5 ms·

This didn't protect Ross Ulbricht.

by itake 5y ago

encryptluks2 5y ago
Because he walked away from his computer and left it unlocked. Wear a hidden bluetooth device or something to lock your computer and use USBGuard if you're that worried.
- flatiron 5y ago
  IIRC he was still sitting at the computer. They just distracted him to turn around and then they swiped it.
  - encryptluks2 5y ago
    Regardless, USBGuard and a hidden bluetooth device to automatically lock when it leaves a certain radius would have likely prevented any issues.
    - michaelt 5y ago
      Ulbricht was arrested in 2013. USBGuard and usbkill were released in 2015. Tough to do encryptluks2-approved opsec if you have to use tools that don't exist.
      - encryptluks2 5y ago
        USBGuard is a newer tool, however the functionality has existed through udev or other integrations for some time.
  - jandrese 5y ago
    They literally snuck up behind him and swiped it out of his hands. He was seated with his back to the door, one of his many opsec failures.
- bawolff 5y ago
  I feel that, at the point where the fbi is trying to distract you by making out so they could steal your laptop, its already too late and you are very screwed. Maybe a bluetooth autolocking thing could have delayed the inevitable, but it would just be a delay.
  - encryptluks2 5y ago
    Not really. Wish proper encryption and a USB safe list, once the computer is locked there isn't much they can do.
    - bawolff 5y ago
      They can watch you for the rest of your life, interrogate you, etc. Presumably they acted the way they did because they had reasonable belief that their plan would work. If Ross behaved differently i assume they would have a different plan of action
brobinson 5y ago
Neither did linking his dark web identity to his real life identity via multiple forum posts or his other 1,000 opsec failures.
- xvector 5y ago
  I suspect those “opsec failures” are just parallel construction. The FBI almost certainly used a zero day on him and then waited to see how they could construct a feasible explanation for having identified him from there.
  - hnnnnnnng 5y ago
    I agree with this. They just wait to find a small breadcrumb trail and then use that construct a case. The identifying the suspect is done through hidden means.
  - bawolff 5y ago
    Even if that's true, Ross certainly made it easy for them
  - maybelsyrup 5y ago
    > almost certainly used a zero day on him I "like" this explanation, but are you going with your gut on that or do you have any concrete signs that point in that direction?
    - xvector 5y ago
      Parallel construction is not new for US intelligence when it comes to solving high-profile crime. We know US intelligence both hoards and uses zero days, especially on users of Tor. As such, we can be reasonably certain that parallel construction is used to capture cybercriminals in high-profile cases, since it immensely simplifies solving the crime to a matter of using the exploit and merely observing for gaps in opsec. Furthermore, using a zero-day on Ulbricht would be optimal as he is no security researcher. You are unlikely to “burn” a zero-day unless you are using it in a dragnet sort of fashion while a vigilant security researcher is watching. By definition, it’s hard to find proof of parallel construction. However, former intelligence officials have confirmed its use as a “bedrock technique” for catching criminals [1]. [1]: https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
na85 5y ago
Arguably it did protect him, but Ulbricht compromised himself by making several major opsec blunders including linking his personal Gmail address to his pseudonyms.
therein 5y ago
Try public WiFi + spoofed MAC + directional antenna. What if you live 3 blocks away from a public library but a few floors higher? With direct line of sight and some wireless networking gear? Would they really try to triangulate the client packets? It is a large leap past "oh he is in the library, let's go find him". You aren't triangulating the AP, you need to logically isolate the packets from the client, calculate their dB and somehow triangulate on just that.
- NaturalPhallacy 5y ago
  >Would they really try to triangulate the client packets? It is a large leap past "oh he is in the library, let's go find him". This is smart, and a good idea. But it really just adds a step. Once they go to the library and don't find him, they'll start looking for something 'smart'. And doing 'smart' things like this really get the hackles of the feds up because they start thinking exciting things like 'state actor', and "I'll get a promotion out of this". The best place to hide something is right out in the open. Preferably behind a SEP field. Not hating on your idea, just exploring it further.

