! !
the saying goes: Justice has long weapon! This sentence is true? Shehui reality, I do not know. But on the Internet, the Internet, this sentence is feeble. I read this text, you can know. Violated the existing decree on the network, even in public 'security sector to initiate an investigation, not necessarily
first to know about
: They are responsible for network monitoring, such as websites and servers are black, game accounts and equipment stolen, the network on a kind of discussions, the content opposition the current government. Belong to the network monitor handling.
us imagine a case: 163.com master the invasion, the server all times to format the hard disk, and reiterate the reading and book junk data, resulting in hard disk data can not be restored, with cumbersome losses. So shrieked specialists in the crisis fix server data at the same time, 163.COM company fast made a report to the Guangzhou network monitoring. Guangzhou network monitoring comprised in the investigation to track the intruder!
If you are an intruder, you are faced with this position. How would you do? In truth, numerous colleagues in the invasion of dissimilar Web site, server, internal network, are not know how to protect themselves. If you disburse consideration to conceal himself, not take an day, network monitor departments can bolt your home eighth generation of progenitors -_-!!!, whether hidden well, so the case behind a duration of lawful action, is also complicated case. And this, in Internet terms, is easy! First,
GHD Purple Straighteners, we must understand how the `network supervision departments to alley the intruder, locking him where offense. We generally kas long aswhen you cut a website, you in the WEB operation. Will be recorded more or less in the other WEB server log. IIS and Apache are recorded a number of IIS logs. If you intrude a site, disc the IP address was not amazing. Even if the general web sites, will be recorded under the IP, while you visit the website by the time to perform an operation, IIS server will be a log, case in point, a connection error happened. This is even more intrusive to others speak about your site will not depart IP record,
GHD, which will definitely leave.
When you invade a server? When you enter the server, ahead of WINDOWS system will connect to your IP recorded, emulated by the doorway server. Will log the connection into the server's IP. Therefore, even now you can put on the record on the server to delete the records on the Gateway, you can not can not reach.
public 'security sector in the crime were locked, the first is to find the crime, how do I find out? The most essential thing is to track the IP of the.
us to understand some of ADSL broadband access under the common sense.
is well known, it is now generally used in telecommunications or Netcom ADSL broadband access network. Most of the use of dynamic IP, is the use of a small number of fixed IP. IP is a trait of nailed bandwidth is generally more than 4M. The average person does not take. When you start the computer, invested by your broadband ISP ADSL account dial-in Internet time. ISP service provider system will randomly apportion you a dynamic IP, and record the retinue accidents, for example: at 8:08:08 on August 8, 2008, btm4545455 (broadband accounts), dial-in IP: 58.53.1.5, operation System: Windowsxp, Dial Tel: 07284544562. Telecom provinces recording may be different, but these data will definitely be recorded ISP, and some people may not believe that ISP will record such details. But I enter the telecommunications network outlooked this system does exist! And more careful, I've simply listed some of his key data record!
another point, when you successfully turntable into the Internet, your IP in the access to the Internet, the router will all over a lot, almost each router will record your IP!
Now we know what way ISP service provider records your whereabouts, right?
We'll talk about the public 'security departments on how to capture the crime were. We all know, should pay attention to a person, we must 1st know who he is, he was there. If this do not know, how to catch? But to obtain to the location and true identity of the perpetrators only means that We all know thatwhen your calculator and a server on the Internet to build a connection when the 2 would each transmit file to each other. And this IP would be tantamount to transmit the aisle, in fact, you use the IP, can only say that the Internet Similarly, the IP is to identify a school in a certain period at a certain time and certain points connected into a network of a second testimony. The same station had committed the crime only to find that school consumers can persist to chase him.
Yes, we are now back in front, as we said, assuming 163.COM company report, the public security sector via thinking of the system in the WEB server and gateway above (not erase) all found a connection and invasion System IP address: 211.1.1.1, this time the public 'security departments for investigation found that the IP is from ** to. This means that the intruder is ** `people? This is really just a facade.
