5 ms·
> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions
by cbsks 5y ago
> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads.
Ouch! Opsec is very easy to screw up.
- 41b696ef1113 5y agoWhat is the proper way to ensure 100% bulletproof VPN connections without leakage?
- artificialLimbs 5y agoIf you're going to commit multiple felonies: using coffee shop wifi instead of your home connection.
- sgjohnson 5y agoWhile wearing a hoodie and a face mask and probably some other accessories
- gruez 5y agolike this? https://www.freepik.com/free-photo/hacker-with-anonymous-mask_3361166.htm https://www.freepik.com/free-photo/hacker-with-anonymous-mas...
- JohnJamesRambo 5y agoNo like this. https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg
- bigmattystyles 5y agoAnd don't buy a latte with a credit card
- rmbyrro 5y agoOr maybe think again...
- Yeri 5y agoAssuming you're talking about corporate VPN: not using VPN. Things like BeyondCorp. And obviously take away access once that person left the company. https://beyondcorp.com/ https://beyondcorp.com/ https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
- sgjohnson 5y agoThe question was how to stop a VPN from leaking the real IP address when the VPN connection fails.
- mikepurvis 5y agoThis has nothing to do with a company-supplied VPN. This person was an employee using a third party VPN specifically to hide his identity from Ubiquiti.
- megous 5y agoOn his work laptop, lol.
- IAmPat 5y agoBriefly... Internal firewall on your PC, like iptables. Block all ports except the VPN port.
- sgjohnson 5y agoSetting up the local routing table so the main interface routes everything except the VPN connection through the VPN. VPN goes down? No route to host. And there are probably a dozen other ways to stop such leakage too. Most commercial VPN providers these days offer something like this, usually branding a it “kill switch” or something.
- gruez 5y ago>Most commercial VPN providers these days offer something like this, usually branding a it “kill switch” or something. seems like surfshark has it, but it isn't very reliable https://www.reddit.com/r/surfshark/comments/r8rfb8/kill_switch_windows_app_problem/ https://www.reddit.com/r/surfshark/comments/r8rfb8/kill_swit...
- madars 5y agoOn Linux, use network namespaces https://www.wireguard.com/netns/ https://www.wireguard.com/netns/ . Create a separate VPN namespace and have wgN be the only non-loopback interface there, then run your application in that namespace. This also solves WebRTC-style leaks. Physical isolation is even better (e.g. using a spare Raspberry Pi).
- gruez 5y agouse tor. it's specifically designed to avoid traffic leaks (as long as you don't open an external application). I trust that far more than whatever "killswitch" VPN providers have, or properly implementing a home rolled solution with iptables/network namespaces/raspberry pis. the "bouncing your traffic across 3 servers to obfuscate tracking" is a nice bonus as well.
- judge2020 5y agoThat wouldn't solve this problem. The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. They didn't have their IP leak via webrtc or some special protocol, it was the VPN app itself with the bug.
- gruez 5y ago>The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. No you won't, because tor isn't a VPN. In fact it specifically tells you not to use it with other browsers/applications[1]. It's a combo of a browser + tor client. The browser has its proxy set to the tor client, so the only way it can reach the internet is via tor. Getting that to behave properly is far easier/reliable than trying to get it to work for every application/os/hardware configuration. [1] https://2019.www.torproject.org/docs/faq.html.en#CompatibleApplications https://2019.www.torproject.org/docs/faq.html.en#CompatibleA...
- hanniabu 5y agoI'm confident enough that 3 letter agencies control most of the network that I'd feel safer using vpn.
- gruez 5y agothey were able to infiltrate various NGOs (that host tor nodes) and/or set up fake NGOs, but they weren't able to infiltrate and/or set up fake VPN providers?
- 5y ago
- spoonjim 5y agoHow would one have prevented their IP from leaking?
- post_break 5y agoUsed a public wifi access point from a computer bought second hand with cash.
- paulpauper 5y agonot necessarily. tons of ways to still be identified
- justin_oaks 5y agoCare to elaborate?
- withinboredom 5y agoLicense plate from car and if there are cams back along the route from the house, they can follow it back home. Also cellphone pings while you are sitting there, fingerprints, facial recognition, local logs in the router, etc.
- atonse 5y agoRemember that if law enforcement has to identify you, they have a whole different set of resources most of us don't have – like the ability to go to the coffee shop and also nearby stores and ask for their camera feeds. And license plate readers (like others have mentioned). Physical opsec is probably also very hard (I don't know anything about it, I just love those kinds of Hollywood movies).