This didn't protect Ross Ulbricht.

by itake 5y ago

This didn't protect Ross Ulbricht.

Because he walked away from his computer and left it unlocked. Wear a hidden bluetooth device or something to lock your computer and use USBGuard if you're that worried.

flatiron 5y ago
IIRC he was still sitting at the computer. They just distracted him to turn around and then they swiped it.
- encryptluks2 5y ago
  Regardless, USBGuard and a hidden bluetooth device to automatically lock when it leaves a certain radius would have likely prevented any issues.
  - michaelt 5y ago
    Ulbricht was arrested in 2013. USBGuard and usbkill were released in 2015. Tough to do encryptluks2-approved opsec if you have to use tools that don't exist.
    - encryptluks2 5y ago
      USBGuard is a newer tool, however the functionality has existed through udev or other integrations for some time.
- jandrese 5y ago
  They literally snuck up behind him and swiped it out of his hands. He was seated with his back to the door, one of his many opsec failures.
bawolff 5y ago
I feel that, at the point where the fbi is trying to distract you by making out so they could steal your laptop, its already too late and you are very screwed. Maybe a bluetooth autolocking thing could have delayed the inevitable, but it would just be a delay.
- encryptluks2 5y ago
  Not really. Wish proper encryption and a USB safe list, once the computer is locked there isn't much they can do.
  - bawolff 5y ago
    They can watch you for the rest of your life, interrogate you, etc. Presumably they acted the way they did because they had reasonable belief that their plan would work. If Ross behaved differently i assume they would have a different plan of action

brobinson 5y ago

Neither did linking his dark web identity to his real life identity via multiple forum posts or his other 1,000 opsec failures.

xvector 5y ago
I suspect those “opsec failures” are just parallel construction. The FBI almost certainly used a zero day on him and then waited to see how they could construct a feasible explanation for having identified him from there.
- hnnnnnnng 5y ago
  I agree with this. They just wait to find a small breadcrumb trail and then use that construct a case. The identifying the suspect is done through hidden means.
- bawolff 5y ago
  Even if that's true, Ross certainly made it easy for them
- maybelsyrup 5y ago
  > almost certainly used a zero day on him I "like" this explanation, but are you going with your gut on that or do you have any concrete signs that point in that direction?
  - xvector 5y ago
    Parallel construction is not new for US intelligence when it comes to solving high-profile crime. We know US intelligence both hoards and uses zero days, especially on users of Tor. As such, we can be reasonably certain that parallel construction is used to capture cybercriminals in high-profile cases, since it immensely simplifies solving the crime to a matter of using the exploit and merely observing for gaps in opsec. Furthermore, using a zero-day on Ulbricht would be optimal as he is no security researcher. You are unlikely to “burn” a zero-day unless you are using it in a dragnet sort of fashion while a vigilant security researcher is watching. By definition, it’s hard to find proof of parallel construction. However, former intelligence officials have confirmed its use as a “bedrock technique” for catching criminals [1]. [1]: https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction

na85 5y ago

Arguably it did protect him, but Ulbricht compromised himself by making several major opsec blunders including linking his personal Gmail address to his pseudonyms.

therein 5y ago

Try public WiFi + spoofed MAC + directional antenna. What if you live 3 blocks away from a public library but a few floors higher? With direct line of sight and some wireless networking gear? Would they really try to triangulate the client packets? It is a large leap past "oh he is in the library, let's go find him". You aren't triangulating the AP, you need to logically isolate the packets from the client, calculate their dB and somehow triangulate on just that.

NaturalPhallacy 5y ago
>Would they really try to triangulate the client packets? It is a large leap past "oh he is in the library, let's go find him". This is smart, and a good idea. But it really just adds a step. Once they go to the library and don't find him, they'll start looking for something 'smart'. And doing 'smart' things like this really get the hackles of the feds up because they start thinking exciting things like 'state actor', and "I'll get a promotion out of this". The best place to hide something is right out in the open. Preferably behind a SEP field. Not hating on your idea, just exploring it further.