Home » Data Protection » Malware/Cybercrime

Searching for Internet Perpetrators

Trying to trace Internet attacks backward to find the perp is an interesting exercisebut potentially fruitless.

Somebody is targeting one of your employees. First they sent a chatty message to Jack in accounting, posing as a coworker, asking Jack to e-mail confidential documents to a Hotmail account. Jack didn’t bite. Next they tried sending a message with a “zero-day” exploit for Microsoft Outlook. That attack failed because you run Notes in the office and Joe has a Macintosh at home. But the attacker isn’t giving up, and you’d like to know who it is. “Traceback” is your goal: That’s the term for using various tools and techniques to follow Internet connections or content back to their point of origin.

A naive analysis of the Internet protocol might lead you to believe that traceback should be easy. After all, every packet that’s sent over the Internet contains the IP address of both its destination and its source. So when packets containing nasty attacks or hostile content show up at Jack’s computer, you should be able to determine the guilty party just by capturing a few packets and then looking at the source address in their packet headers.

Alas, traceback runs into an increasing number of snags, depending on how thoroughly the attacker has covered his tracks.

Return to Sender

First, you can’t trust the source address in the packet header. Most operating systems allow programs to fill in any address that they want. Denial-of-service (DoS) attacks are commonly based on the “ping” capability of the Internet common messaging protocol (ICMP) or on the user datagram protocol (UDP), because the Windows and Unix operating systems make it possible for any program to forge the return address. And since ICMP is frequently used for debugging network problems and UDP is used for streaming media like music and video, most organizations don’t want to block these packets.

Forgery is less of an issue with attacks that use the transmission control protocol (TCP). TCP is a bidirectional protocol that’s used for transmitting Internet traffic like webpages and e-mail. Because the protocol requires that both sides be able to communicate, an attacker who forges his source address with TCP usually won’t be very successful, because he won’t know what to send back to the victim computer to allow the connection to progress. But as it turns out, even though it’s very difficult for an attacker to forge an IP address with TCP, it’s still possible for him to hide his location rather effectively.