Sep 10, 2016 03:09 PM
(This post was last modified: Dec 9, 2016 08:03 PM by ๖ۣۜCriminal.)
Haven't done one of these in awhile so figured i'd release something helpful for my fellow PI's in the community, alot of us probably come to the point in our investigations where we stumble upon a VPN IP and usually consider it a dead end but a good PI always thinks outside the box to turn a dead end into a new lead.
Here are some techniques you can use to identify people behind VPN IP's:
Technique 1. Se'ing the VPN provider directly
Im not gonna spoonfeed and go indepth into this but the jist of it is to email them scare tactics this could involve using fancy legal lingo or fabricated documents without going into too much detail. Now as some of you may know some VPN's don't log anything but all VPN's keep billing logs/sign up logs so you could still possibly get a home IP on someone even if the VPN server directly doesn't store logs but the web server where you manage your account does.It's also possible to use LE related pretexts but I will not get into that because it's risky to use those.Another thing is to keep in mind is if you try to use this method to dox a shared IP which 100's of people use, you will need timestamps along with the IP so they can see which user was using it at the time.Heres an old thread I found of the user killerpop who managed to do this: https://hackforums.net/showthread.php?tid=1967070 as you can see emailing vpn providers can prove useful in your work on finding people.
Technique 2. Tricking the person using the VPN directly
One trick even I managed to succumb too my self in the past was some vpns have ip login history so if you message the person "oh hey use my vpn login it's way better then that vpn your using" you can have them log in change the pass kick them off and check the IP login history for their home connection, this method is extremely potent because almost anyone can fall for it when there off their guard I my self fell for it not realizing what the attacker was trying to do at first.This is just an example pretext im sure theres other interesting ways to get home connections.
Technique 3. Client Side Channel Attacks such as Cache Timing Attacks
if people order food online or visit sites that involve geolocation like if people travel alot and have viewed their own address on google maps to check for directions for example to travel somewhere and back, you can use javascript timing side channel attacks to get their city and state, if they used craigslist sometimes it shows the subdomain of the city there in so thats another site you can use a timing attack on to get city information from, timing attacks are deadly because they completely disregard whether your using a VPN or not and most timing attacks by design will always work only some deadly ones like the pixel perfect attack that was shown off at an old defcon were fixed.Most of this info gets stored in your browsers cache or browser history so it's something to keep in mind.This will only work if the person using the VPN previously cached info related to their city and state in the browser they use.Theres tons of academic research papers you can find on google to get an idea on how to set up the malicious javascript.
Technique 4. Using super convincing bait to force them off the VPN
This one is pretty easy to get creative with, one can get a dummy domain and host a convincing file such as example.com/usersalias-criminal-complaint.pdf and you mention to them it shows how the feds got all there emails and IP's and by instilling worry and fear they will try extremely hard to view this fake document even going as far as switching their vpn off for a bit, iv'e used this method at least twice and it's a very high success rate.Make sure to set up apache/nginx rules to ensure it serves a 403 forbidden page if there on the VPN.it could be a normal page too if you don't want to use a PDF like I said being creative is key for this one.From there you can ISP dox the home connection or grep DB's for it to gain further info.
Technique 5. Grepping alias/emails in DB's
Sometimes you can find old home ip's from there emails and aliases directly sidestepping the need to even deal with the VPN IP in the first place, this requires a large private db collection if you don't want to rely on leakedsource which despite having 2 billion entries sometimes falls short and can't get the info you desire on your target.
Technique 6. VPN Correlation Attacks
Sites like skypegrab allow you to find skype id's linked to a single VPN IP because alot of skypes were resolved and by doing this you may be able to find a persons multiple aliases, possibly a home IP if one of there skypes had a home IP resolved for it before they used the VPN so VPN IP's could be very useful to an attacker in some scenarios.
Technique 7. VPN Pattern Correlation Attacks
Similar to the previous technique sometimes people use the same vpn provider based on the ASN ranges so you can sometimes identify a person just based on the VPN they use, this combined with voice prints(Alot of people will use a mic while using a VPN so voiceprints are usually obtainable most of the time) and other metadata can really nail someones head to a cross.
Technique 8. Disconnection VPN Correlation Attacks
This attack while deadly is very tricky to pull off without an automated script for it, you need to find a platform that they use such as jabber or skype and you want to ddos a bunch of home IP's you think is theres you can do this manually but it can take ages, you'd have to make an excel graph of every IP you hit and keep logs of that but once you know you hit the right IP there jabber will go off or there skype will go off, this allows you to identify there home connection completely side stepping there VPN.If you really want to identify someone bad enough and other techniques failed this is the way to go.
Technique 9. Clickjacking Attacks
Not many people may know this but clickjacking has been used for awhile to deanonymize people.VPN's don't matter in a clickjacking attack because if the victims on an account with real PII a VPN won't prevent info disclosure happening this way, common ways include getting the persons twitter profile or facebook profile and getting names dob and other info from them.
Technique 10. Targeted Malware
If you can get malware installed on the persons comp you can force the person to make outbound connections with their home connection by killing the openvpn.exe process. This is by far my most favorite and sneakiest way to get home connections. Malware is pretty much game over most of the time VPN or not.
