4 ms·

This is a bit beyond my knowledge of TCP/IP, however, does this support Putin's assertion that hackers can make an attack appear to come from Russia when they c

This is a bit beyond my knowledge of TCP/IP, however, does this support Putin's assertion that hackers can make an attack appear to come from Russia when they could be based somewhere else? How much work do you have to do to make it that your IP address is from somewhere credibly in some other country?

mirimir 9y ago
You can use a service that pings (or traceroutes) a given address with multiple probes. Round-trip lightspeed is 150 km/msec. So if you see a probe location with minimum rtt on the order of 1 msec, that's about where the address is. And conversely, if you see probes at the claimed location with minimum rtt over 20 msec, be suspicious. Ping services with many probes: https://asm.ca.com/en/ping.php https://asm.ca.com/en/ping.php https://www.maplatency.com/ https://www.maplatency.com/ https://ping.pe/ https://ping.pe/
- notyourwork 9y ago
  Great point! Also, you can also have your attack derive from Russia. Russia (the government or a Russian hacker group) doesn't have to be behind the attack for it to look like its sourced from Russian internet space.
vim_wannabe 9y ago
You can see a clip of a hacker you may recognize in action here (dramatised): https://www.youtube.com/watch?v=bhS-7jxBgXQ https://www.youtube.com/watch?v=bhS-7jxBgXQ
mitchs 9y ago
I'd say not really. BGP based lies are hilariously easy to spot, and can be observed by any ISP in the world. When the US Intelligence community blames Russia for hacking they aren't just doing geo-ip lookups and believing what they see. Anyone with a credit card these days can rent a server in any country anyway, so origin of traffic is more or less useless.
- comex 9y ago
  > Anyone with a credit card these days can rent a server in any country anyway Including North Korea? :)
  - isostatic 9y ago
    It would make sense for NK to sell VPn and server space to clients fro hard currency.

mirimir 9y ago

You can use a service that pings (or traceroutes) a given address with multiple probes. Round-trip lightspeed is 150 km/msec. So if you see a probe location with minimum rtt on the order of 1 msec, that's about where the address is. And conversely, if you see probes at the claimed location with minimum rtt over 20 msec, be suspicious. Ping services with many probes: https://asm.ca.com/en/ping.php https://asm.ca.com/en/ping.php https://www.maplatency.com/ https://www.maplatency.com/ https://ping.pe/ https://ping.pe/

notyourwork 9y ago
Great point! Also, you can also have your attack derive from Russia. Russia (the government or a Russian hacker group) doesn't have to be behind the attack for it to look like its sourced from Russian internet space.

vim_wannabe 9y ago

You can see a clip of a hacker you may recognize in action here (dramatised): https://www.youtube.com/watch?v=bhS-7jxBgXQ https://www.youtube.com/watch?v=bhS-7jxBgXQ

mitchs 9y ago

I'd say not really. BGP based lies are hilariously easy to spot, and can be observed by any ISP in the world. When the US Intelligence community blames Russia for hacking they aren't just doing geo-ip lookups and believing what they see. Anyone with a credit card these days can rent a server in any country anyway, so origin of traffic is more or less useless.

comex 9y ago
> Anyone with a credit card these days can rent a server in any country anyway Including North Korea? :)
- isostatic 9y ago
  It would make sense for NK to sell VPn and server space to clients fro hard currency.