Operational Security Essentials: A Guide for Hacktivists (OPSEC)

[00:00:07][Music] [Music] hello everyone thank you for your patience thank you for coming back into the room in time for us to start timely with without further Ado I'm going to hand over to the grug with his presentation for today please join me in welcoming grug cool thank you all right uh so this is going to be a talk about obsc it's actually not very technical uh most of the problems that people have with opsac are uh non-technical in nature basically they say too much uh it's intended for uh Freedom Fighters so if you're out freedom fighting all the internet uh this is useful for you uh very briefly we're going to go over uh an introduction on what opsac actually is uh a methodology for how to implement it um then we're going to spend quite a bit of time looking at the LC indictments to see what they did wrong and the OBC fails that they had uh then we're going to go over uh techniques to help your obsc and then uh technology that you can use specifically to make uh obsc uh easier to do and then a brief conclusion so the problem that we're facing is uh one that was expressed well on the wire and that you only need to [ __ ] up once right one mistake is enough to be fatal um this one's pretty awesome right so you only got to [ __ ] up once be a little late be a little slow just once and you can never ever not be late or not be slow just once so we need to plan for that we need to [ __ ] uh put methods in place to make it less likely that our mistakes will be fatal um so briefly what the [ __ ] is obsc obsc in a nutshell just keep your mouth shut all right just don't say it uh the less you say the harder it is for people to figure out what you're doing you need to guard your secrets uh you need to basically operate on what we' call a need to know basis uh generally speaking no one needs to know um the the less that you tell people the better off you are and you need to work hard so that you never get in a position where people can blackmail you uh this is reflected later on in another slide where we we say one law at a time um basically you do not want to give people an opportunity to take control over your actions or your life um it's a terrible idea so in short shut the [ __ ] up right if you don't say it then you don't have to encrypt it or try to protect it um this is an actual excellent guide to obsc uh it's specifically for people who smoke weed um so they've got a slightly different set of rules but they're aiming at basically the same thing so you need to be careful need to be conscious of what you're doing and you need to keep your [ __ ] mouth shut right again the less you say the better off you are for it um as always be paranoid you need to be proactively paranoid uh paranoia does not work retroactively uh mistakes you make will come back to haunt you uh you want to be tidy so you want to make sure that you don't leave Contraband lying around uh an example of a freedom fighter this would um mostly mean things like not leaving incriminating evidence on your laptop making sure that your incriminating evidence is stored on your jump box which would be the first hop that you reach before you start doing your freedom fighting activities on the internet uh you'd make sure that it's always encrypted that it's not left lying around it's not left in a state where other people can access it and copy it uh you'd make sure that it's not on your conference laptop so that when you go to conferences and people break into your hotel room and copy your hard drive they get nothing um basically you need to minimize the amount of stuff that's left lying around that other people can find uh when you are talking to people in an environment that might be monitored which is whenever you are talking to people um never be explicit so don't say let's go in Freedom fight the hell out of Sony and also don't use code right the the clever code word uh the the clever codes that you come up to talk about stuff are terrible um there very very easily broken so this example of like I would like two green sweaters and one mushroom pizza right that is not a good code um on the other hand do use code words right so cryptonym are much better than being explicit so if you're going to be discussing um a particular freedom fighting activity against a particular Target have a cryptonym set up for that Target so you could say we are freedom fighting the hell out of Achilles not we are freedom fighting the hell out of Sony that way uh If it creates a uh additional layer of security so that if your uh conversation is monitored and logged it is harder for people to understand what's going on and it is uh easier for your defense later on and that you could say uh Achilles was not Sony so that was actually not what we were talking about um right and as it says here one law at a time right so you need to provide less ammunition for people to try and go after you you want to make sure that you are not breaking a large number of laws that you get busted for one and then they find all your hacking kit like that would be bad uh similarly it's better off if you don't do drugs because uh for example with weave who got busted in New York they couldn't get him on a hacking charge they got him for drug possession right so they will they will find a way to get you so make it harder for for them in that regards and uh in general camouflage is always good so one methodology for uh doing obsc is basically you need to think about uh how to put the plumbing in first so you need to set up uh your environment for obsc before you actually start doing things so you need to set up your cover identities before you start using them um so my recommendation would be that you create a cover uh your cover is basically an alias a fake identity then you need to work on the legend which is basically the uh history of the background and supporting documentation for that cover um for example uh one very very famous cover is the um the case of The Man Who Never Was which was a guy who died of pneumonia that was dumped overboard uh during World War II next to Spain with um fake documents for the D-Day invasion um and the idea was that when he would be found these fake documents would be taken as legitimate and would confuse uh would act disinformation against the Nazis at worked uh he had 42 pieces of identifying documentation on him right from a ticket step for a movie to his uh driver's license to his officer ID he had a huge amount of background documentation to um act as bonafides to basically make it appear that he was who he said he was um you need to do the same thing like having a simple Gmail account is not sufficient it's