6 ms·

It always surprises me how hard it seems for people to take OpSec seriously (whether for terrorist plots or darknet markets). There are really a few basic groun

It always surprises me how hard it seems for people to take OpSec seriously (whether for terrorist plots or darknet markets). There are really a few basic ground rules that always seem to be violated, even by those with seemingly sufficient experience, like Ross Ulbricht. On the note of OpSec, there's an awesome project called USBKill, which probably would've saved Ross Ulbricht from prison. > USBKill is anti-forensic software distributed via GitHub, written in Python for the BSD, Linux and OS X operating systems. It is designed to serve as a kill switch if the computer on which it is installed should fall under the control of individuals or entities the owner or operator does not wish it to. It is free software, available under the GNU General Public License. [1] [0]: https://github.com/hephaest0s/usbkill https://github.com/hephaest0s/usbkill [1]: https://en.m.wikipedia.org/wiki/USBKill https://en.m.wikipedia.org/wiki/USBKill

hfjtktngnt 6y ago
I've also thought about this, why most terrorists are so dumb. I think it's because if they were smart, they would realize how hard it is to get away with it. This is literally one of the few criminal acts where no expenses will be spared in catching the perps. Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism. Regarding Ross, once they figured out his name, it was over for him, USBKill or not.
- uCantCauseUCant 6y ago
  https://www.nytimes.com/2010/09/12/magazine/12FOB-IdeaLab-t.html https://www.nytimes.com/2010/09/12/magazine/12FOB-IdeaLab-t....
- bryanrasmussen 6y ago
  >I've also thought about this, why most terrorists are so dumb. My theory is that when a terrorist does a stupid thing there are millions of dollars available, and thousands of people trained and ready, to take advantage of that stupidity. When we do something stupid a couple people might point at us and say slightly mean things. Everyone is stupid at least a few times a day.
- 082349872349872 6y ago
  On the bright side, an attested (N=1) method for de-radicalising former terrorists has been simply hooking them up. They may be dumb, but they're not stupid: https://www.theatlantic.com/magazine/archive/2001/12/all-you-need-is-love/302351/ https://www.theatlantic.com/magazine/archive/2001/12/all-you...
  - tremon 6y ago
    So we must sacrifice one person to save many?
    - 082349872349872 6y ago
      Sacrifice? Former elite terrorists probably get bad boy points. It is a truth universally acknowledged, that a single girl in possession of a beautiful visage, must be in want of a boy ... of whom she may confidently boast "I'll alter him." (not, as I must mistakenly have misheard at my marriage, as "aisle, altar, hymn")
    - yowlingcat 6y ago
      What makes you think it's a sacrifice rather than a reverse proselytization (or de-radicalization as some call it)?
    - 082349872349872 6y ago
      For the flagger: quoting the opening line of Pride and Prejudice is simply a more verbose way to say /s. (I have double checked, and all three of google, weibo, and yandex pull Austen up as the top hit for the key phrase.)
- seleniumBubbles 6y ago
  Public perception about the average intelligence of any type of criminal is likely influenced by survivorship bias: https://en.wikipedia.org/wiki/Survivorship_bias https://en.wikipedia.org/wiki/Survivorship_bias
- thinkingemote 6y ago
  Also note that criminals are the ones who failed. We don't get to see how the successful ones are. Same with terrorists.
  - WJW 6y ago
    Unlike most other crimes, a terrorist act that goes unnoticed is almost by definition unsuccessful.
    - a1369209993 6y ago
      Well, there's a conspicuously unoccupied middle ground between the two, but if the terrorist's goal is only to inflict harm, without necessarily revealing the reason or taking credit, they would presumably prefer their actions to look like a natural disaster, riot, (industrial/medical/etc) accident, forest fire, or other non-deliberate and/or non-planned event.
      - goto11 6y ago
        That is not terrorism though. The point of terrorism is to achieve political goals by spreading fear.
        a1369209993 6y ago
        That's true by definition, sure, but that's not how governments actually use the word.
        Teever 6y ago
        How would causing a riot not achieve political goals by spreading fear?
- fitbitq 6y ago
  "Also, smart people tend to do something with their life," Dunno. The Unabomber had probably a higher IQ than most people on hackernews. And on a side note: who cares about James bond? It is always the villain who makes or breaks a James bond movie. I am actually sad that Jet Lee never played the villain.
- heimatau 6y ago
  Your comment was extremely insightful. Thank you for this. I rarely favorite (to be fair I only knew about it recently) but...your comment is in my favorites.
- mercer 6y ago
  I dunno. I believe it's actually pretty easy to get away with lots of crime. It's just that the smart ones don't get caught. > Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism. that probably plays a role. And they are perhaps more likely to consider the ethical dimension.
