4 ms·

The hacker was exposed because of poor OPSEC (due to tracking of his IP address). > Rigmaiden had received boxes and boxes of criminal discovery that would hel

The hacker was exposed because of poor OPSEC (due to tracking of his IP address). > Rigmaiden had received boxes and boxes of criminal discovery that would help him understand how the government planned to prosecute its case. In the penultimate box, he saw the word “stingray” in a set of notes. The authorities were exposed because of poor OPSEC as well. They weren't supposed to ever mention “stingray”.

johnnymonster 8y ago
The story didn't mention how they were able to get his IP address in the first place. That level of detail is important for this community!
- sulam 8y ago
  He was filing fake tax returns. That probably exposed his IP in logs on government servers.
  - mirimir 8y ago
    The safe bet is that every site that you access logs your IP address. At the very least.
  - nindalf 8y ago
    What on earth? Isn't using a VPN the bare minimum when you're doing something potentially illegal?
    - akvadrako 8y ago
      Maybe he did. Unless he's careful in picking his VPN provider they probably have some level of cooperation with the FBI.
      - boomboomsubban 8y ago
        He didn't, but getting anonymous access to a VPN wasn't exactly the simplest thing then. And if you think they would be unable to find the precise location of the aircard, it's not really adding any protection.
  - qrbLPHiKpiux 8y ago
    Should have used the USPS
rattray 8y ago
If I had to guess, I might say poor OPSEC is somewhat common... EDIT: while we're here, do you have a single "start here" article/site for the basics of less-poor OPSEC?
- mirimir 8y ago
  Some good sources: https://blog.cyberwar.nl/2016/02/some-elements-of-intelligence-work-73-rules-of-spycraft-allen-dulles-1960s/ https://blog.cyberwar.nl/2016/02/some-elements-of-intelligen... https://www.opsecprofessionals.org/official/081103_DOD_OPSEC_Manual.pdf https://www.opsecprofessionals.org/official/081103_DOD_OPSEC... http://www.opsecprofessionals.org/training/OPSEC_Training.pdf http://www.opsecprofessionals.org/training/OPSEC_Training.pd... https://www.slideshare.net/grugq/OPSEC-for-hackers https://www.slideshare.net/grugq/OPSEC-for-hackers https://grugq.github.io/blog/2013/06/13/ignorance-is-strength/ https://grugq.github.io/blog/2013/06/13/ignorance-is-strengt... https://theintercept.com/2015/11/12/edward-snowden-explains-how-to-reclaim-your-privacy/ https://theintercept.com/2015/11/12/edward-snowden-explains-... http://thefifthcolumnnews.com/2017/03/tradecraft-introduction-to-opsec/ http://thefifthcolumnnews.com/2017/03/tradecraft-introductio... You might also enjoy my guides: https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano... https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-1 https://www.ivpn.net/privacy-guides/online-privacy-through-o...
guitarbill 8y ago
agreed, for somebody who seems intelligent and driven, seems like it would have been beneficial to put more effort in upfront. but then hindsight is 20/20, and it seems like to be good at OpSec is has to be your job (i.e. providing money so you can solely focus on it), or you have to be truly paranoid.
cryptonector 8y ago
It's difficult to never mention something so important, even if it's a local department rule. And once something like stingrays are well known to the public then it can be a fair inference that they are used in cases where that is the simplest explanation for how the police found or tracked a suspect. Poor OPSEC on the part of the police is basically a given in a society where we have public trials and due process (including discovery). Whether the law allows or should allow the use of such devices, and whether with or without a warrant is up for debate, but it can't allow hiding their use, not in an open society with due process. It was always bound to be the case that some judge would think so, that some police note would leak this, that some police office would testify about it, that a Snowden would leak it, or that the public would figure it out anyways (especially when it comes to active devices). So I wouldn't blame bad OPSEC on the part of the police here for anything. (Not that you are. Just saying.) The defendant in the story, BTW, is not very sympathetic. In general, for test cases, one wants a sympathetic defendant. That's because judges are at least somewhat biased, typically. A judge has to imagine a much more sympathetic defendant and set of circumstances in order to convince themselves to continue with a line of argument that leads to the defendant being cleared on a technicality.
OliverJones 8y ago
All secrets eventually leak. It's a question of time. Not even state actors with unlimited resources can prevent secrets from leaking. So this wasn't bad operational security by authorities. It was a fundamentally flawed operation. Security through obscurity has limited and unpredictable usefulness. Good OPSEC can delay a leak, maybe. But OPSEC is still much harder for defenders than attackers. The article doesn't mention it, but SURELY agency planning about this particular secret covered the next steps to take when it leaked. Ordinarily good OPSEC has defense in depth. Secrets should have limited useful lifetime. "Stingray" as a secret doesn't: once bad actors know their phone locations can be targeted, they can't un-know it. It should be obvious to the holders of secrets when they leak, so they know they're compromised. Having this "Stingray" crop up in a big mess of bankers' boxes full of court docs isn't obvious. Security by obscurity needs a plan B ready to roll at any time. Much better is transparent security, where the tech is well known, the actual secrets have limited useful lifetimes (key-rotation and forward secrecy for example), and reasonable controls exist (search warrants in this case). If law enforcement executives don't know this, they need to go back to school. But they probably do know it, and they're practicing security-by-obscurity on their plan B. (I don't defend somebody who stole large quantities of taxpayers' money. Not at all. But the rule of law--search warrants--is vital.)
- heavenlyblue 8y ago
  You are only correct if stingrays are only a recent invention. On the other hand I am pretty sure they used them for at least a decade now - which means police had managed to abuse the security through obscurity thing for a vast number of cases by now.