better off if you create an hire fake persona with a fake Twitter fake Facebook and so on uh even better if you can get uh fake photographs which appear to be of some other individual and create this entire Persona and then you become that Persona first so you inhabit that before you create your online uh Alias your online uh usernames and so on and then when you do your freedom fighting activities from your online Alias when that gets compromised the person that takes a heat is your cover someone who doesn't exist right and it's very very very critical that you never contaminate so contamination is when there is contact between uh two cover identities or two aliases uh or in this case between your real identity and your cover Persona so be very very very conscious of contamination avoid it like the plague um this is actually from the 10 Crack Commandments by Biggy Smalls uh he has an excellent guide to how to conduct an illegal business or uh illegal activities without going to jail um never reveal your operational details don't tell people how you do what you do or what you are doing never reveal your plan so don't let people know what you plan on doing or what you intend to do um never trust anyone right this particularly goes for the people that you're operating with uh they are not your friends they are criminal codefendants right you want to make sure that they are not in a position that they can do harm to you if they get busted and there's a high likelihood that they will because they're probably dumb that's why they're doing what they're doing um you need to never confuse recreational activity and hacking uh and freedom fighting activities uh Recreation is [ __ ] that you do for fun freedom fighting activities should be treated like a business it's an operation you need to plan who you're going after you need to pick your targets you need to select you need to actually invest some time and effort into that and then when you conduct your operations you need to do that in a systematic and logical fashion and you need to be careful about how you go about doing it uh if you're just going around popping boxes because it's fun you will go to jail right and never operate from your own house uh so for example example um The Iceman who got popped uh a while ago who was documented in uh the Kingpin book by Kevin hard to pronounce last name um he would rent hotel rooms and use those hotel rooms to operate from with a huge Wi-Fi antenna to uh hack into neighboring um businesses and then steal their bandwidth to use that right so that would uh that would keep his house house contamination free uh free of Contraband uh that's a bit extreme uh if you have the capability of doing that you should do that um but at a bare minimum you have to make sure that you are using tour before you go anywhere else tour provides a level of anonymity um however you are better off just not using your own house uh you need to be proactively paranoid as I said before paranoid does not work retroactively you need to plan in advance to be terrified of getting busted uh and you need to work with that in mind all the time otherwise you will make mistakes and go to jail um you need to keep your personal life and your freedom fighting activities completely separated you want to make sure that um the people who know about your freeding fighting activities do not know who you are and uh the people who know you personally should not know that you are conducting freedom fighting activities right it's just dangerous for everyone uh if you want friends go to the pub right don't hang out on IRC and hacker channels to meet people right it's a terrible idea you will go to jail um you want to keep your personal environment Contraband free as I said earlier you want to make sure that your own equipment is kept neat and tidy you want to make sure that all of the evidence that you're generating is not kept on your personal equipment that it's kept on your first jump box on your your hot box uh it's not in a situation where if you get uh busted then it can be used against you it's in a situation where if it gets busted it can also not be used against you it shouldn't be it shouldn't be on your person ever um obviously don't talk to the police it's a dumb idea and never give anyone power over you which again is the one law at a time or um similarly don't let people blackmail you don't get into a situation where there are other people who can control your actions if there's someone else who is in charge of your actions um then it's going to end very very badly like you have no ability to control your own life at that point that's not where you want to be so you might be thinking wow that sounds hard why do you need it very simply it hurts to get [ __ ] all right you're better off going through the effort now and not going through the pain later or um with the the Army quote it's the more the more you sweat in peace the less you bleed in war right and it's important to remember that no one is going to go to jail for you if you're trusting people to keep their mouths shut uh which you should never do they won't right this is why VPN are not actually secure um vpns would only be secure if you trusted that the operator of a VPN is going to go to jail for you um that's not going to happen as these dudes found out right that would be uh Hammond and Donna's the other one and then two other dudes right no one is going to go to jail for you when Sabu [ __ ] up and got busted he flipped immediately same day and turned everyone else in your friends will betray you all right you really cannot trust these people so uh Hammond who actually had reasonably good obsc activities ended up uh being busted because he revealed a large amount of personal profiling information during chats which were then used to incriminate him later um let's see so here's the lwc indictment uh I understand that this is all too smaller no one can actually read it so um Hammond at one point says to Sabu he's been arrested for for weed did two weeks in the county jail and and then he says don't tell anyone because it could compromise my identity but I am on probation right if you have to say do not tell anyone you shouldn't be telling that person right if you know it's going to compromise your identity why the [ __ ] are you telling it to anyone never ever ever ever do this right never trust anyone particularly your criminal code defendants um so in this case which one was it okay uh this is hilarious so um this dude like Donna Caroll or Dona Carol some GIC name um he had been defacing uh political websites for um Irish political parties uh in order to get the defacement code to put up his friend used Facebook to