Tracing the Hack 2

(Finally Part 2)

We continue the story of Totoy the hacker
( http://itphonehome.blogspot.com/2006/08/tracing-hack.html) who succesfully hacked into his school's web server and defaced his school's official webpage for revenge on a school official. He used a commercial DSL account for this purpose.

At the ISP

Bagito found that the IP address used for the hack is assigned to an ISP in Manila. Armed with a search warrant, Bagito went to the ISP in question to look into their records corresponding to the time stamp he got from the server. Fortunately, the ISP was in very cooperative mood and more fortunately, the ISP has not yet deleted its logs pertaining to that time frame. Assisted by one of the ISP's topnotch system administrator, they were able to get to the log file and match the IP address with the time stamp from the server. With these information, they were able to get the account details of the owner of the said DSL account. At this stage, Bagito may now have the necessary information to obtain a seach warrant to be used in his quest to obtain the computer used in the perpetration of the hack.

Summary

This story of Totoy and Bagito for all intents and purposes is a very simplified version of an account of a hacker. A true-to-form hacker will not leave such telltale traces of his or her work. Of course, a competent system and network administrator will not leave his system undefended, or at the least will see to it that the system's logging mechanism is adequate for tracing purposes. As can be seen from the story, the success of knowing who the hacker is depends on the initiative of many persons to in safeguarding their respective systems. If there is no logging mechanism in place, and if there is one, making sure that the data stays intact for a reasonable time, is essential to knowing the identity of the hacker. The cooperation of these people is indispensable.