4 ms·

Neither did linking his dark web identity to his real life identity via multiple forum posts or his other 1,000 opsec failures.

xvector 5y ago
I suspect those “opsec failures” are just parallel construction. The FBI almost certainly used a zero day on him and then waited to see how they could construct a feasible explanation for having identified him from there.
- hnnnnnnng 5y ago
  I agree with this. They just wait to find a small breadcrumb trail and then use that construct a case. The identifying the suspect is done through hidden means.
- bawolff 5y ago
  Even if that's true, Ross certainly made it easy for them
- maybelsyrup 5y ago
  > almost certainly used a zero day on him I "like" this explanation, but are you going with your gut on that or do you have any concrete signs that point in that direction?
  - xvector 5y ago
    Parallel construction is not new for US intelligence when it comes to solving high-profile crime. We know US intelligence both hoards and uses zero days, especially on users of Tor. As such, we can be reasonably certain that parallel construction is used to capture cybercriminals in high-profile cases, since it immensely simplifies solving the crime to a matter of using the exploit and merely observing for gaps in opsec. Furthermore, using a zero-day on Ulbricht would be optimal as he is no security researcher. You are unlikely to “burn” a zero-day unless you are using it in a dragnet sort of fashion while a vigilant security researcher is watching. By definition, it’s hard to find proof of parallel construction. However, former intelligence officials have confirmed its use as a “bedrock technique” for catching criminals [1]. [1]: https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
    - maybelsyrup 5y ago
      This is really interesting, and sad. Thanks. > simplifies solving the crime to a matter of using the exploit and merely observing for gaps in opsec By this logic, could one get away with a "crime" indefinitely given good enough (perfect?) opsec?
      - xvector 5y ago
        Perhaps, but no one is perfect. Keep in mind that perfect opsec also encompasses physical security+surveillance, where intelligence agencies are much better than this than criminals. People say that part of Ulbricht’s shitty opsec was that he left his laptop unlocked, but think of this - the FBI was already ready to grab his laptop the very moment he left it alone. Clearly, they knew he was the criminal well beforehand, and were just lying in wait for him to slip up just one single time. All in all, this is really cool work. I wonder what it would be like to work for the FBI or NSA solving high profile cybercrime. I imagine it would definitely feel more impactful than my current FAANG position, even if the compensation would be lower.
        schoen 5y ago
        > People say that part of Ulbricht’s shitty opsec was that he left his laptop unlocked, but think of this - the FBI was already ready to grab his laptop the very moment he left it alone. Clearly, they knew he was the criminal well beforehand, and were just lying in wait for him to slip up just one single time. Is there another laptop of his that they physically accessed somehow prior to distracting and arresting him? (I don't understand how someone could think from that story that the laptop seizure played any part in initially identifying him, since it was done by FBI agents in the course of arresting him pursuant to a warrant.)
        xvector 5y ago
        No, the theory is that a zero day was used on Ulbricht and they knew he was guilty for a long time. Things like seizing the laptop was just theater to construct a parallel trail of evidence for the courts.

xvector 5y ago

I suspect those “opsec failures” are just parallel construction. The FBI almost certainly used a zero day on him and then waited to see how they could construct a feasible explanation for having identified him from there.

hnnnnnnng 5y ago
I agree with this. They just wait to find a small breadcrumb trail and then use that construct a case. The identifying the suspect is done through hidden means.
bawolff 5y ago
Even if that's true, Ross certainly made it easy for them
maybelsyrup 5y ago
> almost certainly used a zero day on him I "like" this explanation, but are you going with your gut on that or do you have any concrete signs that point in that direction?
- xvector 5y ago
  Parallel construction is not new for US intelligence when it comes to solving high-profile crime. We know US intelligence both hoards and uses zero days, especially on users of Tor. As such, we can be reasonably certain that parallel construction is used to capture cybercriminals in high-profile cases, since it immensely simplifies solving the crime to a matter of using the exploit and merely observing for gaps in opsec. Furthermore, using a zero-day on Ulbricht would be optimal as he is no security researcher. You are unlikely to “burn” a zero-day unless you are using it in a dragnet sort of fashion while a vigilant security researcher is watching. By definition, it’s hard to find proof of parallel construction. However, former intelligence officials have confirmed its use as a “bedrock technique” for catching criminals [1]. [1]: https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
  - maybelsyrup 5y ago
    This is really interesting, and sad. Thanks. > simplifies solving the crime to a matter of using the exploit and merely observing for gaps in opsec By this logic, could one get away with a "crime" indefinitely given good enough (perfect?) opsec?
    - xvector 5y ago
      Perhaps, but no one is perfect. Keep in mind that perfect opsec also encompasses physical security+surveillance, where intelligence agencies are much better than this than criminals. People say that part of Ulbricht’s shitty opsec was that he left his laptop unlocked, but think of this - the FBI was already ready to grab his laptop the very moment he left it alone. Clearly, they knew he was the criminal well beforehand, and were just lying in wait for him to slip up just one single time. All in all, this is really cool work. I wonder what it would be like to work for the FBI or NSA solving high profile cybercrime. I imagine it would definitely feel more impactful than my current FAANG position, even if the compensation would be lower.
      - schoen 5y ago
        > People say that part of Ulbricht’s shitty opsec was that he left his laptop unlocked, but think of this - the FBI was already ready to grab his laptop the very moment he left it alone. Clearly, they knew he was the criminal well beforehand, and were just lying in wait for him to slip up just one single time. Is there another laptop of his that they physically accessed somehow prior to distracting and arresting him? (I don't understand how someone could think from that story that the laptop seizure played any part in initially identifying him, since it was done by FBI agents in the course of arresting him pursuant to a warrant.)
        xvector 5y ago
        No, the theory is that a zero day was used on Ulbricht and they knew he was guilty for a long time. Things like seizing the laptop was just theater to construct a parallel trail of evidence for the courts.