newsclues 6y ago
OpSec is HARD. It is a challenge for militaries, brilliant hackers and dumb criminals.
vmception 6y ago
> There are really a few basic ground rules that always seem to be violated, even by those with seemingly sufficient experience, like Ross Ulbricht. Well yes, for the people that get caught. and then the DOJ always says "see! this proves you can't hide from us" and everyone else on darknet is like "yeah here's the refined checklist implementation for how not to get caught and here's why" which should be like everyone's first purchase on any darknet market for $.99 and should be any vendor's primary first item for sale to gain reputation I pretty much never see indictments that actually undermine the best practices.... you don't need to pay to understand the best practices, but it does save time to see what the tools are that implement those best practices, or understanding why some secret chat apps should be avoided versus others.
- throwanem 6y ago
  I mean if you see some dude with nothing for sale but "how to not get busted doing crimes really i promise.txt"... More seriously, there's an element of performative deterrence in the way stuff like this gets handled. Giving people without the experience to know it's nonsense the idea they can't do dark web crimes and get caught probably cuts down on the rate of people dipping a toe into the exciting world of dark web crimes, where they can for example learn how to not get caught and then talk on the open web about how much they know I guess? What kind of opsec is that?
  - vmception 6y ago
    there is different OPSEC for different attack vectors in the universe of dark web activities, most of them are not crimes and of the crimes most of those do not require stonewalling an eventual multi-jurisdictional state actor there are just different OPSEC models, if we aren't talking about crimes its fine to talk on the open web about them, some of those OPSEC models would still accomplish thwarting the aforementioned threat model.
- refurb 6y ago
  Getting caught is not just about OPSEC, but also visibility. The DOJ has limited time and resources, so will always go after the "big fish" and the cases that give them the best PR. If you had two scenarios: 1. Great OPSEC, high profile 2. OK OPSEC, minimal profile You're still at greater risk for scenario #1. When Ross Ulbricht did his Forbes interview and basically said "I dare the gov't to shut me down", he pretty much guaranteed they'd go to the ends of the earth to shut him down. The only thing worse than committing multiple felonies is making the gov't look stupid or weak.
sandworm101 6y ago
USBkill is useful if you want to prevent cops from seeing what you have saved in your porn folder. It wont stop them from tapping your facebook chats. Or bugging your basement prepper shelter. Or tracking your cellphone movements. In cases like this, whether the cops can pull anything from your harddrive doesnt change anything.
pjc50 6y ago
The refusal to wear masks, which is a trivial form of "opsec" against infection, shows what happens. It's boring, uncomfortable, unsexy, protects you against an outcome you think is low probability, and you don't find out if you're doing it right - only if you've done it wrong, by which time it's too late. Besides, since these terrorists had no concrete grievance, only internet radicalization, they ended up doing more cosplay than effectiveness.
- tonyarkles 6y ago
  A funny side note with that... there was a recent theft of $3000 worth of Crest Whitestrips in my city that got some news attention. It was 3x 40-50 year old white folks that did the theft; the woman distracted the clerk while the two men loaded up. All caught on camera. AND THEY DIDN’T WEAR MASKS. They had every opportunity to cover up their faces in a completely socially acceptable way and didn’t. C’mon.
  - enkid 6y ago
    I guess the only people who need to whiten their teeth right now are anti-maskers.
tomjen3 6y ago
You never hear about the people who do take opsec seriously. Criminals are not dumb, the ones you hear about are.
ShorsHammer 6y ago
You pull the tails usb out and it does a far better job, this is shit software aimed at people with shit practices and there's simply no nice or pleasant way to say it. Just fucking use tails if you are a terrorist intent on murdering billions of people.
- MrMorden 6y ago
  If you're that ambitious of a terrorist you have faceless minions to travel to internet cafes in distant locations and access the internet for you. Using Tails wouldn't do a damn thing for such a high-profile target, though; Osama bin Laden didn't have interwebs at all in Abbottabad, and the US government still dropped in for a visit.
mercer 6y ago
I once, just for the fun of the exercise, tried to set up an unused netbook and be as safe as possible. It was incredibly difficult to not mess up, knowing what I know. In practice, I'd say it was usually convenience or rote behavior that caused me to 'compromise' the laptop. It was a humbling experience, and while I had no aspirations to become a spy, it showed me how bad I'd probably be at it.