johnnymonster 8y ago

The story didn't mention how they were able to get his IP address in the first place. That level of detail is important for this community!

sulam 8y ago
He was filing fake tax returns. That probably exposed his IP in logs on government servers.
- mirimir 8y ago
  The safe bet is that every site that you access logs your IP address. At the very least.
- nindalf 8y ago
  What on earth? Isn't using a VPN the bare minimum when you're doing something potentially illegal?
  - akvadrako 8y ago
    Maybe he did. Unless he's careful in picking his VPN provider they probably have some level of cooperation with the FBI.
    - boomboomsubban 8y ago
      He didn't, but getting anonymous access to a VPN wasn't exactly the simplest thing then. And if you think they would be unable to find the precise location of the aircard, it's not really adding any protection.
- qrbLPHiKpiux 8y ago
  Should have used the USPS

rattray 8y ago

If I had to guess, I might say poor OPSEC is somewhat common... EDIT: while we're here, do you have a single "start here" article/site for the basics of less-poor OPSEC?

mirimir 8y ago
Some good sources: https://blog.cyberwar.nl/2016/02/some-elements-of-intelligence-work-73-rules-of-spycraft-allen-dulles-1960s/ https://blog.cyberwar.nl/2016/02/some-elements-of-intelligen... https://www.opsecprofessionals.org/official/081103_DOD_OPSEC_Manual.pdf https://www.opsecprofessionals.org/official/081103_DOD_OPSEC... http://www.opsecprofessionals.org/training/OPSEC_Training.pdf http://www.opsecprofessionals.org/training/OPSEC_Training.pd... https://www.slideshare.net/grugq/OPSEC-for-hackers https://www.slideshare.net/grugq/OPSEC-for-hackers https://grugq.github.io/blog/2013/06/13/ignorance-is-strength/ https://grugq.github.io/blog/2013/06/13/ignorance-is-strengt... https://theintercept.com/2015/11/12/edward-snowden-explains-how-to-reclaim-your-privacy/ https://theintercept.com/2015/11/12/edward-snowden-explains-... http://thefifthcolumnnews.com/2017/03/tradecraft-introduction-to-opsec/ http://thefifthcolumnnews.com/2017/03/tradecraft-introductio... You might also enjoy my guides: https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano... https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-1 https://www.ivpn.net/privacy-guides/online-privacy-through-o...

guitarbill 8y ago

agreed, for somebody who seems intelligent and driven, seems like it would have been beneficial to put more effort in upfront. but then hindsight is 20/20, and it seems like to be good at OpSec is has to be your job (i.e. providing money so you can solely focus on it), or you have to be truly paranoid.

cryptonector 8y ago

It's difficult to never mention something so important, even if it's a local department rule. And once something like stingrays are well known to the public then it can be a fair inference that they are used in cases where that is the simplest explanation for how the police found or tracked a suspect. Poor OPSEC on the part of the police is basically a given in a society where we have public trials and due process (including discovery). Whether the law allows or should allow the use of such devices, and whether with or without a warrant is up for debate, but it can't allow hiding their use, not in an open society with due process. It was always bound to be the case that some judge would think so, that some police note would leak this, that some police office would testify about it, that a Snowden would leak it, or that the public would figure it out anyways (especially when it comes to active devices). So I wouldn't blame bad OPSEC on the part of the police here for anything. (Not that you are. Just saying.) The defendant in the story, BTW, is not very sympathetic. In general, for test cases, one wants a sympathetic defendant. That's because judges are at least somewhat biased, typically. A judge has to imagine a much more sympathetic defendant and set of circumstances in order to convince themselves to continue with a line of argument that leads to the defendant being cleared on a technicality.

OliverJones 8y ago

All secrets eventually leak. It's a question of time. Not even state actors with unlimited resources can prevent secrets from leaking. So this wasn't bad operational security by authorities. It was a fundamentally flawed operation. Security through obscurity has limited and unpredictable usefulness. Good OPSEC can delay a leak, maybe. But OPSEC is still much harder for defenders than attackers. The article doesn't mention it, but SURELY agency planning about this particular secret covered the next steps to take when it leaked. Ordinarily good OPSEC has defense in depth. Secrets should have limited useful lifetime. "Stingray" as a secret doesn't: once bad actors know their phone locations can be targeted, they can't un-know it. It should be obvious to the holders of secrets when they leak, so they know they're compromised. Having this "Stingray" crop up in a big mess of bankers' boxes full of court docs isn't obvious. Security by obscurity needs a plan B ready to roll at any time. Much better is transparent security, where the tech is well known, the actual secrets have limited useful lifetimes (key-rotation and forward secrecy for example), and reasonable controls exist (search warrants in this case). If law enforcement executives don't know this, they need to go back to school. But they probably do know it, and they're practicing security-by-obscurity on their plan B. (I don't defend somebody who stole large quantities of taxpayers' money. Not at all. But the rule of law--search warrants--is vital.)

heavenlyblue 8y ago
You are only correct if stingrays are only a recent invention. On the other hand I am pretty sure they used them for at least a decade now - which means police had managed to abuse the security through obscurity thing for a vast number of cases by now.