send it to him they sent a copy of the defacement code via Facebook Messenger like don't do that that's a terrible [ __ ] idea right so his Facebook in his real name is now linked directly to this right here you go pro tip don't use your personal Facebook account to send defacement code to Freedom Fighters terrible [ __ ] idea um again when he was logged into IRC and talking with people um his username like basically the username that he used on his computer or on his IRC client before he logged in was his real first name and then uh regardless of which uh nickname he used which which handle he had on IRC uh his IP stayed the same his username stayed the same and he would do things like slash Nick in the same channel to to swap from one ID to the other right it turns out that that's not very effective right that is not a good way to hide your identity all right so yeah there we go they're all from the same IP address uh plaum pum Shar the same login ID which was the dude's real name dumbass right so clearly uh in this case you want to never provide uh person identifiable information in your online name and you want to avoid contamination he did not avoid contamination in this case so each of those usernames uh each of those online IRC nicknames was contaminated by the others um he directly contaminated in this case uh CW is Sabu the covert witness uh C uh Sabu says to him who is this and he's logged in his polonium and he says this is palladium all right again don't contaminate you need to know which identity you're using uh in this case uh Hammond was talking with Sabu and telling him about uh his lifestyle choices and how he operates in particular he mentioned this very unique thing that he is a fan goddess uh so fans are people that dumpster die for food so when he was under surveillance by the FBI when they thought they had the right guy and they observed him dumpster diving for food that demonstrates that he's a frean and they could link it back to the statement that he had made earlier so he had provided uh profiling information in his online chats and that was used to bust him so as a good example of keeping your personal life completely separated from your freedom fighting activity is do not talk about things that are uh personally identifiable to you all right um this one was [ __ ] genius uh we're back back to Dona the dude who used Facebook to send his the face codes he also used his home IP address uh he used his actual home computer to log into a compromised Gmail account to access um the uh one of the the Irish police uh Gmail accounts like don't do that like definitely do not operate from your own home that's an incredibly [ __ ] dumb idea so again don't connect to your target directly from your home IP address right you would think that this would be obvious but um all right so again never operate from your own home uh uh Hammond had also uh contaminated previously he had used his own uh home IP address when he was hacking into some white supremacist sites uh he hadn't been busted for that but he had been put on lists um that's an important thing to do is avoid getting put on lists so uh here we had like uh they they used lists of people who were known Hackers from previous activity and this was uh one of the the list that they used when they were narrowing down who the potential suspects were never operate from your own home um they actually did some really really impressive stuff they used uh Wi-Fi triangulation to figure out which uh Wi-Fi signal uh coming from his house was actually his and uh figured out that it was coming from the rooms that he rented uh checked that down and then from there they used um I'm assuming that he had uh some Wi-Fi encryption like it's unlikely he was using an open network but they hopped onto uh his Network and then they used that um to do a pen trce and they also linked the MAC address of his computer against the statement that he made earlier about how he uses Apple products so they use the MAC address add to show that he was using a Mac and he had said earlier that he uses a Mac so again this was used uh to compromise his identity and pop him and that is because uh again he revealed operational details of what he was doing all right so don't Reveal Your operational details don't tell people how you are doing things uh this was another example of how he revealed operational details he told uh he complained frequently about how T wasn't slow sorry how T was slow how YouTube didn't work and uh how annoying it was to use tour when they were monitoring his traffic they were able to um they were able to show that all of the traffic leaving his house was going directly to tour so that was used as a piece of circumstantial evidence against him as well so by revealing operational details of how he conducted his activities and how he operated uh it was possible to then observe those particular operational details in action and Link them to him this is an amazingly stupid activity um so here Sabu was supplied with an IP address from the Gmail logs um when they had gone through the the Gmail logs of um access to that compromised Irish police site they found some that were anomalous and appear to originate from Ireland they said uh can you find out who this is we believe it's uh pums uh Sabu took that IP address and said to padium do you recognize this IP address and padium because he's a [ __ ] genius said yes that looks like the one I connect from right uh also uh Plum had said that he uses uh a particular VPN network uh to connect to his targets the IP addresses from the Gmail logs were from this particular VPN network um and again Sabu asked him do you use the perfect privacy VPN and again padium answered yes I use that VPN please send me to jail um so here they have later on they show again all of the compromise all of the access to the compromised Gmail accounts occurred from the guy's home address or the the one VPN that he had stated that he uses so obviously he's going to jail right so once again never re Reveal Your operational details do not tell people how you operate don't tell them what you're doing um right in this case he was insufficiently paranoid so after he got busted they took him to an interview and they showed him uh logs that they had collected from Sabu of the IRC channels where he was doing all of this stuff and they said to him here we know everything about you we've got the logs as you can see then they released him on bail he gets back on these compromised IRC channels and he says hey everyone I know for a fact that the feds are monitoring these channels and Sabu says no way I don't believe you why would you think that I'm certainly not a covert witness to which