Breaking the chain

Access logs advice, please?

When cleaning your logs after a mission, how many places do you scrub your traces from? At present, I've been doing InterNIC and a couple of intermediate bounce points, then InterNIC again. My agent is still pretty low-level, though (Skilled), and I'm paranoid about a passive trace biting me in the rear soon, as I move onto more dangerous jobs.

Advice and anecdotes would be greatly, greatly appreciated.

My first jump is always the Uplink test server. Easiest one to get into for me.

Foolish boy, always make InterNIC your first bounce point. You can break into the logs easily (just a password screen), the password never changes and there is no monitor so you can never be traced from there.

Agent_Vast, on Mar 23 2005, 06:49 PM, said:

Foolish boy, always make InterNIC your first bounce point. You can break into the logs easily (just a password screen), the password never changes and there is no monitor so you can never be traced from there.
View Post

Ye..es... But...how many places do I actually need to erase my access logs from in order not to be caught? Or is there a number? Is it just a "Well, however paranoid you are..." thing? I haven't gotten caught yet, but I'm all nervous.

Let's say you bounce your connection through 4 servers.

Gateway > Server 1 > Server 2 > Server 3 > Server 4 > Target

They trace the connection back to server 4. The log on there points to server 3.
The log on server 3 points to server 2. The log on server 2 points to server 1. The log on server 1 points to your gateway.

If you delete the logs on server 2 for instance, though:
They trace the connection back to server 4. The log on there points to server 3.
The log on server 3 points to server 2. There is no log on server 2. They can't trace it back to Server 1 because there is nothing to say which server it is on. They have to give up.

There are only two types of logs you want to delete.

Connection from XxXxXxXxXxXxXxXxX bounced to XxXxXxXxXxX
and
Password from XxXxXxXxXxXxXxXxX accepted.

nfreader, on Mar 24 2005, 05:38 AM, said:

There are only two types of logs you want to delete.

Connection from XxXxXxXxXxXxXxXxX bounced to XxXxXxXxXxX
and
Password from XxXxXxXxXxXxXxXxX accepted.
View Post

...simply because it looks suspicious if you have

"Connection from 127.0.0.1 terminated" and no connection accepted log

That can get you caught at higher levels.

You delete the bounce log, not the connection log.

And the connection log can't get you caught.

OK, instead of giving confusing examples, I'm going to come right out and say that you only need to delete ONE bounce log.
Usually, I use InterNIC as my first bounce and just delete the logs there.
Some use the Uplink Test Machine.

Whatever the case, ALWAYS use the same server as your first bounce, so you won't forget to delete the logs.

I don't think that works, because I've just lost my third game in a very short amount of time (go ahead and laugh :laugh: ) because I keep getting passive logged even though I always delete InterNIC logs after a mission. Maybe I'm just being stupid, but...

There are specific logs you delete. Don't jsut go in with two instances of log deleter open. Only delete:

Connection from xxx.xxx.xxx.xx.x routed to xxx.xxx.xxx.xx.x
And
Password/Authentication Accepted (The actual wording might be diffrent, just delete anything with password in it)

And not the connection log, because it will be flagged as suspicious. Also make sure you are using a new version of Log_Deleter.

So sue me for the following question:

If you simply delete all logs from the server in question, wouldn't that work just as well as other types in blocking the passive trace? I mean, the logs are still gone, and it's much easier to do...

(EDIT) tipos

This post has been edited by Terminator : 22 April 2005 - 10:31 AM

No. Because they see that there are deleted logs and you disconnected but didn't connect. That will get you caught.

Ahh. I see.

That explains a lot...