#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd

Any thoughts on Mullvad? ( [LINK] ) I also like the conference talk "#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd" most of it is based on hackers that have been jailed lately and specifically what they did to end up in jail, but there is also some techinal stuff about privacy and anonymity, specifically about TOR+VPN here: [VIDEO] EDIT: RE: Mullvad, AFAIK they don't have any presence outside SE, NL, or DE so I think your speeds will take a hit coming from outside Western Europe.

Using a pseudonym may be great, but there's always the temptation to be more abrasive, offensive or obnoxious when using one. The longer you keep an identity online in public forums the more information you tend to leak through side channels and should your identity end up compromised you risk having a lot more exposed than if you never covered at all and thought (mostly) before posting. I've chosen to use my real name here because of the level of conversation when I joined and because I've associated HN initially more with the traditional hacker world than the blackhat type. Those of you using pseudonyms could do worse than learn from the Grugq[1]. [1] - [VIDEO]

From the Q&A at the end ( [VIDEO] ), Grug has this to say on TOR: "Against [Law Enforcement Officials], it's fine. Against a nation-state, the TOR network has insufficient resources and has sufficient bad actors that it is not actually secure. So if you're going to hack the shit out of the NSA and do really really bad planning and do not actually evalute the targets you are after, you will go to jail." He also expands on how to unmask a user by controlling both the exit and entry nodes: "So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month, you will be able to uncover a large number of users. [...] You are better of selecting your targets so they will not be state actors."

From the Q&A at the end ( [VIDEO] ), Grug has this to say on TOR: "Against [Law Enforcement Officials], it's fine. Against a nation-state, the TOR network has insufficient resources and has sufficient bad actors that it is not actually secure. So if you're going to hack the shit out of the NSA and do really really bad planning and do not actually evalute the targets you are after, you will go to jail." He also expands on how to unmask a user by controlling both the exit and entry nodes: "So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month, you will be able to uncover a large number of users. [...] You are better of selecting your targets so they will not be state actors."

OPSEC for Hackers ( [VIDEO] ) uses a quote from The Wire to reference what you're talking about: “The thing is, you only got to fuck up once. Be a little slow, be a little late, just once. And how you ain’t never gonna be slow, never be late? You can’t plan for no shit like this, man. It’s life.” The Grugq addresses this issue by recommending that one set up an entire fake persona before doing anything, and then doing all the activities "in character" as that persona. If you stay in character, then even making the types of mistakes DPR made would only lead the authorities to the persona rather than yourself. Granted, this video didn't exist when DPR made Silk Road...

Watch the author's 'OPSEC for hackers' presentation of the slides linked in the article: [VIDEO] slides: [LINK]

'grugq' shares current best practice, and recently stopped by HN when his blog came up for discussion: Anonymity Is Hard [LINK] OPSEC for Hackers (video) [VIDEO]

There is a really good video of OPSEC by grugq on YouTube from Hack In The Box Security Conference. Basically gives you some rules and things to think about, but also talks about where lulzsec went off the rails, and how they were caught. Really interesting talk. [VIDEO]

I must have been following the grugq[1] way too much because all I couldn't help thinking about the massive OPSEC mistakes he did. Fortunately he was apprehended by the German Police, but things would've been way different had took that plane. [1] There's a great presentation from him on video, including analysis of OPSEC failures from other hacker groups: [VIDEO] [2] Another timeless classic: "Don't talk to [the] police", which explains why it is never in your interest to talk to the police when you are suspected of a crime (even if you are innocent): [LINK]

The US prison system is completely insane whether you are a hacker or not. It is baffling to me why you would want to send non-violent criminals to prison with hardened criminals in the first place, the rehabilitation is likely to be higher (and cheaper) with something like an ankle bracelet. Also an interesting idea to have hackers teaching hardcore criminials about OPSEC. Although you could make the argument that the hackers who get caught aren't usually very good at OPSEC to begin with - I suspect that they are learning though, even the Grugq has a video about it [1]. [ [VIDEO] ]

Just because a data aggregation site does not show your data on the front-end, does not mean they deleted it from the back-end. So now you can charge 50$ for people to search in the "special" data pile, where people took the effort to remove it from the front-end. These data brokers crawl publicly available information. Telling them to remove your data, only slows down the doxxer, it does not stop them at all, since the data was already shared. It is not plugging the leak, it is mopping up some of the water. A false sense of security and a clear sign to the doxxer that you care about your anonymity (so more "lulz" to be had). A proper doxxing is also much more than entering a name in some search engines. Especially hackers do not like to be doxxed. For internet civilians who already put this data out there (on social media) a simple data broker doxxing is a mere reminder that such data is public to everyone, not just friends. Doxxing defense is guarding your anonymity online. Everywhere. Doxxing defense is knowing when to change persona's, and when to log off. That is: If you care about it at all. If you care about keeping your identity a secret online, see: [VIDEO] (The Grugq - OPSEC: Because Jail is for wuftpd).

This guide is very hand-wavey. Tor alone is a poor operational security strategy; using nikto and unix-privesc-check does not a hacker make. This may be a decent place to begin one's inquiry, but don't let it end here too. Here are some talks I recommend: Tricks for Defeating SSL in Practice - Moxie Marlinspike [LINK] OPSEC: Because Jail is for wuftpd - thegrugq [VIDEO]

[LINK] [LINK] These discussions are definitely post-mortem analysis but there is also discussion on another OpSec presentation: [VIDEO]

I have to say that I had no use for YouTube until I realized that these kind of talks were on there. In addition to what you mentioned, some I like: The Gruqg on OpSec: [VIDEO] Russ Cox's ACME tutorial: [LINK] Jessie Frazelle on running containers on the desktop: [LINK]

TL;DR: A plurality of Tor users are from Western countries with arguably decent judicial frameworks. Those that have life-or-death consequences to network anonymity will need a lot, lot more than the Tor Browser Bundle or Tor itself. > If their location and they get it with the equivalent of their local government's "search warrant", it's more likely a raid, interrogation, threats, harassment, censorship, and possibly torture and death. This is not who is primarily using Tor. 1/5 directly connecting users of Tor are in the United States. See: [LINK] This doesn't change even for bridge users: [LINK] So, the majority of Tor users are in places I think we'd consider have somewhat working judiciary frameworks. And I'm highly skeptical of even the American judiciary framework, if you read some of my past posts. You are correct, my original threat model was those Tor users and their use cases; if they are in FVEY territory they are probably already lost as Tor does not protect against "passive global adversaries" that FVEY IC has proven to be and may be able to be probabilistically deanonymized as was shown in the Snowden slides. [1] Yes, I admit I should have been thinking more deeply, and my original advice isn't good enough. I have a tendency to not think things through fully before posting here, and then I edit/evolve my thoughts as time goes on, as one does in a verbal discussion. Like you stated, clearly there are situations in which users rely on Tor for more than simple ano

Edit: Other commenters report that Android will silently re-enable cell data under various conditions, so this isn't a surefire solution, either. The Grugq created a tool for this a decade ago (sadly unmaintained): [LINK] as part of a presentation about operational security for hackers. It's a great watch if you're interested in how various (in)famous hackers thought they were secure and got busted anyway. [VIDEO]