From my understanding,
NYPD/FBI have done a damn good job. Investigation of his data trail has turned up links to ISIS, though I can't conclusively state whether ISI- claimed responsibility for the attack of-yet. Seems the Uzbeki perp is a former/current New Jersey resident with rudimentary knowledge of NYC. Once a resident of Paterson, NJ, just a few minutes away from the other recent Elizabeth, NJ attempted terror bombing.
Once they find out who was listed as the financially-responsible party, as well as who's driver's license was used to rent the pickup, they'll follow that to either his on/off-record finances and thus offline/online purchases, as well as whatever state he may have been licensed in under any related aliases, and go from there.
In my experience handling legal documents and working with immigrants, I've noted - to our combined frustration - that the US Gov't often chops up foreign names in order to simplify the formatting for many forms of identification.
At least in my experience working with insurance, the department of motor vehicles, and immigration, its been a flaming nightmare to match up half a dozen variations of a single individual's identity for this exact reason. Social security has one name, visa had another, greencard yet another, driver's license another, personal tax identification number yet another, out of state licence prior to transfer yet another... Logistical clusterfuck when the presence or absence of a letter, or combining a typical longer South American name like Ana Maria Gonçalves Da Silva into Anamaria G. Dasilva, Ana M. Silva, Maria G. Dasilva, so on and so forth. Effectively, this diverges a single individual's legal/financial/data trail into two or more separate identities that may or may not have enough parallels to get a solid hit.
Not to mention how disgustingly easy it is for people to get false identities... Hell, we had a local business get shut down by the FBI for falsifying passports, driver's licenses, and what-have-you. One of them got caught, the other fled the country. Too bad they didn't nab both of 'em. I used to see false documentation on a fairly regular basis when working in the insurance industry. A lot of times its damn near impossible to verify, outside of a hunch that something's off about texture/color/material/language.
Let's not even get started on international driver's licenses constantly made using falsified foreign driver's licenses that allow drivers to own and operate vehicles with practically no paper trail. This is due to the inherent difficulty or downright impossibility of verifying a foreign driver's license, especially for countries where every friggin' state and municipality has its own size, material, wording, coloration, and dating mechanisms.
I can't count how many times I've bitched people out for bringing me falsified documents, which I only caught because I had previously worked with - and retained copies of - licenses from same-similar nations/regions.
Nothing really prevents an American citizen itself from literally printing out a fake license from some random country using an assumed name to obtain an international driver's license, get insurance with Geico or Progressive (only two I know that allow INTL DL's), renting a truck from Uhaul/home depot/lowes/etc, and pulling this shit off.
*facepalm and sigh* Man, I'd love to work for the FBI right now.