When seeing for an intruder when the correlate is very important to check the routing of a log, we all know, when your IP access to a server and they will after a lot of routers, meaning that more than one route record you've ever visited the IP, which is traceable to the. Similarly, even if you use to connect to the invasion of foreign chicken 163.COM, the public 'An Shushu similarly traced to you. How do they do? The reply is simple, the public security departments have the right to meet the telecommunications sector, providing route logs, provided that there are specific IP once the IP route to 211.1.1.1 above it. Would catch you. When you are arrested, when not even think `Why Labour obviously with the agency, or caught? Is actually very simple, because only a membrane, it is very easy to crack, principally agent! Agency agreements are very simple. Is not hard to unravel.
we entire understand,
GHD Blue Butterfly 2011, the public 'safety regulators have a citizen network firewall Is used to disguise some of that content is the reactionary activities of suspected sites and network resources. Do not trust, we try to find a common random way similar to the effective performance overseas www.wujie.web, you will find you and the proxy connection is interrupted, why interrupt? Shield detect your connection for access to the contents of `reactionary and has blocked the site. ISP's system then, it will coerce you and that alien agents disturb the connection. Thus, in a decisive period, you will meditation that agents died. More easy test such as: google.com in your search: A few minutes in level you probably will not be competent to access GOOGLE. Because your content without whichever encryption to such agents, it is cozy to recognize.
Do not believe the agency so that we basically have no security to speak of asset. . And how, in order to avoid tracking it? Method is very simple.
public 'security sector to track the intruder, only from the IP to start with, we flee out of IP, at the peak of they drag the wind. Basically there is no peril. How to flee? I said, I usually Preparation Tool `I` According to the general nature of the threat of a dangerous network uses South Korea server: D, ** On the server: E, I computer: F.
attention, protection level based on individual aptitude, are generally my requirements of this class of intrusion prevention is a high quality control of the server, the first is very rapid, PING merit than if the two foreign countries: 150, then not taken into list. PING general requirements abroad at approximately 120. PING servant 70 alternatively less. Otherwise it will create operating speed is very slow, because of their own act so, the operating speed will cut corners a lot, because: (here I use around the servers A, B, C, D, E, F instead, just must write clearly a) First, we connected to E, then E, using the 3389 terminal server connections in South Korea D, then D, then entered into the 3389 server connection C, then C, 3389 B, and then chained into Hunan. Hunan B, continue to connect into the 3389 Thus, during operation. You will record all the operations in A, above. All records of the invasion of the server A, in Beijing on. With A, do not rub on the logs is to leave the public 'An Shushu track!
I said before, the public 'An Shushu occupy the final weapon is the network route the investigation. When I connect to ** An E, and they will keep track of my route to the E, then? On your 3389 operation, will only stay in each other's server, and you equitable discern the back of the image displacement. And is the outcome of high-strength encryption, I tried could not be identified, in agreement with the present technology, it is impossible to reinstate what you had in the end operation. And it is absolutely impossible. Because the final connection protocol is very strict. For immediately, it is not cracked. After reading you will know why!
When I connect to the E, ** An when I complete all the operation is E, and I just get transferred back to the graphical interface (that is, about the same screenshot), so all the operations E is completed. This time, D, E route to Korea, so the E, the route is not ours, that is, by the ** An ISP service providers we understand the conviction of routing the ~, right? Public 'An Shushu only the domestic telecommunications sector, the right to check the routing log, they can be found in an IP route to a foreign country, but it is absolutely impossible to find a real puppet in the end the computer back him abroad, who is `Why?
because when the E, D, South Korea ** An operation when all his action is recorded by the ** An ISP. This time South Korean domestic C, D, when connected, is likely to be found. Why? Because the front of the A, B, C are in the country, at the peak of in the country, are threaten to be tracked! For example:
case assumptions to back: this time the public 'An Shushu found IP: 211.1.1.1 `A, assuming that he is Beijing, a good night to the public; Anshu Shu` rushed through the Beijing Telecom with Telecom IDC is a `check on the server at the custodian to open in it a puppet of the server, by analyzing the log, get our puppet server B,, good night` rushed to Hunan Telecom in cooperation with Hunan Telecom, `found IDC is a managed server, Su Wen Hunan hospitable `really good. In IDC's hospitality and strong cooperation and the public; An Shushu are courageously fighting, not for individuals, the disbursement of the case vigorously. Found in Shandong C, our server. This time, tired of public security in the repose of the night his uncle, continued to rush in Shandong, in coordination with the regional telecommunications. IP is also found in the apartment belonging to a IDC. So after analyzing the complete log. We kas long as`the public security uncle had the time and in the environment of agreement attached to this C, the IP is: 203.1.1.1` and this IP from South Korea, how do? In fact, the public 'security requirements of the domestic ISP service providers that collaborate with the investigation, likely to open the route to provide the log is very cheap. If you want to cross a case, there is only one possible. Is to Korea `Well, since it is spurious, we will assume that end. To get a ticket to South Korea in the post, the public; Anshu Shu came to South Korea, the strong regional police and hospitality after the mate. Parts per million found by chance in it may have been my format is not responsible for the server IP address is located out of apartment. Under the ten thousandth chance, but also with the ISP, through Korea, but still have not found the deleted routing log. Then routed to that found in Taiwan and South Korea from D ** An IP number 22.1.1.1, Eight Honors and Eight Shames the call, the public 'An Shushu went hard, got a stamp to the ** On finally finally got * * On with the police. One ten thousandth chance finally found in it the afterward is not responsible for the format had been out of the server.
