10 ms·

So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to rese

So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)

joe_the_user 9y ago
It's supposedly part of the Turla malware system, which was already suspected of being a state sponsored system. However, I think there are many ways to mask origin. I wonder if this particular approach is intended so it becomes difficult to even shut down the botnet's C&C. [speculation]Using a fixed domain or ip-address for C&C let's authorities seize it and even a sequence you can predict might be predicted by someone else. This can broadcast its presence to an arbitrarily chosen IP address of the class of those going out to the satellite receivers and the C&C can filter all the traffic for this "I am here" message and can then conventionally communicate to the box - making blocking or spoof the C&C harder. [/speculation]
sillysaurus3 9y ago
Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense discipline. I think rtm could probably do it if he put his mind to it. Maybe tlb. Few others seem to have the personality for this. Solving the location hiding problem is the first step toward doing anything untoward. It's not as simple as "just use Tails." Try to build a service and you'll discover all the reasons. Money is the other half. I guess I may as well tell the story. You need money in certain situations, and bitcoin isn't always good enough. You need untraceable cash that you can spend online. You also need burner phones that can't be tied to your physical location in order to sign up for all the normal services. If you use Tor, you'll quickly discover that ~every service prompts you for a phone number during account creation. I solved this in a simple way: I waited until the middle of winter, then went to goodwill and bought a bunch of clothes, old shoes, and a facemask. I stuffed all of this in a trashbag, then paid a taxi in cash to drop me a couple miles from a certain store that had both prepaid visa cards and burner phones. For the first half of the walk, I looked like a normal person walking along at night, carrying a trashbag. I ducked into a neighborhood whose streetlights were out, and went in between two houses. It was nearly pitch black as I put on the clothes from the trashbag. I left the bag plus my old shoes hidden there, then continued for the rest of the walk to the store. I bought $400 worth of $50 gift cards and two prepaid phones, then did the whole operation in reverse. Why? Because when your opponent is a nation-state, you have a risk of being found via any other method. You can't drive anywhere because of license plate trackers. You can't show your face at the store thanks to facial recognition. You can't wear the same outfit without being picked up on CCTV's near your home base in the same outfit that you were wearing at the store. The same care has to be taken when activating and using the burner phones. Every usage has to be treated as an operation, not an errand, or you're caught. You have to assume one mistake => caught. It was very satisfying having $400 in untraceable cash to set up an untraceable service, complete with an online persona with gmail, twitter, github, and every other normal service. The reason for this level of paranoia was that in addition to being a game, one of my main ambitions has been to fight against drug cartels. I wanted to use technology to do this. My hypothesis was that right now, the main reason cartels are so powerful is that nobody is in a position to talk. Say you're a peon in a cartel: someone who unloads the drug buses that run from Mexico to Chicago, for example. You have very valuable knowledge: what times the buses will arrive, where they're unloading, who's involved. But even if you wanted to snitch, you'd suffer a fate worse than death if you're caught. What are you going to do? Keep submitting this info as anonymous tips to the FBI's website? There's no organized resource for peons to report activities like this. That's why I wanted to build one. It's like SecureDrop for fighting cartels rather than governments. As you can tell from me posting this casually, nothing ever came of the experiment. But if it had, I would've slept quite soundly knowing my location was untraceable even with government-level resources aimed at tracking us down. All of this is to say that the "location problem" is very relevant to pretty much any serious activity, government or not.
- MichaelGG 9y ago
  Or you could have just bought the cards with Bitcoin. Same for phone verification. By buying the card in person you leak a ton of location information.
  - sillysaurus3 9y ago
    Agreed, though it was three years ago when BTC was less useful. Does phone verification as a service really work now? Also I wonder how many gift cards you can purchase reliably and quickly. FWIW, it was the same idea as this article, just a 20 mile radius instead of 600. General location was going to be leaked anyway since it's impossible to use the internet without doing so. Even if you rely on Tails with perfect opsec, traffic correlation can narrow down which region you're in. It's possible to figure out your timezone based on the times of your online interactions. If this SecureDrop offshoot was to succeed, it was going to require lots of communication with the press and with users. Much of the value of the service is knowing you're not alone, and that there are people who are incorruptible and can do something with the information. (My plan was to carefully vet the info for legitimacy, carefully anonymize it, then try to contact some special agent via email once I had anything actionable.)
- jacquesm 9y ago
  - did you have a cellphone in your pocket? - where did you get the cash? - by talking about it you negated all the advantages you built up - if you walk into a store wearing a facemask you run the risk of being arrested or even shot because they assume you are robbing the store - you may have left fingerprints in the store - the cabdriver has seen your face and knows your home address, you should have walked to the spot where you changed your clothes - the clothes bought at the goodwill, did you pay cash for those too? - what happened to the clothes afterwards? - how did you summon the cab to your change location? - you're lucky that neither of the houses you changed next to had a dog
  - glenneroo 9y ago
    I'm not even GP but I think I can answer a lot of these. Are you maybe trying a little too hard to play devil's advocate? - did you have a cellphone in your pocket? After going through all of this, do you honestly think he forgot that detail? - where did you get the cash? That's a good question. Hopefully he withdrew a different amount of cash on a completely separate date, otherwise bank account and transactions surely could be linked. - by talking about it you negated all the advantages you built up He said he is only mentioning it now because he didn't actually go through with his plan i.e. he doesn't care. - if you walk into a store wearing a facemask you run the risk of being arrested or even shot because they assume you are robbing the store What country do you live in where you're shot for wearing a facemask? Holy shit. - you may have left fingerprints in the store Let's hope he wore gloves! - the cabdriver has seen your face and knows your home address, you should have walked to the spot where you changed your clothes Why does he know his home address? Taxis drive around in many cities. In most cities in Europe (regardless of size) there are taxis everywhere and also taxi parking spots, where there are usually a few taxis waiting. - the clothes bought at the goodwill, did you pay cash for those too? Is this a serious question? After all that other work and thinking the process through, why would he all of a sudden use a traceable ATM/credit-card? - what happened to the clothes afterwards? Hopefully burned. Or thrown away in a trash can far, far away. I would assume GP knows better than to throw them in his own trash. - how did you summon the cab to your change location? As mentioned above, taxis (in Europe at least) are everywhere. No need to summon. Just walk around for a few minutes. - you're lucky that neither of the houses you changed next to had a dog Why? Because the dog will bark? And? Dogs bark all the time, because there's a bird, a cat, leaves in the wind, etc.
diegoprzl 9y ago
Take a look at these slides [1] They're for 2010. Hardware needed? Around 70$. Knowledge? With those instructions, anyone. For the uplink you need to be able to spoof your IP which would require to find an adequate ISP [2] [1] http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/BlackHat-DC-2010-Nve-Playing-with-SAT-1.2-slides.pdf http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/... [2]https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]

