how to prosecute a facebook hacker

DevCoder

BadBehaviour wrote: »

Facebook records the time of the access as well as the IP address. It's true that you can't know from the IP who exactly was using the device at that particular time, but you can definitely track down the person who is responsible for the Internet connection and pays for it. This is something that a provider would only tell the police.

Not if the person is using an anonymous proxy or Tor (or Tails). Then forget it, you'll never track the person down, with Tor/Tails not even the GCHQ/NSA etc will bother with such low or even medium/high key events.

Although the other poster who commented that you can't tell as numerous people share the same IP is also wrong as if you can get hold of the NAT map logs then you'll be able to point an internal mac address to an external mapping.

Of course, the real people wanting to hide will change/spoof their mac and then use Tor/Tails to give them 99.9% anonymity

Of course the person in the OP's post sounds like he is capable of nothing like that

References :
https://www.torproject.org
https://tails.boum.org/about/index.en.html
http://www.oucs.ox.ac.uk/network/security/logging.xml?ID=nat

BadBehaviour

krisdorey wrote: »

Not if the person is using an anonymous proxy or Tor (or Tails). Then forget it, you'll never track the person down, with Tor/Tails not even the GCHQ/NSA etc will bother with such low or even medium/high key events.

Although the other poster who commented that you can't tell as numerous people share the same IP is also wrong as if you can get hold of the NAT map logs then you'll be able to point an internal mac address to an external mapping.

Of course, the real people wanting to hide will change/spoof their mac and then use Tor/Tails to give them 99.9% anonymity

Of course the person in the OP's post sounds like he is capable of nothing like that

References :
https://www.torproject.org
https://tails.boum.org/about/index.en.html
http://www.oucs.ox.ac.uk/network/security/logging.xml?ID=nat

Oh I know that you can use proxies and Tor , but it didn't sound like the OP is having to do with someone that clued up, so I didn't bother mentioning it.

patman99

So the op starts a smear campaign and then wonders why they fb account gets hacked.

Don't start a war unless you want to have to deal with incoming fire.

Lumstorm

IP addresses are a flawed way of finding people as they can change. And an ISP is not going to tell the police anything without a court order.

Gingernutty

patman99 wrote: »

So the op starts a smear campaign and then wonders why they fb account gets hacked.

Don't start a war unless you want to have to deal with incoming fire.

Er no. Read again.

The ex business partner and alleged hacker is claiming for a large sum of money and one of their allegations is that the OP has started a smear campaign against them.

The OP has not stated that he has started a smear campaign, just that it is an allegation made against him in an ongoing dispute.

SnowTiger

krisdorey wrote: »

Although the other poster who commented that you can't tell as numerous people share the same IP is also wrong as if you can get hold of the NAT map logs then you'll be able to point an internal mac address to an external mapping.

That's a huge IF.

My router, for example, doesn't hold the information for any longer than is necessary. It's lost after a few minutes.

And, again, it wouldn't identify a particular person. At best, only a particular device.

The OP needs more compelled evidence than an IP address, which they appear to have.

onomatopoeia99

SnowTiger wrote: »

That's a myth. An IP address cannot be used to identify a particular person.

I'm currently at my home in the Philippines. There's sixteen properties in the complex sharing the same IP address.

Also, when I'm back in the UK I freely allow visitors to use my wifi.

Also, I don't understand how Facebook would have the IP address of someone who accessed the OP's computer.

Leaving aside TOR and proxies ...

In the UK, as I'm sure you know, an IP address can be used to identify a specific customer account with an ISP as they all retain their DHCP / RADIUS logs. They won't just tell anyone that asks who had a particular IP at a particular time, the OP would need to seek a Norwich Pharmacal order if he wanted this information.

That will tie it down as far as the property (or mobile telephone) where the hack originated from. If that happened to be the same person that the OP believes is smearing them then in the event of a prosecution it's likely to be considered pretty compelling evidence.

As an aside, I'd be horrified to have my domestic internet connection already NAT-ed before it got to me. 16 properties on one IPv4 address? How do they FTP if the need to use a client that doesn't support passive transfers?

TimothyEBaldwin

onomatopoeia99 wrote: »

As an aside, I'd be horrified to have my domestic internet connection already NAT-ed before it got to me. 16 properties on one IPv4 address? How do they FTP if the need to use a client that doesn't support passive transfers?

They use IPv6, they are not enough IPv4 addresses. The regional nature of IP address allocation has resulted in the Asia-Pacific region running out first.

securityguy

krisdorey wrote: »

Although the other poster who commented that you can't tell as numerous people share the same IP is also wrong as if you can get hold of the NAT map logs then you'll be able to point an internal mac address to an external mapping.

Could you perhaps name a home router, or indeed an enterprise router in a common configuration, which retains outbound NAT logs?

securityguy

onomatopoeia99 wrote: »

As an aside, I'd be horrified to have my domestic internet connection already NAT-ed before it got to me. 16 properties on one IPv4 address? How do they FTP if the need to use a client that doesn't support passive transfers?

FTP, grandad?

If it doesn't support PASV (and, let's face it, FTP software that doesn't support PASV is pretty rare these days) then it's possible for the NAT-point to snoop and modify the FTP control connection. It was pretty standard to do that in the 1990s, before PASV became as common, and most routers and firewalls still have the functionality. If anyone's still using FTP, anyway.