• Hi,

    I have the following question regarding security of personal data or data to draw conclusions on the identity.

    Following assumption:

    Someone makes a new wordpress site (domain is registered in USA with privacy whois) which is hosted on a shared server in the USA. The wordpress installation is located in its own folder on the hosting account. The hosting account also contains other folders with websites for domains that don’t have Whois privacy protection.

    Is there a way to find out that someone’s identity via the new wordpress installation? How high are the chances? What should be considered?

    Background is that this someone plans to create a satirical site that could trigger retaliation from certain religious extremists as happened in Paris (charlie hebdo) though the content allegedly might not be that provoking. This someone plans this as a “freedom of speech”-satirical response to the attack in Paris.

    The structure on the hosting server would be:

    root/old domain(site) with no privacy protection
    root/new satirical domain(site) with privacy protection

    Would be really great to get some input here. Thanks!

Viewing 7 replies - 1 through 7 (of 7 total)
  • Thread Starter Knordelia

    (@knordelia)

    For clarification: It’s not the purpose to hack, it’s about being as safe as possible from hacks. Naturally standard security measures would be taken (firewall, etc.) but the main question actually should also be clarified:

    If this new site gets hacked is is possible for the intruder to find out other domain names/sites in the same root folder that then would lead to identity of site owner?

    …is is possible…to find out other domain names/sites in the same root folder…

    I have had the names of nested folders containing separate instances of WordPress discovered, and I do not expect obscurity to provide any kind of security or privacy.

    …that then would lead to identity of site owner?

    If one domain sitting next to another has Privacy Protection and the other does not, simple logic would suggest both domains at least *could* belong to the owner of the second.

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    I moved this from Plugins/Hacks to miscellaneous cause it’s really that. It’s a serious topic you’ve raised.

    Is there a way to find out that someone’s identity via the new wordpress installation? How high are the chances? What should be considered?

    Yes. Many ways but not necessarily from a WordPress installation. Your WordPress installation will only share/publish what you put into it. If you do not put in any personal identifying information then there is nothing to reveal.

    This plugins may help too, give them a look.

    https://www.ads-software.com/plugins/tags/anonymous

    The real concern is all the non-WordPress information out there related to your domain or hosting.

    From the top of the WordPress Foundation page:

    The WordPress Foundation is a charitable organization founded by Matt Mullenweg to further the mission of the WordPress open source project: to democratize publishing through Open Source, GPL software.

    The “to democratize publishing” is important but in many countries including the U.S. there really is no such thing as anonymity on the Internet. There is the appearance of anonymity but that’s all it is.

    If you are seeking to publish while maintaining as much anonymity as possible then I encourage you to research the topic thoroughly. There are forums for that sort of effort just not these forums. Sadly, many of those other placess also host the worst people too and if you go looking for that then keep that in mind.

    Just hosting your site, being careful what you publish and using domain privacy guards will not really do it and keep you anonymous.

    Thread Starter Knordelia

    (@knordelia)

    Thanks for the feedback. It’s not going to be my site, but I help someone doing it (or actually do it for that person).

    The real concern is all the non-WordPress information out there related to your domain or hosting.

    I thought so, too. I tried some tools from https://pentest-tools.com/ on my own sites to see what can be found out – but since I’m no expert I don’t really know what conclusions to draw from the results.

    In this case the smallest problem are government agencies spying on – against them one can’t protect himself efficiently anyway – but hackers working for members of extremist religious groups who could become a real threat when they find out the identity of someone who mocks them. That person who is planning this has a really good domain name and seems to have a good plan to use it (satire). This could also get quite some publicity if done right. As far as I understood it’s not going to be something like showing the prophet as Charlie hebdo did, but could still enrage the radical ideologists who apparently are behind that
    attack on Charlie Hebdo.

    It’s in a way sad, that satire (though considered by some offensive) can threaten one’s life. On the other hand one might say now that it should be done regardless of anonymity issues as a response in the name of freedom of speech. But it’s not my decision, but I want to help as good as I can.

    Thread Starter Knordelia

    (@knordelia)

    Maybe an anonymous offshore hosting server would a solution then?

    It’s in a way sad that satire … can threaten one’s life.

    Getting the target’s consent ahead of time would remove that problem.

    Thread Starter Knordelia

    (@knordelia)

    Getting the target’s consent ahead of time would remove that problem.

    Yeah, but unlikely that consent would be given.

    After some research it seems that anonymous web hosting would be the best solution to be sure. Otherwise there is a risk to be identified and in the worst case end up like the guys from charlie hebdo.

    In my opinion here is also the problem that such deeds as in Paris create this atmosphere where you can’t be sure anymore. If that person for whom I do this would just go with that setup as he/she has now, it might be as well that nothing would happen – maybe some threat mails…but after Paris it seems risky. That is exactly what “they” want. ??

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Identifying site's owner via hack’ is closed to new replies.