POST 05.01

If you are sneaking into a house, whether to look for something or to take something, you have to be careful about leaving an evidence of your 'visit'. (At least you do if you don't want a long stay in a small room.) You wear clothes that are untraceable, shoes that don't have a distinctive tread pattern, and plastic gloves to hide your fingerprints. As you move around the house, you need to be careful that you don't disturb anything. If you are looking in a desk drawer, you try to put everything back in it's original spot. When you leave the house, there shouldn't be any evidence that you were ever there.

When breaking or hacking into computer systems, you also need to be careful about leaving tracks. There are log files that keep track of system activities. There are modems that keep track of the list of numbers that are dialed. There are 'honey pots' that are fake systems waiting to trap the unwary hacker. There are sign-in logs that keep track of user activity. There are files that are erased but not really erased: they have data pieces left on the drive that are easily recoverable. Internet Service Providers keep track of connection times and user names. When anyone uses any part of the Internet, there are digital fingerprints left lying about if you know where to look.

Except I know how to keep my fingerprints off of a system. I know how to keep any traces of my visit from being detected. I have the tools, right here on my computer.

The first step was to cover my tracks into a system. I started by dialing into one of the free ISP accounts, setting up a few new accounts. Then I connected to an anonymizer system. They are set up to totally hide the connection information. That connection dialed out into another bogus ISP account that I had set up a few months earlier. The bogus account was one of the "free" ISP accounts that used to be available from all sorts of sources. I'd sign up for them using fake information, and I'd then have a sort of anonymous net connection, complete with an email address. I'd use the email address for sites that would want my email for one purpose or another. And when the mail account started filling up with spam, I'd close out the account (or just not use it anymore).

Anyway, I always had 10-12 free ISP accounts ready for various purposes. So I used one of them to connect to the net. Then I bounced the connection around to three other services. That would make the tracking of the session a bit more difficult. And I also used an anonymizer ISP to further muddy the tracking waters.

Now that I had a connection, I used a shell account to telnet into one of the servers that I had identified. And I got my 'bots' ready for action.