hfjtktngnt 6y ago

I've also thought about this, why most terrorists are so dumb. I think it's because if they were smart, they would realize how hard it is to get away with it. This is literally one of the few criminal acts where no expenses will be spared in catching the perps. Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism. Regarding Ross, once they figured out his name, it was over for him, USBKill or not.

uCantCauseUCant 6y ago
https://www.nytimes.com/2010/09/12/magazine/12FOB-IdeaLab-t.html https://www.nytimes.com/2010/09/12/magazine/12FOB-IdeaLab-t....
bryanrasmussen 6y ago
>I've also thought about this, why most terrorists are so dumb. My theory is that when a terrorist does a stupid thing there are millions of dollars available, and thousands of people trained and ready, to take advantage of that stupidity. When we do something stupid a couple people might point at us and say slightly mean things. Everyone is stupid at least a few times a day.
082349872349872 6y ago
On the bright side, an attested (N=1) method for de-radicalising former terrorists has been simply hooking them up. They may be dumb, but they're not stupid: https://www.theatlantic.com/magazine/archive/2001/12/all-you-need-is-love/302351/ https://www.theatlantic.com/magazine/archive/2001/12/all-you...
- tremon 6y ago
  So we must sacrifice one person to save many?
  - 082349872349872 6y ago
    Sacrifice? Former elite terrorists probably get bad boy points. It is a truth universally acknowledged, that a single girl in possession of a beautiful visage, must be in want of a boy ... of whom she may confidently boast "I'll alter him." (not, as I must mistakenly have misheard at my marriage, as "aisle, altar, hymn")
  - yowlingcat 6y ago
    What makes you think it's a sacrifice rather than a reverse proselytization (or de-radicalization as some call it)?
  - 082349872349872 6y ago
    For the flagger: quoting the opening line of Pride and Prejudice is simply a more verbose way to say /s. (I have double checked, and all three of google, weibo, and yandex pull Austen up as the top hit for the key phrase.)
seleniumBubbles 6y ago
Public perception about the average intelligence of any type of criminal is likely influenced by survivorship bias: https://en.wikipedia.org/wiki/Survivorship_bias https://en.wikipedia.org/wiki/Survivorship_bias
thinkingemote 6y ago
Also note that criminals are the ones who failed. We don't get to see how the successful ones are. Same with terrorists.
- WJW 6y ago
  Unlike most other crimes, a terrorist act that goes unnoticed is almost by definition unsuccessful.
  - a1369209993 6y ago
    Well, there's a conspicuously unoccupied middle ground between the two, but if the terrorist's goal is only to inflict harm, without necessarily revealing the reason or taking credit, they would presumably prefer their actions to look like a natural disaster, riot, (industrial/medical/etc) accident, forest fire, or other non-deliberate and/or non-planned event.
    - goto11 6y ago
      That is not terrorism though. The point of terrorism is to achieve political goals by spreading fear.
      - a1369209993 6y ago
        That's true by definition, sure, but that's not how governments actually use the word.
      - Teever 6y ago
        How would causing a riot not achieve political goals by spreading fear?
fitbitq 6y ago
"Also, smart people tend to do something with their life," Dunno. The Unabomber had probably a higher IQ than most people on hackernews. And on a side note: who cares about James bond? It is always the villain who makes or breaks a James bond movie. I am actually sad that Jet Lee never played the villain.
heimatau 6y ago
Your comment was extremely insightful. Thank you for this. I rarely favorite (to be fair I only knew about it recently) but...your comment is in my favorites.
mercer 6y ago
I dunno. I believe it's actually pretty easy to get away with lots of crime. It's just that the smart ones don't get caught. > Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism. that probably plays a role. And they are perhaps more likely to consider the ethical dimension.

