VPN and IP spoofing

[Uspring]

I want to excuse myself since this is not really a DIY topic and that being likely the area of interest of the members this site provides for. But I do need some help and this boils down to a technical question.

A very good friend of mine is being charged of copyright infringement by downloading a computer game and with it some software, which allows the download of this game by others. Probably this software advertises somehow the availability of the game on her computer. This then was used by a law firm to access the game from my friends computer and locate her by her IP address. This is the point of view of the law firm.

My friend was abroad during the time of the copyright violation and she had sublet her apartment. The lawyers argue, that this does not provide an alibi, since she could have used a VPN connection to her apartment, so that it would appear, that the subletter was the guilty one.

Is it possible to configure the apartments router to accept packets from abroad and forward them back into the internet under its own IP address? What kind of provisions does that require?

Or does this require a correspondingly configured computer in her apartments LAN, which does the same thing? What kind of preparations does this require? My friend is in no way knowledgeable in these kind of things, but the lawyers argue, that all this can be done with a few clicks. So an additional question is, what level of expertise is required for this? There actually wasn't any other hardware in my friends apartment except the router given to her by her internet provider, but this is hard to prove.

[plasma]

Hi it is possible to log in aboard and forward a connection, fpipe assuming Windows, but that can be ruled out by looking at the web browser history, but then if they want to use that tack, anyone can forward through her computer. I'm assuming utorrent , for IP spoofing its not run of the mill, but I'll question the wlan.
I can help but need to know excalt what they think happened, it could be her, assuming VPN but it could be any one on the internet.

They have IP, what was the SRC and DST port numbers?
Web browser history?
Remote assistant software?
Regedit search, you could probably find something in there.
Protocol used UDP,TCP ?
Encryption?
Router inbound outboard packet count?

[Uspring]

plasma, thank you for your answer.

If I understand you right, it is possible with a computer set up in my friends apartment. Does this require a special configuration for the purpose of being a server to forward packets back into the internet, which come from abroad? I want to add, that no such computer was present in her apartment, at least not one put there by herself. I can't answer questions about statistics etc. The reason I ask is, that I want to know if that is an easy task for a run-of-the mill user.

Possibly the only thing she would have to do is to set up a means to contact a dynamical DNS server to update her changing IP addresses and poke a hole into the routers firewall to allow VPN access. And there should be an authentification procedure for this kind of external access.

What about the router in her apartment? Could that be configured to mirror packets send to it from abroad to obscure the IP address from which the packet originally came? I mean, without another PC in the LAN.

[plasma]

I've never heard of a basic home router to do that, if she logs into the router it should display bytes sent received and packet count for Wan port and Wlan.
If they say its her IP, they should also be able to tell you port numbers, which can be semi related to Os and programs used. VPN use encryption so the send received packet count should be high on the received.
Take a photo of the router stats with timestamp from the carma.
They should be able to tell you the TTL of the packet, its the number of hops a VPN would make the count higher if she was far away from home router. You can increase or decrease the TTL by any amount but a forwarded or proxy should only decrease by one not to zero has that will open up Dos problems.
The Mac of any device should be saved to the router for awhile, take a photo.
I wouldn't think they could just say the IP address in court with out the actual packet data.
Ask there lawyers for a pcap file,and download wireshark for window or Linux.

[Fumeaux]

No lawyer, just an it student here. Therefore I can only comment on the technical aspects.

I wouldn't think they could just say the IP address in court with out the actual packet data.

Another thing to consider is that the public IP i.e. the one seen from the internet, belongs to the ISP. Most of the time the ISP uses 1 public IP to serve multiple endusers, meaning that multiple people connect through the same IP to the internet/look the same. The backtracking who sent the packet can only be done via the ISP. To my knowledge only enterprises have their own IP, which can be tracked directly to them.

To me it sounds like your friend used a torrent client, to download the game. Google "torrent filesharing" if you want an explaination, but in short by downloading something, others can download the same thing from you. For this to happen, you dont need to configure your router or any firewall. It happens pretty much on its own. So unfortunately she could have done it on accident. Although this would only work if her PC was running while she was away and starting the PC while not physically there would be pretty much impossible for a normal enduser. No VPN would make that happen.

Do I understand correctly: A lawfirm downloaded the game from your friend? To me it sounds like the lawfirm was fishing for a case.

I think you should contact a lawyer yourself.

Edit: You might want to post your problem on reddit https://www.reddit.com/r/legaladvice/. I think they can be of more help from a legal perspective.

