a particular individual is a much more difficult task. Although some organizations permanently assign each IP address to specific users, most use IP addresses that are dynamically assigned to different users at different times. In either event, you need the cooperation of the organization to consult either their administrative records or their log files. Some organizations won’t cooperate unless a court compels them. And in some countries the courts just don’t care about your plight.

Even if you have an IP address and the organization wants to cooperate, you might still be out of luck. The IP address might belong to a wireless access point—and it’s a very rare access point indeed that keeps detailed logs about who connected to it and when.

The IP address could also be wrong. In many cases the attacker can simply “borrow” the IP address of someone else in his organization. A sophisticated attacker will change both his IP address and his Ethernet address. Although every Ethernet interface sold today comes with a unique 48-bit address that’s burned in at the manufacturer, every interface on the market also can be reprogrammed to use any other 48-bit address. You can even do this trick with wireless Ethernet addresses.

1  2  || Next >>