newsclues 6y ago

OpSec is HARD. It is a challenge for militaries, brilliant hackers and dumb criminals.

vmception 6y ago

> There are really a few basic ground rules that always seem to be violated, even by those with seemingly sufficient experience, like Ross Ulbricht. Well yes, for the people that get caught. and then the DOJ always says "see! this proves you can't hide from us" and everyone else on darknet is like "yeah here's the refined checklist implementation for how not to get caught and here's why" which should be like everyone's first purchase on any darknet market for $.99 and should be any vendor's primary first item for sale to gain reputation I pretty much never see indictments that actually undermine the best practices.... you don't need to pay to understand the best practices, but it does save time to see what the tools are that implement those best practices, or understanding why some secret chat apps should be avoided versus others.

throwanem 6y ago
I mean if you see some dude with nothing for sale but "how to not get busted doing crimes really i promise.txt"... More seriously, there's an element of performative deterrence in the way stuff like this gets handled. Giving people without the experience to know it's nonsense the idea they can't do dark web crimes and get caught probably cuts down on the rate of people dipping a toe into the exciting world of dark web crimes, where they can for example learn how to not get caught and then talk on the open web about how much they know I guess? What kind of opsec is that?
- vmception 6y ago
  there is different OPSEC for different attack vectors in the universe of dark web activities, most of them are not crimes and of the crimes most of those do not require stonewalling an eventual multi-jurisdictional state actor there are just different OPSEC models, if we aren't talking about crimes its fine to talk on the open web about them, some of those OPSEC models would still accomplish thwarting the aforementioned threat model.
refurb 6y ago
Getting caught is not just about OPSEC, but also visibility. The DOJ has limited time and resources, so will always go after the "big fish" and the cases that give them the best PR. If you had two scenarios: 1. Great OPSEC, high profile 2. OK OPSEC, minimal profile You're still at greater risk for scenario #1. When Ross Ulbricht did his Forbes interview and basically said "I dare the gov't to shut me down", he pretty much guaranteed they'd go to the ends of the earth to shut him down. The only thing worse than committing multiple felonies is making the gov't look stupid or weak.

sandworm101 6y ago

USBkill is useful if you want to prevent cops from seeing what you have saved in your porn folder. It wont stop them from tapping your facebook chats. Or bugging your basement prepper shelter. Or tracking your cellphone movements. In cases like this, whether the cops can pull anything from your harddrive doesnt change anything.

pjc50 6y ago

The refusal to wear masks, which is a trivial form of "opsec" against infection, shows what happens. It's boring, uncomfortable, unsexy, protects you against an outcome you think is low probability, and you don't find out if you're doing it right - only if you've done it wrong, by which time it's too late. Besides, since these terrorists had no concrete grievance, only internet radicalization, they ended up doing more cosplay than effectiveness.

tonyarkles 6y ago
A funny side note with that... there was a recent theft of $3000 worth of Crest Whitestrips in my city that got some news attention. It was 3x 40-50 year old white folks that did the theft; the woman distracted the clerk while the two men loaded up. All caught on camera. AND THEY DIDN’T WEAR MASKS. They had every opportunity to cover up their faces in a completely socially acceptable way and didn’t. C’mon.
- enkid 6y ago
  I guess the only people who need to whiten their teeth right now are anti-maskers.

tomjen3 6y ago

You never hear about the people who do take opsec seriously. Criminals are not dumb, the ones you hear about are.

ShorsHammer 6y ago

You pull the tails usb out and it does a far better job, this is shit software aimed at people with shit practices and there's simply no nice or pleasant way to say it. Just fucking use tails if you are a terrorist intent on murdering billions of people.

MrMorden 6y ago
If you're that ambitious of a terrorist you have faceless minions to travel to internet cafes in distant locations and access the internet for you. Using Tails wouldn't do a damn thing for such a high-profile target, though; Osama bin Laden didn't have interwebs at all in Abbottabad, and the US government still dropped in for a visit.

mercer 6y ago

I once, just for the fun of the exercise, tried to set up an unused netbook and be as safe as possible. It was incredibly difficult to not mess up, knowing what I know. In practice, I'd say it was usually convenience or rote behavior that caused me to 'compromise' the laptop. It was a humbling experience, and while I had no aspirations to become a spy, it showed me how bad I'd probably be at it.