pprune security

[pontius's pa]

Danny,

Bit of a disturbing trend shown by your monitor PPrune Towers on Fragrant Harbour i.e he claims to know the path and perhaps identity of any one making a posting whilst he, (and he claims you),happen to be watching.

At least I think that is what he implied. I would be very happy to be corrected if mistaken.

This sort of threat, if true, could stop chaps posting anything about anything if they thought that their anonymity was threatened, despite the protection so far given to the identity of a somewhat extreme contributor to Fragrant Harbour.

I hope that you will counsel Mr PPTowers on such an incautious posting, which was clearly made in the heat of the moment, as are those of most of the rest of us!!!

brgds etc

[pontius's pa]

Sorry, re my previous.

forgot to identify message

please see "these postings are not from CX pilot", page 2, dated 3 July

[PPRuNe Dispatcher]

We will not reveal any private details of a user without their express permission, unless we receive a court order or if they severely or repeatedly break the rules they agreed to when they signed up.

We will not attempt to find out private details or a users identity without good cause.

--PPRuNe Dispatcher

[CrashDive]

..... and we didn't get PPRuNe to where it is today by willy-nilly releasing folks details and / or betraying confidentialities - indeed I don't believe there's ever been an instance of us having ever done so (uhm, well maybe just the once, but that was all dealt with out of court) - that said, and knowing PPTowers quite well, I'd say that if he made such a remark then he would of had a very good reason for doing so !

------------------
CrashDive

Administrator to The Professional Pilots RUmour NEtwork

May you live in interesting times !

[stickyb]

I think it is worth setting the record straight on this one, although I have nothng to do with Pprune whatsoever apart from being a user.

In simple terms

Anyone who uses the internet has to have an address.
That address has to be given to every site you visit.

So yes, the claims or comments are correct you can be traced.

Though it would require co opertaion of you ISP to turn your TCP/IP address into a phone number in some cases.

Very easy though to spot the corporate users!

[mutt]

Pontius's Pa,

The guys at Pprune aren’t doing anything out of the ordinary, we are not as anonymous as we would like to think.

The following is a report taken from a commercially available anti-hacking program, it traces the route from my desktop PC (#01) back to the originating machine (#19) which had attempted an unsolicited connection to my PC.

Theoretically, armed with a court order obtained with very good justification, I should be able to get the originators ISP to show his usage logs, which would lead back to the actual individual who attempted the hack.

01 / 2xx.24.2xx.89
02/ 2xx.24.2xx.1
03/ 2xx/24.2xx.97
04/ 208.162.203.233
05/ 212.26.63.77
06/ 193.251.150.161
07/ 193.251.240.142
08/ 193.251.154.121
09/ 193.251.154.94
10/ 64.86.90.129
11/ 207.45.221.77
12/ 207.45.198.90
13/ 195.22.192.198
14/ 195.22.196.166
15/ 151.99.75.154
16/ 151.99.98.250
17/ 212.131.52.6
18/ 62.86.52.118
19/ 217.57.11.50

So I think that the moral of this is, “don’t expect Pprune to take the can for slanderous statements”, if they really need to, they can find out exactly who we are!

Mutt. :)

[Evo7]

<font face="Verdana, Arial, Helvetica" size="2">
The following is a report taken from a commercially available anti-hacking program, it traces the route from my desktop PC (#01) back to the originating machine (#19) which had attempted an unsolicited connection to my PC.
</font>

Is someone really selling traceroute? And are people actually prepared to pay for it? It's been a unix freebie for the better part of forever and you can compile it yourself under windows.

Do they offer to sell an advanced utility to check if a machine is at a given IP address too? Called ping? ;)

[CrashDive]

stickyb, mutt, and Evo7 are all correct.

All ping and trace-route do is to show just what your IP address is at any one time when you logged on with your ISP, and where abouts the ISP/server is located (well, sort of).

And yes, the PPRuNe software does log the IP address of a contributor, i.e. the IP address of the contributor at a particular moment in time and which was provided to them when they connected with their ISP. Indeed as part of our testing on this I wrote a program which collated all the posts that were made using my name and the associated IP address.

Q). Guess how many unique IP addresses had been assigned to me over time by my ISP ?

A). 870 !

So want to see what IP address has been assigned to your computer by your ISP ? Well log on to the Internet, then start a Dos Command Prompt and type 'ipconfig'.

Nb. Right now my ISP assigned IP address is 62.25.71.75 which if you run Neo-Trace against it, shows me connected to modem-843.beagle.dialup.pol.co.uk on the network of the European Regional Internet Registry / RIPE NCC (NETBLK-RIPE-C3).
That said, a few moments ago I just logged off and then logged back in again and my ISP assigned IP address has changed - surprise surprise (NOT ! ) to 62.25.71.164
... and I've just logged off / on again and, you've guessed it, it's changed again !

Now try that a few times when you've logged on and watch how your IP address changes (coz your ISP is providing the next available one to you on a pseudo-random basis) and the modem which you connect to at their end will also change as their needs demand - and it will probably be in different domain e.g. the first three numbers of the octal grouping (e.g. the 62.25.71 in the above) will change...

Nb. That's why banning an IP address is not a very smart idea, certainly from our point of view, because being such a broad brush approach and because IP addresses are so randomly generated you (we) have no real idea if the IP address that belonged to a naughty contributor will be the exact same one (i.e. unlikely) the next time they try to make a posting and / or that the same banned IP address has not since been allocated to some innocent PPRuNe contributor.

So, imagine that we (PPRuNe) needed to track down a contributor. What we'd have to do is to find the IP address that they were assigned by their ISP and that was used in one of their postings. Then trace back to their ISP and ask them to match the IP address which we logged at a particular moment in time (i.e. when the posting was made), against the ISP's log of who was assigned that IP at that time.
Nb. This all assumes that a contributors ISP have kept an audit trail of this (and just imagine how big a file that would be for any popular ISP) and that they are prepared to facilitate our request (very unlikely without a court order - and even then local jurisdiction would more than likely get in the way).

On the subject of individual corporate users. These folks typically sit on their companies network, kept safe & secure from that nasty Internet behind a router and firewall (regardless of whether the company is using a leased-line or dial-up access) and accordingly it's almost impossible to determine what the IP address it is that their computer is using on their internal network, i.e. what PPRuNe logs is not likely to be the IP address of the computer that your are using in your office, i.e. not unless your network administrator is a complete prat !

[This message has been edited by CrashDive (edited 06 July 2001).]