As the internet expands into a more refined and complex landscape with endless capabilities, so too does the capacity for cataclysmic criminal activity. These delinquents are constantly developing their tactics in accordance with the advancement of technology.
Tools such as proxy servers and VPNs which were designed to provide an extra level of security are also being waged by cybercriminals to act in anonymity. The ability to hide IP addresses on top of the already nameless nature of the internet can leave victims feeling hopeless in their efforts to track their assailants.
However, all hope is not lost. Law enforcement, digital forensics professionals, and ethical hackers have also kept up with the times, developing tools and methods to bypass the digital anonymity of cybercriminals and hold them accountable.
Techniques Used to Bypass Anonymization Services
Cyber security professionals in both law enforcement and private organizations are met with the challenge of working around services like VPNs and proxy servers that hold the capability to mask the geolocation of a cybercriminal.
However, there are ways to bypass the anonymity of these services. Digital forensics professionals have cultivated tools and techniques to detect the use of these services, block their access to networks, and even uncover the true IP address of the perpetrators.
Analysts utilize data that is both publicly available and disclosed through court orders to bypass the protections of proxy servers and VPNs. Analyzing network data and gaining access to server logs allows cyber security and law enforcement to unmask cybercriminals.
Network Traffic Analysis
Network Traffic Analysis is exactly what it sounds like; the monitoring of activity on a network to discover unusual and suspicious behavior. This allows networks to pick up malicious activity such as malware attacks.
VPNs and proxy servers create unique traffic patterns from typical network activity. This lets cyber security agencies detect VPN and proxy server use on a network, allowing them to bypass their anonymity.
- Deep Packet Inspection (DPI): DPI filters the data passing through a network to find unwanted content and block it. This can be used to detect typical characteristics of VPNs and Proxy servers, although some advanced VPNs are able to disguise these signals.
- Flow Analysis: This analyzes network activity by collecting and monitoring IP traffic in real time. Cyber security can detect unusual IP activity on a network, allowing them to skirt the stealth of VPNs.
VPN Detection and Blocking
Although the selling feature of most VPN services is the ability to access internet networks without fear of your geolocation being exposed, there are ways to detect their activity and even bypass their obscurity. Detecting suspicious activity and inconsistencies in IP addresses can allow networks to sidestep VPNs and block their access.
- IP Blacklists: Once a VPN IP address is identified, networks can store that information in their database and block activity that comes from that address.
- WebRTC Leaks: WebRTC is used to communicate between multiple devices in real time, which requires your IP address. Leaks can expose the user’s true location and service provider, even bypassing the protection of certain VPNs.
- DNS Leak Testing: DSN leaks expose the user’s browsing history to third-party entities. In the sense of VPN detection, this can provide an IP address that conflicts with the one displayed under the VPN. This can allow cyber security analysts to bypass their digital anonymity.
OSINT (Open-Source Intelligence) Techniques
Open-Source Intelligence consists of information that is available from a public source rather than a classified database. This includes articles, reports, social media posts, and online forums that are readily available. OSINT techniques allow cyber security professionals to piece together data and work around digital anonymity to break through a cybercriminal’s online alias.
- Metadata Analysis: The data within content shared online can be extracted and analyzed to reveal information such as the file author, date of creation, and location in which it was created. This can be seen in cases of email sextortion where the email header metadata is used to track down the perpetrator.
- Social Engineering: If you’ve ever seen Dateline NBC’s ‘To Catch a Predator’, you know there are instances where online deception can be used for positive purposes instead of blackmail or sextortion. These tactics can be employed by cyber security professionals to trick scammers into revealing their identities.
Logging & Correlation
VPN and proxy services keep logs of user activity for purposes such as bandwidth limitations or improving the performance of their service. These logs are often kept confidential, and some VPNs have no-logging policies. However, if this information becomes accessible, it can allow law enforcement to circumvent the protections of the VPN or proxy server and uncover the identity of the user.
- Service Provider Cooperation: Internet service providers may be asked to divulge information on a user’s VPN provider, which in turn may lead to the VPN being asked to disclose logs of the user’s activity. This is normally completed by Law Enforcement when the use of a VPN is identified during a digital investigation.
- Correlation Attacks: These attacks look for patterns in the traffic and data being encrypted by a VPN or Proxy server to bypass the encryption key. This is done by looking at multiple pairs of plaintext (unencrypted) and ciphertext (encrypted) and looking for key bits or sensitive information that can be used to uncover the key.
What Does a VPN or Proxy Actually Do?
If you’ve made it to this point of the article, you may be wondering what exactly a VPN or Proxy server is used for. In simple terms, both tools are used to mask your geolocation and allow you to access regionally restricted content.
Proxy servers mask the user’s IP address by routing your activity through their own server rather than yours. When you perform an action online, the request is sent to the proxy server and then to the network you are trying to access.
However, your data is not encrypted through a proxy server. It is important to consider that a proxy server merely stores your data on their server rather than your service provider’s. While many proxy servers are secure, this still opens the door for data leaks.
On the other hand, VPNs provide a higher level of security than proxy servers. In addition to masking the user’s activity more extensively, VPNs also encrypt data that is accessed and exchanged when using the internet.
Data exchanges via VPNs are sent through a tunnel which hides them from third parties. Even if an outsider was able to detect and intercept your data, encryption provides an extra level of security and ensures that it won’t be readable.
A VPN Hides User Information Including
- IP Address/Geolocation: VPNs mask your IP address by rerouting your internet traffic through a remote server with a different address.
- Browsing History: Your service provider will be aware you are using a VPN, but will not be able to access the searches you make or websites you visit.
- Downloads: Along with your data being encrypted, any information on the content you download or upload will be encrypted and consequently inaccessible by your ISP.
- Streaming Activity: VPNs prevent third-party entities from accessing your streaming history and streaming services from prohibiting access based on geolocation. Additionally, the encryption of this data prevents ISPs from slowing internet connection when streaming.
Next Steps
If the scammer is using a VPN or proxy server, your best bet at ending your harassment and successfully recovering is taking swift action. You should never pay a scammer, but your chances of recovering lost funds if you’ve already done so hinge heavily on timely reporting.
Uncover any information and submit a report to your local and national law enforcement. This step is crucial in any cybercrime investigation as it is necessary documentation for legal proceedings.
If you are unable to unveil the perpetrator, you should contact a digital forensics organization such as DFC. Through our proprietary tools and techniques, we are able to disregard their digital anonymity and bring them to justice.
We can help you investigate the crime and connect you with law enforcement that have the jurisdiction to charge the criminal. Our findings can be used by both law enforcement and attorneys in your case.
If you are being attacked online by somebody you can’t identify, there is no time to waste. Call our helpline today for a free and confidential consultation with one of our specialists.
DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.