ponum says I was showed them during my interrogation right so he's now not only confirmed for a fact that he is polonium by verifying that he was busted and has been interrogated in this way he's now been in the same channels that are being logged and being logged as stating that he was just arrested and interrogated like it's shockingly dumb like um so then Sabu starts sort of quizzing him again to make sure he knows who this guy is and he starts saying [ __ ] like uh so Sabu is acting all like uh proactively paranoid like I don't know who you are who are you you're saying shit's being logged I know shit's being logged um you just showed up out of nowhere he says yes like I don't want to tell you who I am because I don't want to be associated with a comp compromised handle and then uh he points out that he was raided and again verifies that he is who he says he is that um the the chat I showed earlier where uh Sabu says to him who is this he responded with the uh username of the individual that was arrested so again you have to be proactively paranoid uh here was a huge warning sign when he got raided and when they interrogated him they asked him about a large number of other people involved in the chat but not about Sabu right because obviously they don't need to ask about Sabu they've already got him and he's acting as a covert witness so that should be a red warning sign if out of your entire gang one guy gets arrested and everyone else is uh he's asked about informational details of everyone else except for one person there's a very very high likelihood that one person has already been arrested and compromised so you need to be proactively paranoid and make sure that no one involved uh with you is going to be able to compromise and uh reveal information about you right here's a guy who actually did good uh this is virus virus was in a chat with Sabu and basically uh virus says do not start accusing me of being an informant especially after you [ __ ] disappeared and then come back offering to pay me for [ __ ] that's fed tactics right and then your friend [ __ ] topiary that no one knows where the [ __ ] he is he's never been docks no one knows who he is he gets [ __ ] busted right and Sabu is like what I never did that who offered to pay you for information and virus points out yes you offered me money for docks only informants ever offer up cash for [ __ ] right so again here's a warning sign if someone disappears for a while then they come back and they start offering to buy inform about things uh cash is one of the one of the things that feds are able to throw at a problem right they might not have the uh intellectual resources but they have the financial resources so once they compromise someone they can then start using money to get other information um if someone starts offering up money for [ __ ] he's probably not a hacker because hackers generally have no [ __ ] money right otherwise they'd be penetration testers and penetration testers don't do stupid [ __ ] right so there's is actually a happy ending a virus who is smart and proactively paranoid has not been busted um this slide is basically just for examination later on um it discusses various ways that uh you can uh contaminate an identity so it lists uh different activities that they the feds can do to correlate between uh online handles and use that to figure out that all of these handles are associated with one individual then they try and figure out who that one individual is right um so never contaminate uh here is just the uh information on how um once they believed that Hammond was the guy to go after uh they started conducting surveillance on his premises on on his domicile like where he lived they used that surveillance to link his online activity of the subg handle to his presence in his home right so when he was at home they would call up Sabu and be like is sapg online and then when he would leave they'd call up and say is sapg online as he just left now and they used that correlation between online activity and physical activity to um further link uh hammonded to the subg Persona uh everyone recognize these right this was um a uh a JPEG that was put up on a defaced site by the [ __ ] genius wormer who is now in jail um he got busted because when he uploaded this picture which was sent to him by his girlfriend in Australia he never removed the exf metadata which included the GPS tags for where it was taken which was from her home which was then linked to her Facebook account where her Facebook boyfriend was wormer right this is incredibly bad obsc um he then after he' gotten busted went and posted a huge dump of uh his reasonings online on ppin and sent that out so he has made the job of his public defender incredibly difficult all right this is my name this is my online handle uh I was taken to the office I turned over all the evidence I had I'm now going to jail I hate myself I'm a dumbass um he fell for one of the oldest tricks in the book uh the FBI agent basically said um you have no skills you're no good at what like so uh it's kind of like nagging like basically the um the guy doing the interrogation will belittle the abilities of the person that they're interrogating and the large ego of the person they're interrogating will cause them to then uh correct the mistakes and demonstrate they actually have the the skills that are being demeaned and in the process they confess to everything so here he points out in particular that um neither the DPS Administration nor the FBI understand the complexity of SQL injections all right I I would guess that the FBI might understand the complexity of SQL injections particularly if they're interviewing someone who does not understand the complexity of exf data um right so those those are some examples of dumbass [ __ ] things that you can do and how it will end you in jail uh it turns out that it's pretty low hanging fruit that you need to go after right it's very very difficult to be sufficiently paranoid but uh being more paranoid than these dudes isn't that hard uh so techniques basically you need to to put in the plumbing uh Plumbing is all of the stuff that you're going to use to maintain your cover identities and to keep them separate from your actual identity to uh create an environment where your personas appear to be legitimate and real and are not actually in contact with who you are the problem is Plumbing is [ __ ] boring right it's not exciting to go and create a fake Facebook account and generate fake activity and make it appear legitimate and make sure that every time you do this you do it from the correct uh IPS and from all this other stuff and that you never make mistakes on that and that