 | | | 
18.08.2011, 15:20
|  | Forum Legend | | Join Date: May 2010 Location: In the kitchen at parties.
Posts: 4,540
Groaned at 204 Times in 120 Posts
Thanked 6,078 Times in 2,378 Posts
| | Re: Tracking an IP Address | Quote: |  | | | Ok, my friend is willing to release the IP and scenario.
His Gmail was hacked on April 3rd, and an email (whose content I shall not reveal, but suffice to say it is depraved) was sent from his account at 19:53 (Swiss Time).
The IP address which did this, was 194.230.155.12
Any help in identifying the culprit (and more importantly exonerating him) would be appreciated.
Thanks,
StirB | | | | | The obvious answer would be to place the culprit at the scene of the crime at that time, or conversely, was the victim anywhere near a PC/ a device with that IP address at that time and can he prove he wasn't ?
| 
18.08.2011, 15:21
| | Re: Tracking an IP Address
Ideally, prove it wasn't his device (or a device he had access to) which sent the email.
| 
18.08.2011, 15:22
| Forum Legend | | Join Date: Aug 2009 Location: Vaud
Posts: 4,518
Groaned at 491 Times in 320 Posts
Thanked 4,099 Times in 1,952 Posts
| | Re: Tracking an IP Address | Quote: | |  | | | What suspicions have been raised in my example ? I simply stated watching porn from somebody else's PC, not trying to blame them for it. | | | | |
That's the ART 174 about calomny, dumbass
I tried to translate the Art 174. I try again:
It seems if someone have made something to raise any suspicion toward someone that would be against honor (like watching porn from work). That someone is guilty of that offense and liable up to 3 years jail or/and a fine. | 
18.08.2011, 15:23
|  | Forum Legend | | Join Date: Jan 2009 Location: Romandie
Posts: 2,551
Groaned at 26 Times in 23 Posts
Thanked 5,004 Times in 1,827 Posts
| | Re: Tracking an IP Address
I imagine the authorities would be interested in this. | 
18.08.2011, 15:26
|  | Forum Legend | | Join Date: May 2010 Location: In the kitchen at parties.
Posts: 4,540
Groaned at 204 Times in 120 Posts
Thanked 6,078 Times in 2,378 Posts
| | Re: Tracking an IP Address | Quote: | |  | | | 
That's the ART 174 about calomny, dumbass 
I tried to translate the Art 174. I try again:
It seems if someone have made something to raise any suspicion toward someone that would be against honor (like watching porn from work). That someone is guilty of that offense and liable up to 3 years jail or/and a fine.  | | | | | Improve your English comprehension, then come back re-read what I said. You infer some kind of intent that was not made in my example.
| 
18.08.2011, 15:26
| Forum Legend | | Join Date: Aug 2009 Location: Vaud
Posts: 4,518
Groaned at 491 Times in 320 Posts
Thanked 4,099 Times in 1,952 Posts
| | Re: Tracking an IP Address | Quote: |  | | | Ok, my friend is willing to release the IP and scenario.
His Gmail was hacked on April 3rd, and an email (whose content I shall not reveal, but suffice to say it is depraved) was sent from his account at 19:53 (Swiss Time).
The IP address which did this, was 194.230.155.12
Any help in identifying the culprit (and more importantly exonerating him) would be appreciated.
Thanks,
StirB | | | | | 1) Although it's not really source of identification, remove the IP from here
2) Include in your police report to request google to display any source of logging to your friend account. A fraudulent access has been made by gmail, it's probably trackable (unless the suspect has used proxies).
3) Dont ask your friend to change the password, it might block the suspect to do again and be tracked | 
18.08.2011, 15:31
| Forum Legend | | Join Date: Aug 2009 Location: Vaud
Posts: 4,518
Groaned at 491 Times in 320 Posts
Thanked 4,099 Times in 1,952 Posts
| | Re: Tracking an IP Address | Quote: | |  | | | Improve your English comprehension, then come back re-read what I said. You infer some kind of intent that was not made in my example. | | | | | 
That why I said it "seems"... But it really seems so:
If one use someone else computer to access p0rn, it can raise any suspicion toward honor of the "victim". Therefore it would be an offense as per art 174.
| 
18.08.2011, 15:31
|  | Forum Veteran | | Join Date: May 2011 Location: Boston
Posts: 1,785
Groaned at 33 Times in 28 Posts
Thanked 3,013 Times in 1,242 Posts
| | Re: Tracking an IP Address | Quote: | |  | | | ISP's do no generally maintain firewalls for customers, but for internal security. Any traffic most likely went through a switch.
Also, ISP's have blocks of IP addresses, and due to the nature of mobile and laptop usage (on and off the network frequently), most lease times are very short so the address can be re-used quickly, reducing the size of the pool of IPs the ISP has to maintain/block book. | | | | | Well, right, as the whole point of the traffic accounting is mostly for incoming problems, not tracking outgoing customer traffic. And it depends on the network kit, too, since firewalls can often serve as switches. Most of the time it isn't enabled unless there's a network issue and, even then, the expertise to sift through these logs is minimal in most shops.
And, he might get lucky if the lease times on this ISP are fairly long since the IPs don't need to get reassigned every time you boot. It varies, but it could be a long while depending on the lease criteria. The DHCP table and IP range is less of a concern than the resources to manage frequent reassignments.
| 
18.08.2011, 15:34
|  | Moddy Wellies | | Join Date: Apr 2007 Location: North Yorkshire
Posts: 8,729
Groaned at 53 Times in 47 Posts
Thanked 9,942 Times in 3,654 Posts
| | Re: Tracking an IP Address
Oh noes. It's turned into a Geek Off.