Finally, in the million millionth chance of getting the source under the invasion of IP23.1.1.1 a area from Hubei, China, so the public 'An Shushu dog dine dog went to Hubei,
GHD IV Pink Straighteners, and finally the cooperation of the local ISP. Dial-up through the system log records, and finally find this male, but the public `'An Shushu found. Has been: the murderer prosecution period. . . . But this is yet at 500 billion dollars have luck. To tell the fact, Bill 50 billion massive crown his property to give you the chance, than the high probability of IP-found source!
at birth is my speculation, the plot namely smooth. But in reality, it is absolutely impossible, above all: the routing log, no who absences to retard you can retard the. Check the routing speed of the web ambition lead to ebb in the overall ISP is very tall. And do not necessarily have a accident, the maximum critical is namely this path normally sometimes delete the log. So he is quite short shelf life. Telecommunications sector in common and the small cities of the network monitor, not how the ministry is not mighty birds. So, even if we must ascertain the C, Shandong waiter is very difficult. Public 'An Shushu general, can be found in B digit, you should mail people: the good people of the public security banner. .
say that foreign E, D, and, when found in C time, do not know what age. To investigate a number format, and the invasion of the server logs to read and write, not mistrust is. . . How to say can not, unless there are routing and gateway log object. Can be found in a few months the probability is 0, along to domestic public 'safety case treatment speed, normally wait a year or two,
GHD Red Butterfly 2011, be feasible to work to South Korea. At that time, estimates for the server did not change people. I do not know, luck can be found at this time ** An E,, the probability is naturally better than Microsoft's employer to send you 500 billion higher hazard of sword. , And in a few years, you can find in the E source IP. When the President of the United Nations can do, right? Oh yes, if necessary this.
ISP in these annuals has been on the router to intercept all network access to your data, and decrypt the open. And even now the decryption open, yet you get the other server's data connection. This level of enjoyment, I think only super spy was to enjoy it. ISP can not supply the money and equipment to monitor a human annuals. And also saved a few years of data, you know, if a province a province of the Internet ISP monitoring data,
GHD Hair, ample to install tens of thousands of data a day G was. . . Do not know what starting a loaded, it is impossible. Not to say the declassified. Even find you, who did not certify that the invasion of the format of the 163.COM hard disk!
After all, if you can dodge the use of foreign networks to open domestic routes, there is no presumable to find you, the above assumption of A, B, C, D, E I are individually used. Not casually boast. Here me, I usually test the site server to hide their characteristic ways to prepare chicken `
first 3-5` 2 `two sets of foreign domestic chicken, chicken a minimum of two foreign countries. Enough so as to avoid tracking. Domestic chickens can be dwindled to 1 units. Speed based on your decision to find the chicken. Requires very high network latency broiler `chicken` foreign zone network delay requires you to connect the unit's value is not higher than 130 PING. No more than 70 domestic chickens delay. This can be a good use of broiler chickens. Is to use the WINDOWS 3389 comes with a remote connection, then connect the chicken in the broiler, so that continual sets of sock-like connection.
I usually use the 5 `3 sets of domestic fowl, 2 chicken abroad. I used the connection is fully exposed to the domestic A, `B number of domestic, C` D No No foreign nation. E, domestic, F number of the machine. E, I connect, then connect the D, C, B, A. Note `E recommendation is to use open agent connected. Such for the open E, SOCKS5 agent service mode, and then you connect the unit IP127.0.1, E, can successfully connect. E, so I left the WINDOWS logging IP `all became 127.0.1. This can not certify what I have done. Even when I check my computer at the time, they can only see me connected to 127.0.1. The route can only prove that I visited, and the other server, a connection is established.
more hidden way, because the human accustomed. Not a haphazard guess. If you can be caught this direction, only folk who mention you are God! Avatar. . . .