on and on and on it's it's tiring and it's boring and it's really not fun and uh my advice by the way is use Gmail cuz it is a pain in the ass to set up Hotmail or Yahoo that [ __ ] sucks and then they ask for money if you want more than like 10 Megs of space uh Gmail is actually fairly good for that um obviously it's all monitored blah blah blah blah uh the awesome thing about Plumbing is if you've done it correctly then nothing happens yay um the important thing is of course you have to put in place first because paranoia doesn't work retroactively right really you have to be proactively paranoid you have to worry about all of this [ __ ] before it happens so if we talk briefly about personas uh you need to have legitimate personas like ones that are finally like vaguely believable um again an awesome quote from The Wire he knows my name but my name is not my name and to you to them you're only the Greek and of course I'm not even Greek okay so in this case they have set up uh very very legitimate personas which provide a strong level of protection so that even if uh the other criminal code defendants are compromised they will not be able to reveal information that is actually useful against these two individuals so that's why your handle should be something like Jose rather than you know your name all right so the problem is basically you are you right you are a unique butterfly um you stick out in a crowd really what you want to do is you want to be someone else right if you're someone else people will be distracted and won't know who you are so as you'll notice he's wearing a mask right um the primary danger that you will face when you're using an online Persona is contamination uh contamination is when there's contact between uh any cover identities or uh your your real identity uh that contamination uh will occur when they interact and it can then be used to trace from one compromised identity through to the other so it's always important to keep them completely separated and never interact right they need to be in isolation from each other uh you also need to do layers so simply having an initial cover identity is not sufficient once you have one cover identity you then um start creating sub aases from that uh it's better to have multiple uh cover identity so that when you get paranoid and you believe one has been compromised you can phase it out rapidly and move another one into place um an important thing to realize with a cover identity is that uh the time when it is most compromised is when it appears to be most effective so once it's generated a sufficient large uh history and Legend and it's it's got enough background enough interaction with a whole bunch of other people it's at this point that you need to kill it and roll in a new one because at is at this point that it has generated um enough sort of interactions and so on to be dangerous that it is going to be the most compromised and the most interesting to other people um and it's that point that you want to get rid of it and then move on to a new one um you need to use uh technologies that fail closed you need to make sure that you do for example tour before you do anything else uh to will provide a level of anonymity so that if your other uh techniques get get compromised or broken then at least you have t to fall back on as a final layer of Defense uh T is not foolproof but that's why it's part of a layer defense and it's part of your last layer so that there is a level of anonymity around you before it gets to anything else uh you should have your back stop Persona which is your uh your sort of primary cover identity and then you have your sub aases under underneath that like you can have uh your primary cover identity set up a secondary cover identity and then use that secondary cover identity to create your online handles and have uh layers of Defense in that regard so you would basically become your primary cover your primary cover would become your secondary cover your secondary cover would become your online handle who would then go on and do Freedom finding activities when they're compromised there's uh layers that need to be unwrapped and if you've been uh diligent in avoiding contamination it will be hard to link back through those multiple layers um one way you can avoid that is to avoid profiling information right so the problem with profiling information is when you provide information about yourself or about uh where you are and this can reveal your location uh geographically it can reveal uh information about you that can be used to unmask and figure out who you are um so yeah like I've been having a discussion with some people about exactly how many weather events with uh timestamps you would need to correlate before you could figure out where someone is geographically right so if someone gets on IRC and goes I [ __ ] hate how hot it is today right if you've got a time stamp you can start eliminating places that are not hot at that point in time and someone later on he starts complaining about the rain you can then use that time stamp to correlate for all of the areas that were previously hot that are now also raining and so on and from that you can uh probably track down someone's geographic location it's likely not going to be easy but again it's better off uh when it's raining [ __ ] about the heat when it's hot [ __ ] about the cold and so on use some disinformation there or just don't talk about it um the other important thing that you need to realize is that it appears very very easy to create a cover identity and assume that cover identity and uh do it without contamination it's actually something that requires practice right so what you need to do is you need to do it several times in situations which are not likely to end up with you going to jail and you need to practice being someone else and you need to practice going through the steps of creating a new cover identity um so it says amateurs practice until they get it right professionals practice until they can't get it wrong right you need to get really really deeply ingrained that when you are your cover identity you are your cover identity right not you are not pretending to be your cover identity you actually are that person so don't fall out of character all right um briefly on logging uh again the wire has got massive amounts of respect for having some excellent Ops rules what you're doing Robert's Rules of Order says we need to have minutes of the meeting these the minutes [ __ ] is you taking notes on a criminal [ __ ] conspiracy right avoid logging useless information uh so no logs no crime uh in particular uh the logs that you want to have are things like your scan logs