Hacker News Reader

Comment by Theodores | Hacker News Reader

This is a bit beyond my knowledge of TCP/IP, however, does this support Putin's assertion that hackers can make an attack appear to come from Russia when they could be based somewhere else? How much work do you have to do to make it that your IP address is from somewhere credibly in some other country?

View on HN

I'd say not really. BGP based lies are hilariously easy to spot, and can be observed by any ISP in the world. When the US Intelligence community blames Russia for hacking they aren't just doing geo-ip lookups and believing what they see. Anyone with a credit card these days can rent a server in any country anyway, so origin of traffic is more or less useless.

> Anyone with a credit card these days can rent a server in any country anyway

Including North Korea? :)

It would make sense for NK to sell VPn and server space to clients fro hard currency.

You can use a service that pings (or traceroutes) a given address with multiple probes. Round-trip lightspeed is 150 km/msec. So if you see a probe location with minimum rtt on the order of 1 msec, that's about where the address is. And conversely, if you see probes at the claimed location with minimum rtt over 20 msec, be suspicious.

Ping services with many probes:

https://asm.ca.com/en/ping.php

https://www.maplatency.com/

https://ping.pe/

Great point!

Also, you can also have your attack derive from Russia. Russia (the government or a Russian hacker group) doesn't have to be behind the attack for it to look like its sourced from Russian internet space.

You can see a clip of a hacker you may recognize in action here (dramatised): https://www.youtube.com/watch?v=bhS-7jxBgXQ

Reply on news.ycombinator.com