2

I have an IP address of someone who has stolen from my company, but I'm pretty sure they relayed through another computer. The IP address I have doesn't go to home or business, but to a field in the middle of nowhere. How can I find the original IP address?

I don't think they would have spoofed their IP, because I've read it's fairly difficult, and this person is only stealing $100 at a time.

I've already reported it, but I had a similar situation months ago that I also reported, and nothing came of it (theft is too small I guess). Now, this person, or several people, are stealing every other day, in small amounts, from different IP addresses each time.

My business is small and I can't handle much fraud so I need to try to find this person ASAP.

My programmers are working on changing the backend to close the gap, but this person has already taken $2500. Thanks for any help you can give.

user81737
  • 21
  • 3
  • What are you going to do if you find the IP address?

    Chances are, you can't. It is so easy to cover your tracks when doing something like this. Better just get the backend fixed as soon as possible.

     – mikeazo Jul 24 '15 at 19:06
  • The IP address I have doesn't go to home or business, but to a field in the middle of nowhere. How did you come up with that explanation? – kasperd Jul 24 '15 at 20:04
  • 1
    You would have to have the cooperation of the person/company,/business/ISP running the relayed IP. Even then you would only get the next IP in the chain. Pretty soon you have spent 1000 of hours and need lawyers and etc. The local PBS TV station, a few years ago, had a special about someone who followed the chain all the way back to Ukraine, If I remember correctly, who earns like $100/month max. In the process he lost his wife, all his friends, and was 2 million USD in the hole. And PBS buying the story was all that saved him. Don't be this person. – cybernard Jul 24 '15 at 21:14
  • If your uncommonly lucky you can do a whois and get the network range and block the whole range. However, I suspect, you won't be that lucky that there limited to 1 range. I have 57402 banned ip and counting. – cybernard Jul 24 '15 at 21:25
  • I'd at least try mentioning it to the ISP responsible for the IP and owners of the IPs. If the machines are owned by different people, chances are the person's either using Tor (in which case... good luck finding them) or they've hacked someone's machine (in which case that person has a vested interest in closing the gap and finding the perpetrator). You'll want to do a quick cost-benefit of time spent helping developers patch the problem v. time spent tracking down / revenging yourself upon the hacker. – Parthian Shot Jul 24 '15 at 22:07
  • 1
    Set an upper limit on time and resources you're willing to expend to catch this guy before you even start. And don't just spend the amount of resources they've taken to try to get those resources back; if you spend $2500 (or an equivalent amount of time) to track $2500, you've just lost $5000. – Parthian Shot Jul 24 '15 at 22:08
  • Please add to your question the way you get the suspected IP origin address of your attack? – dan Jul 27 '15 at 09:04
  • Why isn't the suspected IP origin address already blocked at your firewall? – dan Jul 27 '15 at 09:05
  • From all of the comments, it doesn't sound like it would be easy to do. The IP addresses I have are all different, and the reason I think they are relayed is because one user has an IP address in FL and one in CA, but I don't know enough about computers to know for sure. They use a different stolen credit card each time and a different IP address each time. We are adding an extra verification step to our process to deal with fraud. – user81737 Jul 27 '15 at 13:04
  • @kasperd The IP addresses I tracked landed in a field or industrial park, based on a Google search that gave me the latitude and longitude of the IP. They are all across the U.S. but I'm pretty sure I'm dealing with one person, not several. – user81737 Jul 27 '15 at 13:06

1 Answers1

3

Short answer: Without either a trusted place on the internet (access to an Internet Exchange [IX]), ability to subpoena ISPs for logs/records, or some other intelligence (e.g. this IP also has posted to wikipedia with information that could lead to their identity), you don't.

When one uses a relay or a VPN to obfuscate their IP, there is no way the other end can tell what the originating IP is. All of that information is not included in the packets. The only way to actually trace it would be to get records from the ISP of the IP they are using, and determine what other connections were active to that IP. From there, one can begin to determine the originating IP address.

There is no such thing as "spoofing their IP" on the open internet when it comes to TCP sessions. When one spoofs their IP, they change the packet header to indicate the packet has come from a different IP than their own. However, this causes any return packets to go to the spoofed IP, and not the real IP. IN the case of TCP traffic, which includes http, SSH and most protocols the attacker is likely to use, a TCP handshake could never occur. This is because the spoofed IP will not respond to the TCP SYN (synchronize) statements, and thus no TCP socket will be created and no data can be sent.

In order to spoof an IP address on the open internet, one would have to use a BGP hack or do something of that sort -- prohibitively difficult attacks typically restricted to nation-state level cyber staff.

The question becomes: Why does the IP address matter? If there is a way for someone to steal, close that vulnerability and eliminate your exposure; so no matter where they come from they can't do anything malicious.

Herringbone Cat
  • 4,332
  • 16
  • 20
  • I think you're making assumptions about how the IP address was obtained. – Neil Smithline Jul 25 '15 at 03:45
  • @NeilSmithline - how so? I'm addressing generalities on tracking IP addresses and don't see where I assume how one obtains the IP. – Herringbone Cat Jul 25 '15 at 14:50
  • You assume the IP was obtained in a way that would be hard to spoof. The question doesn't say enough for us to know that. – Neil Smithline Jul 25 '15 at 14:54
  • @NeilSmithline Ah yes. I do make it clear that only TCP sessions or packets requiring a return are hard to spoof -- others (TCP SYN floods requiring no reply, UDP, ICMP etc) can be spoofed one-way. However, can you think of a possible way that someone could steal money from a "spoofed" IP, from any web or internet accessible service, without being able to receive return packets? – Herringbone Cat Jul 25 '15 at 15:03
  • I can't figure out how they can be losing money and unable to stop it so I've concluded that I don't fully understand the situation. – Neil Smithline Jul 25 '15 at 15:16
  • I don't think this is someone spoofing an IP address only because it is much harder to do. I think they are using VPN or some other relay. – user81737 Jul 27 '15 at 13:04