Question: I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the [outrage](http://en.wikipedia.org/wiki/Anonymous_%28group%29#Activities) of [Anonymous (hacker group)](http://en.wikipedia.org/wiki/Anonymous_%28group%29), but as a critical thinker, I'm unable to control my curiosity to dig out how exactly they are doing this? Frankly, this group really scares me.

One thing that I don't understand is how they haven't been caught yet. Their IP addresses should be traceable when they DDOS, even if they spoof it or go through a proxy.

* The server with which they are spoofing should have recorded the IPs of these guys in its logs. If the govt. ask the company (which owns the server) don't they give the logs?
* Even if it is a private server owned by these guys, doesn't IANA (or whoever the organization is) have the address & credit card details of the guy who bought & registered the server?
* Even if they don't have that, can't the ISPs trace back to the place these packets originated?

I know, if it was as simple as I said, the government would have caught them already. So how exactly are they able to escape? 

PS: If you feel there are any resources that would enlighten me, I'll be glad to read them.

[Update - this is equally appropriate when referring to the [Lulzsec group](http://en.wikipedia.org/wiki/LulzSec), so have added a quick link to the Wikipedia page on them]

Answer: 
The thing about a DDoS is that you use *other people's* IPs, not your own. It's relatively simple to become untraceable on the Internet -- just route your traffic though a host that is not keeping traffic logs. As someone who frequently has to try to track these people down, I can tell you what an impossible nightmare it is. Here's the pattern I frequently see:

1. Select a relatively recent exploit in some web software package (e.g. joomla extension).
2. Use google to find an appropriately vulnerable attack target
3. From some location that can't be traced to you (e.g. coffee shop), execute the attack to gain control over the vulnerable server, but don't do anything else that would draw attention to yourself. (bonus points, fix the vulnerablity so no one comes in behind you). Delete any logs that might trace back to your presumed location.
4. Repeat the above, relaying your traffic through the previously compromised server. Repeat again several times until you're removed multiple steps from the machine that will be behaving as your proxy. Ideally these servers should be located in countries like China, India, Brasil, Mexico, etc., where datacenter techs tend to be *uncooperative* toward investigations, and should all be located in different countries as to create jurisdiction and communication nightmares for the people trying to track you.

Congratulations, you're now anonymous on the Internet. It's a bit like Tor, except none of the nodes know they're participating. Usually these attackers set up and use backdoors on servers for which no logs or records are kept (since the backdoor presumably doesn't exist). Once the attacker disconnects, that link becomes permanently untraceable. 

One hop drops your chances of detection dramatically. Two hops makes detection almost impossible. Three hops and it's not even worth the effort.
Maybe you should read [this PDF](http://cryptome.org/0003/anonymous-barr.pdf). They are not so anonymous. The LOIC tool used for DDOS, leaks the original IP of the person using it. You can use the browser (JavaScript) version of the same tool, maybe hiding behind Tor.

HBGary Federal exposed their names and addresses in that PDF. That is why they attacked his site, email, wipe his iPad, took over his twitter etc....
Search the #hbgary hashtag on twitter for more info on that.