I hope you guys enjoyed this thread and now realize VPN's can be thwarted if you put the effort in.
Here are some techniques you can use to identify people behind VPN IP's:
Technique 1. Se'ing the VPN provider directly
Im not gonna spoonfeed and go indepth into this but the jist of it is to email them scare tactics this could involve using fancy legal lingo or fabricated documents without going into too much detail. Now as some of you may know some VPN's don't log anything but all VPN's keep billing logs/sign up logs so you could still possibly get a home IP on someone even if the VPN server directly doesn't store logs but the web server where you manage your account does.It's also possible to use LE related pretexts but I will not get into that because it's risky to use those.Another thing is to keep in mind is if you try to use this method to dox a shared IP which 100's of people use, you will need timestamps along with the IP so they can see which user was using it at the time.Heres an old thread I found of the user killerpop who managed to do this: https://hackforums.net/showthread.php?tid=1967070 as you can see emailing vpn providers can prove useful in your work on finding people.
Technique 2. Tricking the person using the VPN directly
One trick even I managed to succumb too my self in the past was some vpns have ip login history so if you message the person "oh hey use my vpn login it's way better then that vpn your using" you can have them log in change the pass kick them off and check the IP login history for their home connection, this method is extremely potent because almost anyone can fall for it when there off their guard I my self fell for it not realizing what the attacker was trying to do at first.This is just an example pretext im sure theres other interesting ways to get home connections.
Technique 3. Client Side Channel Attacks such as Cache Timing Attacks
if people order food online or visit sites that involve geolocation like if people travel alot and have viewed their own address on google maps to check for directions for example to travel somewhere and back, you can use javascript timing side channel attacks to get their city and state, if they used craigslist sometimes it shows the subdomain of the city there in so thats another site you can use a timing attack on to get city information from, timing attacks are deadly because they completely disregard whether your using a VPN or not and most timing attacks by design will always work only some deadly ones like the pixel perfect attack that was shown off at an old defcon were fixed.Most of this info gets stored in your browsers cache or browser history so it's something to keep in mind.This will only work if the person using the VPN previously cached info related to their city and state in the browser they use.Theres tons of academic research papers you can find on google to get an idea on how to set up the malicious javascript.
Technique 4. Using super convincing bait to force them off the VPN
This one is pretty easy to get creative with, one can get a dummy domain and host a convincing file such as example.com/usersalias-criminal-complaint.pdf and you mention to them it shows how the feds got all there emails and IP's and by instilling worry and fear they will try extremely hard to view this fake document even going as far as switching their vpn off for a bit, iv'e used this method at least twice and it's a very high success rate.Make sure to set up apache/nginx rules to ensure it serves a 403 forbidden page if there on the VPN.it could be a normal page too if you don't want to use a PDF like I said being creative is key for this one.From there you can ISP dox the home connection or grep DB's for it to gain further info.
Technique 5. Grepping alias/emails in DB's
Sometimes you can find old home ip's from there emails and aliases directly sidestepping the need to even deal with the VPN IP in the first place, this requires a large private db collection if you don't want to rely on leakedsource which despite having 2 billion entries sometimes falls short and can't get the info you desire on your target.
Technique 6. VPN Correlation Attacks
Sites like skypegrab allow you to find skype id's linked to a single VPN IP because alot of skypes were resolved and by doing this you may be able to find a persons multiple aliases, possibly a home IP if one of there skypes had a home IP resolved for it before they used the VPN so VPN IP's could be very useful to an attacker in some scenarios.
Technique 7. VPN Pattern Correlation Attacks
Similar to the previous technique sometimes people use the same vpn provider based on the ASN ranges so you can sometimes identify a person just based on the VPN they use, this combined with voice prints(Alot of people will use a mic while using a VPN so voiceprints are usually obtainable most of the time) and other metadata can really nail someones head to a cross.
Technique 8. Disconnection VPN Correlation Attacks
This attack while deadly is very tricky to pull off without an automated script for it, you need to find a platform that they use such as jabber or skype and you want to ddos a bunch of home IP's you think is theres you can do this manually but it can take ages, you'd have to make an excel graph of every IP you hit and keep logs of that but once you know you hit the right IP there jabber will go off or there skype will go off, this allows you to identify there home connection completely side stepping there VPN.If you really want to identify someone bad enough and other techniques failed this is the way to go.
Technique 9. Clickjacking Attacks
Not many people may know this but clickjacking has been used for awhile to deanonymize people.VPN's don't matter in a clickjacking attack because if the victims on an account with real PII a VPN won't prevent info disclosure happening this way, common ways include getting the persons twitter profile or facebook profile and getting names dob and other info from them.
Technique 10. Targeted Malware
If you can get malware installed on the persons comp you can force the person to make outbound connections with their home connection by killing the openvpn.exe process. This is by far my most favorite and sneakiest way to get home connections. Malware is pretty much game over most of the time VPN or not.
I hope you guys enjoyed this thread and now realize VPN's can be thwarted if you put the effort in.
