Take the 2-minute tour ×
Arqade is a question and answer site for passionate videogamers on all platforms. It's 100% free, no registration required.

Similar to my previous question about passive traces, I'm wondering from where a passive trace starts; from as close as the active trace reached, or starting at the target server.

For instance, the typical method is to delete one's logs from the first bounce point -- typically Internic, but this still requires going to a different server to delete the logs. If I have the time remaining on a trace and wish to remove the transfer logs from the machine I'm actually hacking using Log Deleter, would that make me safe, rather than making a separate connection to Internic?

share|improve this question
    
I've been wondering about that as well. I made a habit of making my connection seem as innocuous as possible and deleting InterNIC logs, but never got around to testing where the passive trace actually started. –  kotekzot Apr 1 '12 at 23:21

1 Answer 1

They start on the server you broke into, when the owner company discovers what you did. A passive trace is just a company looking at their logs, and the logs of all your bounce nodes in reverse order, to figure out whodunit. They might also hire a colleague of yours to track you down.

You can delete logs on the target system, but, consider this: You can't completely hide your tracks.

If you delete all the logs, you will leave behind a single disconnection log when you leave, with no matching connection log. This is suspicious.

Even when you leave your initial connection log and only remove suspicious activity, the company will still be aware of the general time when your attack occurred, and may put 2 and 2 together.

The exception is of course when you delete everything, including the OS, and then crash the system so no logs are left behind. But even then, there's the lingering risk that the company has started following the log trail while you were connected.

Removing the logs from a bounce node (typically the first one so you can take your time) is just so much safer. If the bounce logs are missing from a single node in the chain, they won't have enough evidence to incriminate you.

share|improve this answer
    
"If the bounce logs are missing from a single node in the chain, they won't have enough evidence to incriminate you." Is it true ALWAYS? –  Zoltán Schmidt Aug 29 '13 at 0:41
    
@ZoltánSchmidt Yes and no. If the company puts a fellow hacker on your trail, they could undelete the missing logs and nail you that way. The only way to rule this out is to use the latest version of the log deleter, which can't be undeleted. –  lunboks Aug 29 '13 at 10:40
    
Nowadays, I always do it ASAP. Thanks! –  Zoltán Schmidt Aug 29 '13 at 12:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.