Can User Using Public Wi-Fi Be Traced?

Question

Let's imagine the following situation:

"Overintelligent hacker connects to Wi-Fi points across country and performs illegal activities that get government's attention.

If all the government can get is routers' logs which IP was assigned and connected, it is still internal IP. Now let's assume they exposed hacker's MAC address which was faked."

How can investigators solve the puzzle?

Can that hacker be traced and if he can, then how? And does ISP stores router's MAC address in its database for tracing?

Solution 1

If the hacker uses the same web-browser he can be lost likely tracked as most web-browsers have it's own fingerprint (or at least a fingerprint that is very likely to be unique). This fingerprint does not include cookies but all other information your browser exposes and that does not change often like supported languages, installed plugins...

Get your own browsers fingerprint: http://panopticlick.eff.org/

Solution 2

It is unlikely that the laptop MAC or IP are used for this sort of tracing. Much more likely are:

• persistent cookies (especially evercookies, which are extremely persistent)
• browser fingerprinting (as mentioned by @Robert)
• usage (if you log into the same website/application, that end can be logged and traced - patterns can indicate identity)

You may possibly get tracked back by IP to the wireless network you are on, which can then be followed up physically.

Solution 3

Online, it is unlikely it could be tracked any further to the router he is connected to.

However, there are many offline techniques that should be considered. For example, it may be possible to use other security such as CCTV to link someone to being at a certain place at a time. Combined with a log, could show that they were responsible.

... Or forgetting CCTV, if you purchase a Big Mac! (Thanks @Psycogeek!)

Comments

[Arjan]

MAC addresses do not propagate all the way over the network (and surely not onto the other end of the internet), unless you're using IPv6, in some cases.