or uh information that you've pulled down such as your password lists and so on those are useful pieces of information that can be used to uh conduct operations in future pieces of information that are not useful are things like CIS log right your jump box does not need to know at which times you have logged in right that's not information that is actually useful to you and it could be used as evidence against you so kill syis log um if you look at the script that was released with the uh Stu net CNC servers that's very good in how to strip down and eliminate information about um what sort of activities you're doing and mitigating against the risks of unnecessarily logged information um other interesting things that they do is for example they don't call their botn net a botnet right they they call uh ads and use data they have a very very primitive interface which appears to be uh juvenile except that it's simply making it uninteresting to the Casual Observer right so like there there's a huge amount that could be learned from the operational activities of these stet uh CNC administrators um in terms of staying Anonymous uh briefly if we go over some guidelines you want to avoid revealing personal information about yourself uh any personal information that you reveal can be used to create a profile that profile could then be linked to a subset of people on lists so uh if you're at this conference you are already on lists I can guarantee it um so anti-profiling guidelines these are all you would think amazingly [ __ ] obvious but again uh as you've seen you would be surprised right so don't discuss any personal information don't discuss where you're from what's happening what's going on or who you are right not include personal information in your online identities so don't call yourself uh 5 foot6 180 pound white guy 1988 right that's a horrible [ __ ] name unless you're actually you know not a 5 foot6 180 pound white guy um so avoid avoid creating handles which are obviously linked to you in some way um when you're discussing with people in chats that will be monitored which is again all chats um don't reveal things which are uh personally identifying such as physical traits your gender your tattoos your piercings or with your own only have one leg for example um this is why I never talk about my big penis because it's something that could be used to identify me no all right never mind these are the jokes kid okay um don't mention your profession your hobbies or your political activities uh again these are things that can be used to profile you and identify you later on uh for example these are things that Hammond did when he said that um he'd been arrested in an action recently which was uh the Republican National Convention and he was one of the protesters who got arrested out of 120 people it's like oh look here's one who's been busted for hacking and one who says that he was arrested during this event maybe it's this dude right so avoid mentioning things that You' have done that can be identified um when you are conducting Anonymous operations don't post things to clear text right this was used heavily by that HB Gary what's his name yeah yeah that dude who uh he liked to correlate information between uh online activities from different accounts and used that as a contamination source to figure out who was who um we don't know how actually effective it was but again it is a source of contamination uh when you are using an anonymous activity with a non-anonymous activity um never ever ever post po Facebook pictures um even if they are gorgeous tits you will go to jail uh for example your uh your Facebook link will contain your personal ID and that will be linked to your Facebook account and they'll know who the [ __ ] you are right uh another one uh there's a large amount to be said for keeping very very irregular hours this will avoid uh locating you in a particular time zone um which will again uh mitigate against some Geographic profiling um don't disc don't discuss your environment such as uh the elections are coming up and I really hope that some political party wins um and if you're using a keyboard which is uh unique in any way for example anything that is not a pure us like 102 character keyboard don't use special characters right uh again that will be used to Geographic profile you uh and if you think you're awesome you're not um basically the NSA was doing buffer overflows in the 80s uh there's a high chance that some of you weren't even born yet um there is no way that you more advanced than them right however for a long time the NSA didn't really give a [ __ ] about being uh the number one dog on the internet it didn't actually matter so like for quite a long time as hackers we thought that we were the apex predator um and it's just basically that the nation states didn't give a [ __ ] right uh we have seated the position of apex predator to Leo uh Leo is law enforcement officials uh it's actually more generally meant in this case to mean uh nation states who now give a [ __ ] uh we just simply do not have the resources to compete with nation states um they've got massive amounts of money huge amounts of people and they don't face going to jail if they [ __ ] up um so again uh shut the [ __ ] up uh in terms of technologies that you can use to help ensure that you uh maintain good obsc um right uh on the subject of vpns versus tour uh a lot of people seem to have uh thought that vpn's provided anonymity that's not the case VPN provide privacy Tor provides anonymity so the difference is uh privacy protects your data anonymity protects you right so if you are using a VPN service you have to make sure that you've gone through tour first otherwise that VPN is simply a link from the endpoint to you yourself right so tour to a VPN okay VPN to tour go to jail um when you're purchasing a VPN the only safe currency you can use is Bitcoins uh Liberty reserve is monted by the FSB uh web monies is monitored by the FSB if not administrated by the FSB um you might not care whether the FSB knows who you are but you probably would be better off without them having that information uh again when you purchase Bitcoins do that only over tour um if you're looking for vpns which do not keep logs uh check out this link from uh Tarn freak again I wouldn't actually trust any of those vpns who say that they don't keep logs uh prq and mulvad are the ones I would recommend um IP Predator is okay except that it's slow as hell um so a bit more on Bitcoins you need to remember Bitcoins are Anonymous but they're not private so all of the uh Bitcoin activity can be traced and can be used to connect back between uh different individuals so make