4 ms·

You're assuming they're safe because their technology stack is safe, but there are about 20 ways that law enforcement could possibly track these guys down that

You're assuming they're safe because their technology stack is safe, but there are about 20 ways that law enforcement could possibly track these guys down that don't require particularly l33t skillz. Cops work like hackers in the sense that both groups attack vulnerabilities. The vulnerabilities here are clear: these guys have big mouths and they're overconfident. They'll talk to somebody someday, and when that happens, it will provide an opening for the fuzz.

nodata 15y ago
> there are about 20 ways that law enforcement could possibly track these guys down that don't require particularly l33t skillz. Would be interesting to hear some of them.
- Hoff 15y ago
  Most any overlap between your "secret" identity and your "normal" identity can provide an opening. This might involve (erroneously) shared contacts. Shared VoIP numbers. Shared MAC addresses, or shared IP addresses. Shared passwords. IRC channels or web sites. Even what times you are active, what words and what phrases you use, and your browser strings can provide clues. A group within (IIRC) Lebanon was reportedly identified a while back because of an opsec error; one of the folks involved in the group used a "restricted" cellular phone to call his girlfriend, and that broke open the identities. The German Ultra encryption system was targeted and was sometimes vulnerable due to opsec errors. Opening such as key reuse, or sending duplicate messages, can provide openings that allowed decryption. This area is related to the classic "covert channels" discussions within information security; on the expected information leakage, and around how a "defender" wants to keep leakage at a minimum, and how an "attacker" is looking for clues and errors. This is also a corollary to the classic difficulties with maintaining server security; leave one sufficiently egregious opening in your security, and you can be toast.
- jeffreymcmanus 15y ago
  I just named one.

nodata 15y ago

> there are about 20 ways that law enforcement could possibly track these guys down that don't require particularly l33t skillz. Would be interesting to hear some of them.

Hoff 15y ago
Most any overlap between your "secret" identity and your "normal" identity can provide an opening. This might involve (erroneously) shared contacts. Shared VoIP numbers. Shared MAC addresses, or shared IP addresses. Shared passwords. IRC channels or web sites. Even what times you are active, what words and what phrases you use, and your browser strings can provide clues. A group within (IIRC) Lebanon was reportedly identified a while back because of an opsec error; one of the folks involved in the group used a "restricted" cellular phone to call his girlfriend, and that broke open the identities. The German Ultra encryption system was targeted and was sometimes vulnerable due to opsec errors. Opening such as key reuse, or sending duplicate messages, can provide openings that allowed decryption. This area is related to the classic "covert channels" discussions within information security; on the expected information leakage, and around how a "defender" wants to keep leakage at a minimum, and how an "attacker" is looking for clues and errors. This is also a corollary to the classic difficulties with maintaining server security; leave one sufficiently egregious opening in your security, and you can be toast.
jeffreymcmanus 15y ago
I just named one.