Question about ISP's

Printable View

10-16-2011
JFonseka

Question about ISP's

This might seem like a strange question.

I have a friend who uses internet through a phone plan. He claims that if he wanted to he can hide himself from his ISP, because he uses a "personal proxy", and that if it came down to some investigation because he did something or the other. He wouldn't be able to be traced by authorities.

I insisted that since he's paying for a mobile plan and using the internet through that, he could still be obviously traced, proxy or not.

Background information on him, he's no hacker (obviously), and no real experience with anything technical with programming or IT in general.

Is what he says true?
10-16-2011
grumpy

No it is not.

The ISP will always know his login IP address (they assign it, either statically or dynamically), how much he uploads or downloads (they keep statistics, usually for billing purposes), when he logs in, and when he logs out. They will also be able to recognise any sites he visits (by IP address). If he uses a proxy, they can recognise the proxy (again by IP address).

The ISP, however, is perfectly placed to implement a classic "man in the middle" attack on their users, and log all traffic (upload or download) between the logged in user and any sites (or proxies). So, incidentally, can the "personal proxy" provider, unless it is some form of distributed routing (such as TOR, which is designed in a way to make it difficult to implement "man in the middle" attacks).

Of course, if the user is communicating with their proxy (or other sites) by secure means (eg SSL, tunnelling) the data the user uploads or downloads will probably be encrypted in some way. Depending on the strength of the security, it may take considerable resources for a third party such as the ISP to interpret (for example, decrypt) the traffic.

Generally, unless there is an urgent reason (for example, a court order) no ISP would bother to log their user traffic, whether they use a proxy or not, because it takes too many resources.
10-16-2011
Mario F.

Anonymous members and members of other hacking groups have been arrested before despite hiding their presence through encrypted proxy connections. The moment authorities get interested in your friend and have the necessary green light for investigation, internet technology is on their side. Not your friend's. It's a myth that of the perfect anonymous user. It might be true that of the very-difficult-to-find user, though.

In any case, since your friend announced himself to you, he already demonstrated he doesn't fully understand the concept of what he's trying to do. First rule about Fight Club.
10-16-2011
CommonTater

As grumpy points out, he may be able to hide his activity but not his presence. His service provider will always know when he's logged in and can track both his modem's MAC address and the IP address they assign.
10-16-2011
manasij7479

Just out of curiosity, is the same applicable for wireless connections and/or public wifi?
10-16-2011
whiteflags

I think it does apply since if you use the internet from your phone, at some point you will have to be routed through the underlying infrastructure of the internet to access non locally hosted things, and at that point, you will have a point of presence.
10-16-2011
CommonTater

Quote:

Originally Posted by manasij7479

Just out of curiosity, is the same applicable for wireless connections and/or public wifi?

The provider for the public hookup will always know who is connected to his service... or at least have the means to find out.

You can get a real good hint of this if you go to some advertising intensive site and notice how the ads always seem relevent to where you are...

My cousin's been keeping track... he goes to tim hortons he gets restaurant adds, in one local mall it's future shop and mark's, in another it's all hardware and appliances... all totally relevent to where he is at the moment.

So, yes, they pretty much know who's connected ... and where they are!
10-16-2011
laserlight

Quote:

Originally Posted by CommonTater

The provider for the public hookup will always know who is connected to his service... or at least have the means to find out.

Yeah, though I think the ISP itself would only be able to determine who provided the wifi service.
10-16-2011
JFonseka

Thanks for confirming my suspicions guys, I said something similar albeit less technically and he didn't believe me.
10-17-2011
Elysia

Who connects you to the Internet? Why, the ISP, of course. That means that any proxy you might have will always be connected "after" the ISP. So all traffic will first flow through the ISP, then your proxy.
So while you can "technically" hide from authorities or other agencies or people, you can't hide from your ISP. That doesn't stop authorities from tracking you down, though, of course.
10-17-2011
CommonTater

Quote:

Originally Posted by laserlight

Yeah, though I think the ISP itself would only be able to determine who provided the wifi service.

There will be routing information in the packet to be sure it gets to the right computer Lase... It's a tad complex and I'm not sure I'd get the explaination right but for my lan each packet will contain the lan's address on the net as well as my computer's address in the lan (subnet IP)... otherwise senders wouldn't stand a chance of getting a packet to my machine.
10-17-2011
laserlight

Quote:

Originally Posted by CommonTater

There will be routing information in the packet to be sure it gets to the right computer Lase... It's a tad complex and I'm not sure I'd get the explaination right but for my lan each packet will contain the lan's address on the net as well as my computer's address in the lan (subnet IP)... otherwise my local router wouldn't stand a chance of getting a packet to my machine.

The ISP still wouldn't know though, since such information is established per connection, not per contract with the ISP.
10-17-2011
Elysia

Quote:

Originally Posted by CommonTater

There will be routing information in the packet to be sure it gets to the right computer Lase... It's a tad complex and I'm not sure I'd get the explaination right but for my lan each packet will contain the lan's address on the net as well as my computer's address in the lan (subnet IP)... otherwise senders wouldn't stand a chance of getting a packet to my machine.

I suppose you still have me on ignore, but I'm going to ask anyway.
So far as I am aware, each packet will contain:

- Sender's port
- Sender's public IP (any private IP will be replaced by routers)
- Receiver's MAC address
- Receiver's port
- Receiver's public IP

So which ones are you referring to?
So if there is a proxy, it will swap the sender's public IP with its own, and thus only the ISP would know who the "true" sender is.

I may be missing something, and if so, feel free to fill me in.
10-17-2011
phantomotap

Quote:

There will be routing information in the packet to be sure it gets to the right computer Lase... It's a tad complex and I'm not sure I'd get the explaination right but for my lan each packet will contain the lan's address on the net as well as my computer's address in the lan (subnet IP)... otherwise my local router wouldn't stand a chance of getting a packet to my machine.

That's not how NAT works; the internet knows nothing of my local LAN including individual (real) MAC addresses, assigned range, or IP class. NAT works by directly mutating IP headers and associating state tables.

Messaging between a computer on a private network and a machine, one appearing as being directly attached to the internet, may pass through multiple NAT gateways before getting to the actual target.

An IP packet tells you the publicly associated origin and destination; it doesn't tell you anything about the actual communicators which include the hardware, software, and certainly the persons involved.

So, yea, the even the ISP only knows who owns or leases the public IP involved.

Soma