sure that when you are using your Bitcoins you do that in a way that is not going to contaminate between cover identities um at a bare minimum like use unique wallets and also finish your slides before you go and give your talk so uh use mixers to uh do anything apparently um but uh I I don't actually have a good list of mixtures that you can use to make sure that your Bitcoins have been mixed thoroughly um it's it's something I need to address in future but I don't use vpns so it's not a a huge problem for me um the other thing is you need to make sure that you fail closed so uh in the infosu cartoon where he forgets to enable tour uh he gets [ __ ] and the reason is if you use tour button or tour browser these are technologies that can fail open right you do not actually have a good back stop um that's why I have developed portal uh portal is the personal onion router to assure Liberty right so uh I've got two examples uh this would be one of them this is a um TPL link uh VR 73n uh it's tiny it's awesome uh this one is an uh mr11 U and it has uh been chipped so it's been chipped to have uh more RAM and more disk space and it also has has an onboard battery that can run uh four to 5 hours um when you log in you get like a really awesome display of my aski skills and some ANC colors which is pretty [ __ ] cool um no logs no crime blah blah blah so uh portal acts as a router between uh your operational laptop and or sorry your your operational uh console and um your your online targets it ensures Ur that all of your traffic is always going over tour your uh operational machine is unable to actually access the router itself it cannot conduct any Administration activities it cannot um log in or access it at all and any traffic it sends will always be routed over tour as a result uh if your laptop gets compromised it cannot be used to connect back to someone else's shell and reveal your IP address um similarly when you use an OP operational laptop it should be one that has no radios so no Wi-fi no Bluetooth should have no webcam um and it should also not have an online battery so that if uh the police do come down and knock down the door you can pull the power plug out and it shuts down and now they have to deal with your encryption rather than with um trying to break your online passwords uh in this case I use a mobile Uplink uh in Thailand it's very very easy to get uh 3G connections like I can just walk into a 7-Eleven and buy any number of SIM cards um obviously I don't actually do that I send my maid to go and get them for me or uh have her get motorcycle guys to go and buy them and bring them to me uh it's a lot easier and means that I don't end up on CCTV purchasing a particular SIM card um by using a mobile Uplink it's safer than going to coffee shops um at a coffee shop your Wi-Fi can be monitored by people in the environment uh and and you also have the problem that if your telephone if you've got your phone with you and it's on uh and you haven't pulled the battery out when you're at a coffee shop if they are able to backtrack the uh attacks to that specific IP during that time frame they will also be able to correlate that with logs of your phone being at that specific location during that time frame right so uh your mobile phone can be used to uh uncover your geographic location and if your IP address can be used then um to also geolocate then those two can be correlated and you can go to jail um with portal we had to use some additional tricks on the earlier versions to get enough disk space to install so the unmodified routers have only four Megs of ram sorry four Megs of uh Flash and it is not possible to install t on four Megs because T takes 1.2 Megs by itself and the operating system takes 2.7 and you lose because you have no space so um it's not actually possible to get tore onto uh an unmodified router without using uh a micr SD in a mobile uh in a a 3G modem you have the um SD card configured to act as an overlay device which gets Union mounted and you can have uh between two and 32 gigs of disk space which is excessive on a router but um you know maybe you want to run bit torent as well uh the this is the hardware that's currently supported uh the mr11 U and the mr340 um I would recommend these they are fairly small they have an on onboard battery um they come in a neat carrying case well you can get them in a neat carrying case like this they're pretty awesome uh the Mr 3020 sucks it's basically the 703 but bigger um with nothing else and the 703 is Tiny which is awesome um they both have USB uh you can hit out my uh GitHub where I've put up some more information about it it's not actually complete yet but it will be soon so um that would be the technology to use it it provides an initial layer I'm now working on another project for uh developing an operational uh an operational console that you would then use when you're doing your actual online operations uh I'm probably going to use Raspberry Pi for that because it's fairly easy to get uh so in conclusion you can be you can be a criminal you can be famous but you cannot be a famous criminal shut the [ __ ] up right are there any questions no I am that awesome cool all right thank you oh right sorry FX uh what's the what's the in in your estimation uh the average cost per uh Persona um in terms of time you probably want to invest something like six months to bring it up uh there has been some discussion of creating a Marketplace for for personas uh because it is it's just really massive pain in the ass um in terms of money well in terms of money I wouldn't know in terms of uh time investment that I put into it to create a Bare Bones Persona it took me three days right uh Yahoo [ __ ] sucks right hot mail is a pain in the ass like you cannot believe um I think that can probably be cut down by at least one day uh because I had to do a fair amount of uh learning on the go but if you calculate my time as um like based on what I would charge for doing that you're looking at thousands of dollars per Persona like it's like the the hassle of doing it is pretty a pretty pretty epic um I don't know if for example the uh like the sweat shops in India that are good at like clicking on captures and stuff like that could be trained to create online personas like basically more filled out spam accounts um they already have a lot of the infrastructure for that and if they can be trained to do that then there might be such a volume of uh stuff that the price goes down and the an anonymity goes up because it's again an online Marketplace that's possible I mean if you do it yourself you're looking at several days of work and depending on how you would value that that's quite