joe_the_user 9y ago

It's supposedly part of the Turla malware system, which was already suspected of being a state sponsored system. However, I think there are many ways to mask origin. I wonder if this particular approach is intended so it becomes difficult to even shut down the botnet's C&C. [speculation]Using a fixed domain or ip-address for C&C let's authorities seize it and even a sequence you can predict might be predicted by someone else. This can broadcast its presence to an arbitrarily chosen IP address of the class of those going out to the satellite receivers and the C&C can filter all the traffic for this "I am here" message and can then conventionally communicate to the box - making blocking or spoof the C&C harder. [/speculation]

sillysaurus3 9y ago

Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense discipline. I think rtm could probably do it if he put his mind to it. Maybe tlb. Few others seem to have the personality for this. Solving the location hiding problem is the first step toward doing anything untoward. It's not as simple as "just use Tails." Try to build a service and you'll discover all the reasons. Money is the other half. I guess I may as well tell the story. You need money in certain situations, and bitcoin isn't always good enough. You need untraceable cash that you can spend online. You also need burner phones that can't be tied to your physical location in order to sign up for all the normal services. If you use Tor, you'll quickly discover that ~every service prompts you for a phone number during account creation. I solved this in a simple way: I waited until the middle of winter, then went to goodwill and bought a bunch of clothes, old shoes, and a facemask. I stuffed all of this in a trashbag, then paid a taxi in cash to drop me a couple miles from a certain store that had both prepaid visa cards and burner phones. For the first half of the walk, I looked like a normal person walking along at night, carrying a trashbag. I ducked into a neighborhood whose streetlights were out, and went in between two houses. It was nearly pitch black as I put on the clothes from the trashbag. I left the bag plus my old shoes hidden there, then continued for the rest of the walk to the store. I bought $400 worth of $50 gift cards and two prepaid phones, then did the whole operation in reverse. Why? Because when your opponent is a nation-state, you have a risk of being found via any other method. You can't drive anywhere because of license plate trackers. You can't show your face at the store thanks to facial recognition. You can't wear the same outfit without being picked up on CCTV's near your home base in the same outfit that you were wearing at the store. The same care has to be taken when activating and using the burner phones. Every usage has to be treated as an operation, not an errand, or you're caught. You have to assume one mistake => caught. It was very satisfying having $400 in untraceable cash to set up an untraceable service, complete with an online persona with gmail, twitter, github, and every other normal service. The reason for this level of paranoia was that in addition to being a game, one of my main ambitions has been to fight against drug cartels. I wanted to use technology to do this. My hypothesis was that right now, the main reason cartels are so powerful is that nobody is in a position to talk. Say you're a peon in a cartel: someone who unloads the drug buses that run from Mexico to Chicago, for example. You have very valuable knowledge: what times the buses will arrive, where they're unloading, who's involved. But even if you wanted to snitch, you'd suffer a fate worse than death if you're caught. What are you going to do? Keep submitting this info as anonymous tips to the FBI's website? There's no organized resource for peons to report activities like this. That's why I wanted to build one. It's like SecureDrop for fighting cartels rather than governments. As you can tell from me posting this casually, nothing ever came of the experiment. But if it had, I would've slept quite soundly knowing my location was untraceable even with government-level resources aimed at tracking us down. All of this is to say that the "location problem" is very relevant to pretty much any serious activity, government or not.

