Mac Forum / Applications / Other MS Products / January 2006

To try to further unravel the mystery, I double-checked with my friend
as to whether "the spy" had used any identifying phrases to indicate
what he had done and my friend said he specifically made reference to
"Your IP address."

Now, surely "the spy" CAN'T be out to get EVERYONE who subscribes to
the same Internet Service Provider as my friend, unless I mistake the
meaning of "IP" as being "Internet Provider" as opposed to "Identity
Personal" or some other thing.  So this must indicate "the spy" has
some way to, if not infiltrate, at least identify my friend's Mac in
particular?  What my friend wants to know is does this persist if he
changes Internet Service Providers and Operating Systems but not Macs?
Thanks on his behalf.

Cori

Ah.  Okay, that rules out a lot of the tin foil hat stuff I was
talking about earlier then.  

About all a remote website authore can know about an inbound poster:
       o ip address (which you said was different because the victim
         had moved and had new service established).  Did the spy
         have any way of knowing where the victim had moved?
       o account name/password  (which you said was different becaust
         he victim created a new login/password on the site in quetion)
       o Web browser  (if the victim uses a unique web browser, this
         can be a good clue)
       o Persistent cookies (if any).  This is my leading suspicion
         how the remote web site spy knew the person had come back,
         and from which new ip address.
       o writing style and word choice.  even the words that are
         misspelled and how they are misspelled can be used to
         identify someone.   How you sign your posts can also give ya
         away.  A determined spy can tell a lot just from word
         choice.

Depends if you reinstall the operating system over what's already
there, or you do as i suggest and format the hard drive first, then
reinstall the OS.  In the former situation, the cookie and cache data
may persist, in the latter they definitely do not.  But, with a format
of the hard drive you also lose all your data unless you back up
first.

However that's probably not necessary in this case, now that we can
reasonably rule out a malware infection or intentionally installed
software as the answer of "how didthe spy detected the victim?"  If
all the spy is is a remote website operator, the solution is easier:

       o Anonymous web surfing software such as Ghostsurf or
         Tor+Privoxy.  Because the victim's new ip address is already
         known to the spy, they have to change it somehow.   Short of
         getting a new ISP (which will be in the same geographic area
         anyway, and provide a clue), anonymouse surfing software is
         the way to go.
       o Delete all cookies from the current web brwoser.  Empty the
         cache files.
       o Change web browsers.  If the victim uses IE now,  switch
         to Firefox.  If they use Firefox now, switch to Opera.
         This does two things:  changes the browser info that is sent
         to the web site in question and uses a different cookie set
         so a persistent cookie from th eold days won't be seen.
       o start writing in a different style.  

If the remote website operator did manage to get some spyware
installed onto the computer,  then the reformat and reinstall the
operating system takes care of that.

or better still, the simple and obvious solution:

       o The victim should leave the board pursue other interests.
         If there's a group that has it out for the victim on a given
         board, it's just not good for the victim's mental health to
         keep going back and doing battle.  There are few if any
         discussion boards that are worth this level of drama.

I hope it all works out regardless!

Best Regards,