Run!
| 
18.08.2011, 15:38
| | Re: Tracking an IP Address | Quote: | |  | | | Well, right, as the whole point of the traffic accounting is mostly for incoming problems, not tracking outgoing customer traffic. | | | | |
Almost.
That is, "Almost completely wrong."
Do carry on | 
18.08.2011, 15:43
|  | Forum Veteran | | Join Date: Aug 2006 Location: Nowhere
Posts: 1,680
Groaned at 65 Times in 49 Posts
Thanked 2,702 Times in 1,015 Posts
| | Re: Tracking an IP Address
Bit more info for you http://www.projecthoneypot.org/ip_194.230.155.12
Looks like a bot to me.
Some of that info is quite old though.
| 
18.08.2011, 15:43
|  | Forum Legend | | Join Date: May 2010 Location: In the kitchen at parties.
Posts: 4,540
Groaned at 204 Times in 120 Posts
Thanked 6,078 Times in 2,378 Posts
| | Re: Tracking an IP Address | Quote: | |  | | | Oh noes. It's turned into a Geek Off.
Run! | | | | | You were given fair notice by the thread title | This user would like to thank Upthehatters2008 for this useful post: | | 
18.08.2011, 15:46
| | Re: Tracking an IP Address | Quote: | |  | | | | | | | | Unless it is a super-bot, I think it must be human interaction, as emails were also replied to etc etc
| 
18.08.2011, 15:51
|  | Forum Veteran | | Join Date: May 2011 Location: Boston
Posts: 1,785
Groaned at 33 Times in 28 Posts
Thanked 3,013 Times in 1,242 Posts
| | Re: Tracking an IP Address | Quote: | |  | | | Do carry on  | | | | | Hrm, I hadn't realized the EU came up to speed on the draconian measures in the states. But Switzerland isn't part of the EU unless this is extended to Schengen states so it isn't clear that they must comply.
Of course, there's always Eschelon | 
18.08.2011, 15:55
| | Re: Tracking an IP Address | Quote: | |  | | | Hrm, I hadn't realized the EU came up to speed on the draconian measures in the states. But Switzerland isn't part of the EU unless this is extended to Schengen states so it isn't clear that they must comply. | | | | | Bilaterals and, of course, the bad press for CH following 9/11. | Quote: | |  | | | Of course, there's always Echelon  | | | | | ftfy | 
18.08.2011, 15:58
| | Re: Tracking an IP Address
The good news is that Zurich KaPo has a e-crimes division that might be interested in this.
The bad news is that it seems to be small fry in the scheme of things - a gmail account was allegedly hacked from a Sunrise IP?
Turn on 2-factor authentication for the Google services. Improve password complexity elsewhere and avoid open wifi and internet cafes.
Defend yourself first - if the cops are interested then the ISP may be required to turn over logs (that they must keep) so that an investigation can be carried out - no fishing permitted, court order all the way.
In my opinion, coming now with this when it seemed to happen in April means it'll be hard work.
| The following 3 users would like to thank for this useful post: | | 
18.08.2011, 16:02
|  | Forum Legend | | Join Date: May 2010 Location: In the kitchen at parties.
Posts: 4,540
Groaned at 204 Times in 120 Posts
Thanked 6,078 Times in 2,378 Posts
| | Re: Tracking an IP Address
Lastly, if the "victim" is accused of anything, the burden of proof lies with the accuser.
| 
18.08.2011, 16:03
|  | Forum Veteran | | Join Date: May 2011 Location: Boston
Posts: 1,785
Groaned at 33 Times in 28 Posts
Thanked 3,013 Times in 1,242 Posts
| | Re: Tracking an IP Address | Quote: | |  | | | Bilaterals and, of course, the bad press for CH following 9/11. | | | | | Bad press for CH? Just curious, what happened as I don't remember the Swiss getting much of a mention post 9/11...then again, I might have read it and forgotten. | Quote: |  | | | ftfy  | | | | | Thanks | 
18.08.2011, 16:13
| | Re: Tracking an IP Address
poptart, I think the SIMs used by the alleged terrorists before the 9/11 attacks were Swiss PAYG (Sunrise IIRC). The irony is to get a pre-pay SIM in the US does not need any government-issued ID like it does here.....
Let's clear up a few things.
1. ISPs are required to keep logs for a considerable period and they will know what consumer had what IP address at what time. It's the legal requirement of an ISP to do this. Be it a cable connection or DSL connection, with supplied CPE or not, they know who was connected when. Same for mobile subscribers.
2. Like with P2P, you need rock solid evidence to make progress. That's why there are few prosecutions in Switzerland on that topic and why this is small fry.
From my experience, there is little that can be done here apart from improving your own security habits. Everyone knows your Gmail username so do get a complex password or 2-factor authentication - it works with BlackBerry, iPhone and Android (and even SMS).
| This user would like to thank for this useful post: | | 
18.08.2011, 16:13
| | Re: Tracking an IP Address | Quote: | |  | | | Bad press for CH? Just curious, what happened as I don't remember the Swiss getting much of a mention post 9/11...then again, I might have read it and forgotten. | | | | | A significant number of the 9/11 involveds were said to be in possession of Swiss PAYG phones because there was no requirement6 to register them in any way at that time. | This user would like to thank for this useful post: | |
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | | Thread Tools | | Display Modes | Linear Mode |
Posting Rules
| You may not post new threads You may not post replies You may not post attachments You may not edit your posts HTML code is Off | | | All times are GMT +2. The time now is 22:12. | |