Comment by cb18 | Hacker News Reader

Comment by cb18 | Hacker News Reader

Parent Full thread

How is it possible to uniquely identify a computer's hardware from over the internet?

Do you think there is a database that connects an identifying factor of all computers to their owners?

A computer vendor could maybe keep a list of device serial numbers/MAC addresses, along with non-cash payment methods, but how could law enforcement legally acquire such data, if not authorized in a specific case?

And if there is a specific case, what is the likelihood that an investigator could determine a device's serial number/MAC from over the internet(how is that even possible?) and then locate the original vendor then locate the original purchaser?

The crux of this seems to be somehow uniquely identifying a device over the internet. A vendor having a database of items sold + payment method seems more plausible.

Isn't an IP address the only identifying factor of a machine transmitted over the internet? And IP addresses aren't permanently tied to machines. Even if theoretically an IP address could somehow be used to acquire the connected MAC addresses, doesn't TOR prevent that?

I'm not an expert on this, if something is wrong here, or I'm missing something, I'd be happy to learn.

You'd need at least a little bit of remote code execution on the perpetrator's machine to lift his MAC address. Not guaranteed, but plausible.

I expect the manufacturer to have a database correlating MAC address, serial number, date the device left the factory, and where (i.e. which retail store) it was shipped to.

I expect the retail store's inventory tracking system to know when the device with that serial number was sold, by which cashier, at which register.

If it doesn't know the (tokenized) credit card number and name on card directly, I expect the store to be able to find its copy of the receipts from that register at that time, which would contain the last 4 digits and name on card.

If the purchase was relatively recent, I expect video of the register at that time.

If the purchase was in cash but the video is still around, I'd also expect video of the purchaser walking out to his car, and (maybe separately) a shot of that car with good enough resolution to pick out the license plate.

I don't think Joe Credit Card Fraudster gets this kind of attention, but someone who is believed to be a credible national security threat... absolutely.

This is all true, but it assumes optimal data retention by retailers, and a government agency with the skills (and willpower) to do the legwork.

In reality, I would expect that one or more of those elements in the chain to be broken. Retailer lost their backups. Changed systems, threw out the old one. Doesn't keep records that far back. Etc.

I agree there is a possibility they could track all these steps, but it would require everything working perfectly (from the authorities' POV)

If the purchase was in cash for a second hand item (possibly third hand or more) then it becomes very dificult to track the buyer down. Look around a second hand store for a laptop that is more than a few years old and it is likely to have had at least one other owner since the original purchase. Do not use the laptop for at least 1 week, that way any CCTV from the store has been overwritten and really by the time they manage to trace it from the manufacturer through any owners and on to the second hand store it will be perhaps 2 weeks after purchase. At this stage even public CCTV records will start to be overwritten. If you bought one well in advance, i.e. 2 or even 3 months before you used it then it would make it nigh on impossible to find the buyer.

As an added level of security, a month after buying it make a post on craigslist to sell it as broken/not working. send an email to yourself from an internet cafe offering to buy it. Via email arrange a trade at a location without any CCTV. Plausible deniability if the police do ever show up at your door.

Reply on news.ycombinator.com