4 ms·

You'd need at least a little bit of remote code execution on the perpetrator's machine to lift his MAC address. Not guaranteed, but plausible. I expect the man

You'd need at least a little bit of remote code execution on the perpetrator's machine to lift his MAC address. Not guaranteed, but plausible. I expect the manufacturer to have a database correlating MAC address, serial number, date the device left the factory, and where (i.e. which retail store) it was shipped to. I expect the retail store's inventory tracking system to know when the device with that serial number was sold, by which cashier, at which register. If it doesn't know the (tokenized) credit card number and name on card directly, I expect the store to be able to find its copy of the receipts from that register at that time, which would contain the last 4 digits and name on card. If the purchase was relatively recent, I expect video of the register at that time. If the purchase was in cash but the video is still around, I'd also expect video of the purchaser walking out to his car, and (maybe separately) a shot of that car with good enough resolution to pick out the license plate. I don't think Joe Credit Card Fraudster gets this kind of attention, but someone who is believed to be a credible national security threat... absolutely.

askldfhjkasfhd 11y ago
This is all true, but it assumes optimal data retention by retailers, and a government agency with the skills (and willpower) to do the legwork. In reality, I would expect that one or more of those elements in the chain to be broken. Retailer lost their backups. Changed systems, threw out the old one. Doesn't keep records that far back. Etc. I agree there is a possibility they could track all these steps, but it would require everything working perfectly (from the authorities' POV)
celticninja 11y ago
If the purchase was in cash for a second hand item (possibly third hand or more) then it becomes very dificult to track the buyer down. Look around a second hand store for a laptop that is more than a few years old and it is likely to have had at least one other owner since the original purchase. Do not use the laptop for at least 1 week, that way any CCTV from the store has been overwritten and really by the time they manage to trace it from the manufacturer through any owners and on to the second hand store it will be perhaps 2 weeks after purchase. At this stage even public CCTV records will start to be overwritten. If you bought one well in advance, i.e. 2 or even 3 months before you used it then it would make it nigh on impossible to find the buyer. As an added level of security, a month after buying it make a post on craigslist to sell it as broken/not working. send an email to yourself from an internet cafe offering to buy it. Via email arrange a trade at a location without any CCTV. Plausible deniability if the police do ever show up at your door.

askldfhjkasfhd 11y ago

This is all true, but it assumes optimal data retention by retailers, and a government agency with the skills (and willpower) to do the legwork. In reality, I would expect that one or more of those elements in the chain to be broken. Retailer lost their backups. Changed systems, threw out the old one. Doesn't keep records that far back. Etc. I agree there is a possibility they could track all these steps, but it would require everything working perfectly (from the authorities' POV)

celticninja 11y ago

If the purchase was in cash for a second hand item (possibly third hand or more) then it becomes very dificult to track the buyer down. Look around a second hand store for a laptop that is more than a few years old and it is likely to have had at least one other owner since the original purchase. Do not use the laptop for at least 1 week, that way any CCTV from the store has been overwritten and really by the time they manage to trace it from the manufacturer through any owners and on to the second hand store it will be perhaps 2 weeks after purchase. At this stage even public CCTV records will start to be overwritten. If you bought one well in advance, i.e. 2 or even 3 months before you used it then it would make it nigh on impossible to find the buyer. As an added level of security, a month after buying it make a post on craigslist to sell it as broken/not working. send an email to yourself from an internet cafe offering to buy it. Via email arrange a trade at a location without any CCTV. Plausible deniability if the police do ever show up at your door.