MichaelGG 9y ago
Or you could have just bought the cards with Bitcoin. Same for phone verification. By buying the card in person you leak a ton of location information.
- sillysaurus3 9y ago
  Agreed, though it was three years ago when BTC was less useful. Does phone verification as a service really work now? Also I wonder how many gift cards you can purchase reliably and quickly. FWIW, it was the same idea as this article, just a 20 mile radius instead of 600. General location was going to be leaked anyway since it's impossible to use the internet without doing so. Even if you rely on Tails with perfect opsec, traffic correlation can narrow down which region you're in. It's possible to figure out your timezone based on the times of your online interactions. If this SecureDrop offshoot was to succeed, it was going to require lots of communication with the press and with users. Much of the value of the service is knowing you're not alone, and that there are people who are incorruptible and can do something with the information. (My plan was to carefully vet the info for legitimacy, carefully anonymize it, then try to contact some special agent via email once I had anything actionable.)
jacquesm 9y ago
- did you have a cellphone in your pocket? - where did you get the cash? - by talking about it you negated all the advantages you built up - if you walk into a store wearing a facemask you run the risk of being arrested or even shot because they assume you are robbing the store - you may have left fingerprints in the store - the cabdriver has seen your face and knows your home address, you should have walked to the spot where you changed your clothes - the clothes bought at the goodwill, did you pay cash for those too? - what happened to the clothes afterwards? - how did you summon the cab to your change location? - you're lucky that neither of the houses you changed next to had a dog
- glenneroo 9y ago
  I'm not even GP but I think I can answer a lot of these. Are you maybe trying a little too hard to play devil's advocate? - did you have a cellphone in your pocket? After going through all of this, do you honestly think he forgot that detail? - where did you get the cash? That's a good question. Hopefully he withdrew a different amount of cash on a completely separate date, otherwise bank account and transactions surely could be linked. - by talking about it you negated all the advantages you built up He said he is only mentioning it now because he didn't actually go through with his plan i.e. he doesn't care. - if you walk into a store wearing a facemask you run the risk of being arrested or even shot because they assume you are robbing the store What country do you live in where you're shot for wearing a facemask? Holy shit. - you may have left fingerprints in the store Let's hope he wore gloves! - the cabdriver has seen your face and knows your home address, you should have walked to the spot where you changed your clothes Why does he know his home address? Taxis drive around in many cities. In most cities in Europe (regardless of size) there are taxis everywhere and also taxi parking spots, where there are usually a few taxis waiting. - the clothes bought at the goodwill, did you pay cash for those too? Is this a serious question? After all that other work and thinking the process through, why would he all of a sudden use a traceable ATM/credit-card? - what happened to the clothes afterwards? Hopefully burned. Or thrown away in a trash can far, far away. I would assume GP knows better than to throw them in his own trash. - how did you summon the cab to your change location? As mentioned above, taxis (in Europe at least) are everywhere. No need to summon. Just walk around for a few minutes. - you're lucky that neither of the houses you changed next to had a dog Why? Because the dog will bark? And? Dogs bark all the time, because there's a bird, a cat, leaves in the wind, etc.

diegoprzl 9y ago

Take a look at these slides [1] They're for 2010. Hardware needed? Around 70$. Knowledge? With those instructions, anyone. For the uplink you need to be able to spoof your IP which would require to find an adequate ISP [2] [1] http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/BlackHat-DC-2010-Nve-Playing-with-SAT-1.2-slides.pdf http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/... [2]https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]