Subject: gthorne - on icq, spoofing, and how they track you
Message Body =
first of all i want to mention that newer versions of icq allow you to hide your ip from the other end - but it is a direct network app, so like i said in a previous message - the computer must know the ip it is connecting to, and just because icq allows you to check a box removing the ip from the other person's 'viewscreen' --- it is still available to you since it is in your machine's memory
it is therefore like any other networking app
my next topic is what can be spoofed in win95 or other os's
first i will recall the previous postings and mention that it is possible to fool a remote machine completely with linux what your ip is
in win98, it requires that you have control over the dns server, so you have to be a hacker to spoof or run your own dns server
win95 can only alter your ident (see the little spoof app in netwar on my site - also called eye-dent for those of you who have it)
which is not much protection at all since your ip is till the same
well enough about what has already been said... here are a few points most people don't think about
what IS able to be spoofed is JAVA (and therefore javascript)
how do i know? i do it.
what i mean by this is that a foreign machine knows your ip implicitly (as i said about icq) and on a server, the remote server has some environment variable accessible from perl to track you
these are: $HTTP_REFERER, $HTTP_USER_AGENT, $REMOTE_ADDR (which usually is the same as $REMOTE_HOST), $REMOTE_IDENT, and $REMOTE_USER
some of these you will recall from fravia's site as being the same baic ones in javascript - and so they are, webserver variables arent entirely alien to the web client variables
so check there for explanations
note that i do not cover cookies here - but all they can track us number of your accesses to a site or what data you type in directly (and of course any of these user variables)
$REMOTE_ADDR ($REMOTE_HOST) is your ip - and as i said it is truly known to the other machine - or you have no network connection
linux boxes can fool this since the spoof technique uses its own way to access the net - let me just leave it at that, the details are kind of complicated
java (and therefore javascript which calls java to get your ip) relies on what your machine reports its ip to be
since it loads from your pc, that is the data it knows to check
if you are on a lan where all machines are set an ip that is permanent, and all machines interact with eachother and the internet, this is the same as the remote ip
what i need to point out however, is that on my own machine setup, i have a intranet ip and a separate internet ip
this is due to the fact that my intranet has a standard tcp schema with permanent ip addresses to identify itself to other machines in the intranet (i can use any ip... even one used by someone else on the internet to identify myself.. since it is not an internet dns needed to resolve my ip at all)
this can be set simply in the permanent networking properties of your win95 control panel under tcp/ip network properties if you have installed the microsoft tcp/ip protocol
when i dial up to the net of course, i have a dynamic internet ip assigned by my provider. dynamic being great because it changes, and is kind of hard to track on a many-user system who really dialed that ip address (and in safety for yourself make sure to have a private line or dial *67, before the call so normal people cant *69 and track you while you are online and using the phoneline - fbi can still track you dont be too comfortable)
therefore my machine has 2 ip addresses... one for the internet and one for the intranet
to make a long story come to a close, the machine on the other end knows your true ip so without a deep method of spoofing, you cannot cover this
java, however, reports your intranet ip - so sites that record your ip data based on java or javascript, get what you tell them is your ip
since i wrote this much i will probably miror this in refined form on my website in the netwar section
do take care, and i hope this answers alot of questions that have been asked before