PS: If you dont mind, keep us updated with how it plays out.

[shrad]

From an IT professional perspective the task of setting up a VPN on two sides and so would require an IT degree if it was done outside the help of some specific software or device.

If it was done from the help of such software or device it would have been on purpose on both sides of the channel, so there are two sides to take proof on.

Wireless networks are also very easy to hack and spoof as nowadays there are a vast number of ways to circumvent wireless security (see hackaday.com and search for keywords "wireless" and "security", you will have some solid references and maybe parallel cases).

As said, a lawyer would be helpful in this case because the lack of knowledge in these fields in many people will lead to abuse from such law firms.

I'm pretty sure that somewhere a little crap is laughing at his free internet here and there...

[Uspring]

Thank you for all your answers.

@plasma:

I've never heard of a basic home router to do that, if she logs into the router it should display bytes sent received and packet count for Wan port and Wlan

I'm just checking now, whether her router was capable enough to do the forwarding by itself. We don't have the router anymore but we do know the model. I can't follow up on your advice wrt its settings.

@Fumeaux:

The backtracking who sent the packet can only be done via the ISP.

Exactly, the ISP was contacted by the law firm and they disclosed the user to them.

To me it sounds like your friend used a torrent client, to download the game. Google "torrent filesharing" if you want an explaination, but in short by downloading something, others can download the same thing from you. For this to happen, you dont need to configure your router or any firewall. It happens pretty much on its own. So unfortunately she could have done it on accident. Although this would only work if her PC was running while she was away and starting the PC while not physically there would be pretty much impossible for a normal enduser. No VPN would make that happen.

You're likely right about torrent. Whether this was the case my friend can't know, since she isn't the culprit.

The claim made by the opposing lawyers is, that there was a live computer sitting in her apartment forwarding a remote access made by her, so that it appeared as if the copyright violation was started from there. Or, the lawyers weren't clear about this, that her router was configured in such a way, that she could do this without the help of a live computer in her apartment. I believe, but I'm not an expert in this, that a VPN connection from a remote computer makes the remote computer a member of the network in her apartment, so she could, in principle, access the internet from there. That would make it appear, that the copyright violation was started from her apartment.

Do I understand correctly: A lawfirm downloaded the game from your friend? To me it sounds like the lawfirm was fishing for a case.

Yes, the law firm was contracted by the copyright holder in order to follow up copyright violations.

I think you should contact a lawyer yourself.

My friend did this, but ... how do I say this politely ... he is inept.

@shrad:

From an IT professional perspective the task of setting up a VPN on two sides and so would require an IT degree if it was done outside the help of some specific software or device.

If it was done from the help of such software or device it would have been on purpose on both sides of the channel, so there are two sides to take proof on.

That is what I thought and your assessment is encouraging.

Wireless networks are also very easy to hack and spoof as nowadays there are a vast number of ways to circumvent wireless security (see hackaday.com and search for keywords "wireless" and "security", you will have some solid references and maybe parallel cases).

Sadly, precedence cases hereabouts show, that courts consider WPA2 networks as being secure. Unless weak passphrases are used. But then it is the users responsibility if it is hacked.

[Hydron]

It is possible for a router to offer a VPN service, but would certainly depend on the model.

To use a VPN you'd need to set that up on the router, and also setup a dynamic DNS service to allow for the IP address to be discovered from another location when it changes (I'm assuming here that the IP is a dynamic one that would likely change periodically or when the modem is rebooted).

If the router doesn't have a VPN service available then you'd still have to do the dynamic DNS thing (assuming a dynamic IP), and would also have to setup a computer to act as the VPN server, and dig into the router configuration to enable the appropriate ports to be forwarded to said computer. Alternatively (and unfortunately) there are programs out there designed to sidestep most of this doing-it-properly thing, and would indeed allow for a "few clicks" type of operation, assuming a host computer was left behind permanently on and attached to the network (e.g. LogMeIn Hamachi).

If you can dig up the model of the router then it should be pretty easy to check what it is capable of, but at the end of the day it's basically always going to be possible to setup a VPN in some way unless the ISP is using NAT or similar due to the IPv4 address shortage (am assuming that's not the case).

You're never going to be able to 100% prove that it was impossible to be VPN'd into the network unless there is something like ISP NAT going on - it sounds like a bullshit catch-all argument used when the defendant can actually show that they were unlikely to be responsible but the opposing party still wants to shake someone down. This may be a case where they know it wouldn't stand up in court but are relying on the financial cost and difficulty of a layperson taking them on (unless it's covered by some sort of strict liability, where the account holder is _always_ at fault even if they didn't have ability to control the use of it). I'm assuming that strict liability doesn't apply though, because otherwise they wouldn't be trying on the "YOU COULD HAVE USED A VPN!!!1!" bollocks once they learned that the defendant wasn't in control of the network at the time.