a lot of money I mean for you that must be tens of thousands of [Laughter] dollars yeah uh there's one more question up here nope yes uh sorry crypto credit cards I uh prepaid credit cards I don't really like them uh the so the question was uh what is my opinion on prepaid credit cards so the the issue I have with a prepaid credit card is the acquisition is uh inherently unsafe like even if you just walk into uh like a local 711 to purchase one over the counter you're going to be uh tied to that particular card via CCTV right so if they they do track back they have your picture which is not great and they have your geographic location which is again not great so you have to travel to make sure that it's not from your hometown you have to like you know wear a hat and a hoodie and look like you're going to mug someone which is going to draw attention which is going to make it even more annoying um you also have the problem that that um when you use it it is tracked and monitored online so uh like I actually do prefer Liberty reserve for those sorts of things a Liberty reserve like it's monitored by the FSB but the FSB basically doesn't give a [ __ ] as long as you do not [ __ ] with Russia right and if you're Russian as long as you [ __ ] with other people they again don't give a [ __ ] so you they they have a very very myopic view of things and you can take advantage of that uh it might not be completely foolproof but it does provide this level of like it's being administered by the FSB FSB is not going to cooperate with external entities because that's just not what they do and um as long as you don't sort of piss in their tent they're not going to care about you right so you can kind of fly under the radar on that one I would not be very comfortable with Prepaid Cards sorry uh that could work so uh the idea would be to to have um uh a mixer or an online exchange for prepaid credit cards um that's something that Silk Road could solve as a problem by so if you if you actually do want to purchase prepaid credit cards that are Anonymous you can buy them with Liberty reserve from a Russian website um and it costs uh 20% more than the the online value like the actual cost the the prepaid amount but it is purchased through a layer of indirection and it comes from criminals so it's probably not being monitored yay yeah and and shut the [ __ ] up about your prepaid credit card use now then now then I wanted to ask a question about children I work a lot with children and when I do I like to use a prepaid credit card what are your thoughts on proxying resources through other countries for example paying a small child to get a credit card on your behalf in another country um so uh basically there there is a lot of value to having an understanding of the geopolitics uh so uh I had a friend who got busted for uh a different hack but um what he used to do was hack the [ __ ] out of Iran all the time he loved it uh he didn't even bother to bounce before he went in there and his reasoning was there is no way in hell that the us is going to extradite someone to Iran for hacking it's just it's never going to happen right so you could hack as much as you [ __ ] liked and no one would care um if you do similar things like that so for example if you're a Malaysian I'm pretty sure that you can hack the [ __ ] out of Singapore with impunity I I don't think that you're going to have to worry too much about that uh I wouldn't recommend doing it but again that is that is a sort of um understanding of the geopolitical environment that you can use to your benefit uh in terms of proxying through multiple places uh again I would I would recommend using T it is sufficiently anonymous uh to keep you safe at that level um if you want a lot of proxies you can purchase them from the ld4 uh botnet the ld4 botnet has been set up uh from millions of bots across the world you can buy uh again using Liberty reserve you can buy uh socks proxies from the ld4 botnet from uh AMW proxy.sh sent to you from the botnet pool um if you use that as a final hop uh you're probably going to be safe because the Bots are developed in such a way that no connections are ever logged right so you will be able to uh choose your geographic location where you're going to exit your your terminal point uh you can probably choose down to a a particular state or a city in the US uh similarly you could probably choose a particular country in Europe um you can purchase from criminals who are again they will happily give up their logs once they get busted but um you should be doing it in such a manner that the logs that they can provide do not incriminate uh your actual identity they don't allow you to go to jail right so they have no uh monitoring of the end points the the actual traffic that goes back and forth they can show that someone purchased stuff but you're basically safe y security of tour as an anonymizer really like um if if you're into bad [ __ ] like how good is tour going to be so against State actors right so the the question is basically uh how secure is T against a motivated nation state um what happens with Tor is it's basically it's completely effective against a motivated uh policing agent against Leo it's fine against the nation state uh the tour network has insufficient resources and has sufficient Bad actors that um it is not actually secure so if you're going to hack the [ __ ] out of the NSA if you do really really bad um planning and you you do not actually uh evaluate the targets that you're going after and you pick on a state actor that is going to come down on you like a a ton of bricks uh you will go to jail uh there are problems with t in that uh if someone controls a sufficient percentage of the network they will be able to monitor uh exit nodes and entry points and that percentage is like really really low uh I think there's only something like 3,000 nodes in the network uh at any one time uh you uh I've heard that you only need to control 1% of them to uh statistically have a guarantee that you'll be both an entrance node and an exit node at some point in time and you can use that to demask so if you can control 300 boxes uh Jose probably knows a lot more about this because he controls more than 300 exit nodes Jose know who's who knows who you are but um yeah so if you can purchase say 300 VPS Accounts at $5 each then you can set up uh 1% of the tour Network and statistically uh over a month you'll be able to uncover a large number of users so tour is actually not super effective for that but what else you going to do uh you're better off selecting your targets so that they will not be State actors any other questions no cool thank [Applause] [Music] [Music] you