[Uspring]

Hydron, thank you for your help.

I'm assuming that strict liability doesn't apply though, because otherwise they wouldn't be trying on the "YOU COULD HAVE USED A VPN!!!1!" bollocks once they learned that the defendant wasn't in control of the network at the time.

You're right, it is not strict liability here, but is much like a reversal of the burden of proof once a copyright violation has been detected on your IP address.

[Zipdox]

My router has an easy to use VPN server builtin and I do use it when on vacation. It is very easy to do.

[Uspring]

Zipdox, presumably you have quite a bit more expertise in this area than my friend has. Something being easy is somewhat relative. May I ask, why you use a VPN? Does it have something to do with a restriction of services, i.e. them only being available in the country you live in? I'm asking, because motives of this sort or others might be assumed by the opposing lawyers. The instruction manual for my friends router does not even mention VPN connections, so it is not likely, that it supports the feature you mention.

[Hydron]

What sort of burden of proof do you need to show that the infringement was not committed by the accused person?

Is it beyond reasonable doubt? Because if so you're (she) is screwed, and so would ~99.999% of people to ever get accused (very hard to prove you cannot have done something like that), so I assume that's not the case.

If it's "on the balance of probabilities" then the fact that the router didn't have a VPN feature, the accused was overseas and not in control of the apartment, and had no other computer equipment left (hard to prove unfortunately) might swing things her way unless there is an asshole judge or something involved.

[Zipdox]

Zipdox, presumably you have quite a bit more expertise in this area than my friend has. Something being easy is somewhat relative. May I ask, why you use a VPN? Does it have something to do with a restriction of services, i.e. them only being available in the country you live in? I'm asking, because motives of this sort or others might be assumed by the opposing lawyers. The instruction manual for my friends router does not even mention VPN connections, so it is not likely, that it supports the feature you mention.

To encrypt traffic on insecure WiFi and to access my server and other devices on my local network while away. It's just a simple setting in the router menu that you can enable. I have an Asus router.

[Hydron]

A VPN server option is much more likely to be present in a router that's bought for it's features and performance and has to complete in the marketplace than in an ISP supplied unit that might just be designed to do the bare minimum.

[Uspring]

@Hydron:

What sort of burden of proof do you need to show that the infringement was not committed by the accused person?

That is not really clear to me and likely depends on the judges frame of mind. All my friend can do is to try to convince the judge, that this is difficult for a layperson, if there is a live PC in her apartment and impossible if there is no other hardware except her basic router. That's exactly the point you made:

A VPN server option is much more likely to be present in a router that's bought for it's features and performance and has to complete in the marketplace than in an ISP supplied unit that might just be designed to do the bare minimum.

@Zipdox:
My friend just owns a laptop and keeps all her data there (and in some external HDs for backup).

The crazy thing is the lack of motive to go into all this VPN stuff, since using her own IP address for a copyright violation will directly point at her. And this copyright violation would have had to be planned a long time in advance, since she was already several months away, before it happened.

[plasma]

I can help, but lick I said, you need to ask there lawyer for a pcap file, that should break off the conviction.

[Uspring]

Thank you for your offer, plasma.
But I don't understand your reasoning. Are you saying, that the opposing lawyers might have enough information to distinguish between theses two possibilities:

1) There is a torrent participant sitting in my friends apartment offering software, or

2) The software is offered remotely through a VPN connection from abroad going through her apartment.

Wouldn't these 2 cases look the same to the lawyers downloading the software from my friends IP address?

[MRMILSTAR]

This posting reminds me of why I stopped using Torrents about 6 years ago. Its too visible. A friend of mine still uses Torrents but he uses a VPN hosted in another country for a small monthly charge. He hasn't had any problems.

[plasma]

The lawyers arnt expected to be ask for pcap files,is you have a It team looking at it.
About Tor with out bounds connection, you could use carrier, like what ISP uses,  if they have the technology to determined deference, they also have the information.

[Hydron]

I can help, but lick I said, you need to ask there lawyer for a pcap file, that should break off the conviction.

I think the idea here is showing you're actually serious about contesting it and also technically competent (by asking for the actual evidence they allegedly have - this is the pcap file) - if they rely on people not having a clue then it might put them off going forward.