4 ms·

#1 and #2 really should just be a part of #3: catastropic opsec. I don't know what it is about people who run these criminal enterprises on the darknet, but th

#1 and #2 really should just be a part of #3: catastropic opsec. I don't know what it is about people who run these criminal enterprises on the darknet, but they constantly seem to be failing even the most basic of opsec. Re-using identities across multiple services, using e-mail addresses with real names, posting photos with identifiable information (and before websites stripped metadata for them, often posted with metadata), etc. I mean it's nice that they are making it easier to catch themselves, but at the same time I can only wonder how some genius can invent some novel and complex ransomware operation just to turn around and use the email they've had since they were 13 to register the services that operate it.

number6 4y ago
You only catch those who make those mistakes
- ziddoap 4y ago
  Yes, thanks for that. My point is that those mistakes are made by plenty of ransomware gangs, some of the largest dark markets to ever exist (AlphaBay, Silk Road, etc.), Freedom Hosting, and more. All of which were, at some point, major entities on the darknet making absolutely rudimentary opsec mistakes.
  - Closi 4y ago
    You only have to slip up once to get caught. Some of the people caught on those listed examples had great Opsec... until that one time where they messed up and then suddenly ended up in jail.
    - ziddoap 4y ago
      Which ones of my list had great opsec? I'm not denying what you said, it only takes one slip up, but in the cases I mentioned by name: AlphaBay used their regular hotmail account to send password reset emails, and that email was tied to their LinkedIn. Freedom Hosting was taken down because the operators used outdated FF with javascript enabled. Silk Road's Ross Ulbricht posted his personal Gmail address, linking the identities. All of these are profound opsec failures, not just an oopsie that led to getting caught by talented LEOs.
      - jstarfish 4y ago
        What sort of answer are you looking for? All of these proprietors are human. Humans make mistakes and act irrationally at times. Criminal enterprises are complex. Opportunity for mistakes increases with scale. The guy who ran Doxbin is the only high-profile case I can think of with apparent-flawless opsec, and that much only because he bailed before the long tail caught up to him. The tightest opsec I've ever seen is maintained by disability fraudsters. Privacy laws protect the evidence anybody would need to present against you, so as long as you keep doctor-hopping and never admit to anything, nobody can touch you. These people tend to be reclusive and not public-facing, but with such low risk comes low reward-- there's no real money to be made in it. (...unless you're the doctor knowingly signing off on false diagnoses. This increases scale, at which point, the more of those you write, the greater the chances of some mistake made by you or any single one of your patients bringing the whole enterprise down.)
        ziddoap 4y ago
        >What sort of answer are you looking for? They said that some of the 3 I listed by name had "great opsec". I am curious which one of those they thought was great, and laid out why I think the opsec in these cases was really far from "great". Maybe when they said "those listed", they were referring to the list on the website and not my list. In that case, I misunderstood and obviously my comment doesn't make much sense. But I presumed they were referring to my list. >Humans make mistakes and act irrationally at times. Criminal enterprises are complex. Agreed on both fronts. But I think that the severity of mistakes is a scale, and some of the really big players on the darknet have made mistakes that I argue is much closer to the "really dumb mistake, trivially avoided" end of the scale, such as using your LinkedIn email to run your multi-million dollar black market. >Opportunity for mistakes increases with scale. Agreed. But none of the three examples I listed by name were affected by scale. Using outdated software with known vulnerabilities, posting your own email, and using an email connected to your LinkedIn are all not issues of scale. Edit to clarify, as I think people may be misunderstanding me (maybe? hard to tell from just downvotes and no replies): Opsec is hard. 100%. You have to maintain it basically forever, which makes it really hard. But, if I walk into a bank intending to rob it and start shouting out my full name and address (or, say, left my drivers license at the scene), people would have a jolly laugh at how bad of a robber I was. This is analogous to using the same email to run your multi-million dollar black market as well as sign up for a LinkedIn account. Most people would agree that in my hypothetical, the robber made some really trivial mistakes. I'm not sure why it's so hard to say that for these darknet operators that basically did the same thing, but in computer form.
  - 111111101101 4y ago
    You have to be a certain level of stupid to attempt these crimes, especially when you're up against such powerful nation-state adversaries. Stupid probably isn't the right word though. Lazy and arrogant might be more accurate.
FredPret 4y ago
The genius is the one selling the shovels to the gold diggers
- amelius 4y ago
  It's still illegal, so they might be exposed at some point through their "non-genius" clients.
pcthrowaway 4y ago
I suspect anywhere in the world, if you're capable of avoiding all 3 of these, you can get a job that pays in the 85th-99th percentile for your country, and 60th percentile globally. It's not a particularly high bar, but I suspect the majority of technically apt people would fail it. People with lucrative work available legally have more to lose and less desperation to engage in activities that are both illegal and malicious
- varispeed 4y ago
  > you can get a job that pays in the 85th-99th percentile Being in 85th-99th is no longer attractive. Because of extreme level of taxation people who earn real money are not included in those statistics, as in they are not paid a salary. In my country (UK) being in 85th-99th percentile, means you'll have okay-ish life. After years of saving you may be able to afford an old terraced house, second hand, couple of years old car. Oh and if you decide to have family and your spouse won't be working, then you are screwed. These indicators are no longer what they used to be.
  - throwawa-y123 4y ago
    notwithstanding a slight bump due to covid, taxes across the West are at the lowest levels they’ve been since before WW2
anothernewdude 4y ago
Developers aren't Ops.

number6 4y ago

You only catch those who make those mistakes

ziddoap 4y ago
Yes, thanks for that. My point is that those mistakes are made by plenty of ransomware gangs, some of the largest dark markets to ever exist (AlphaBay, Silk Road, etc.), Freedom Hosting, and more. All of which were, at some point, major entities on the darknet making absolutely rudimentary opsec mistakes.
- Closi 4y ago
  You only have to slip up once to get caught. Some of the people caught on those listed examples had great Opsec... until that one time where they messed up and then suddenly ended up in jail.
  - ziddoap 4y ago
    Which ones of my list had great opsec? I'm not denying what you said, it only takes one slip up, but in the cases I mentioned by name: AlphaBay used their regular hotmail account to send password reset emails, and that email was tied to their LinkedIn. Freedom Hosting was taken down because the operators used outdated FF with javascript enabled. Silk Road's Ross Ulbricht posted his personal Gmail address, linking the identities. All of these are profound opsec failures, not just an oopsie that led to getting caught by talented LEOs.
    - jstarfish 4y ago
      What sort of answer are you looking for? All of these proprietors are human. Humans make mistakes and act irrationally at times. Criminal enterprises are complex. Opportunity for mistakes increases with scale. The guy who ran Doxbin is the only high-profile case I can think of with apparent-flawless opsec, and that much only because he bailed before the long tail caught up to him. The tightest opsec I've ever seen is maintained by disability fraudsters. Privacy laws protect the evidence anybody would need to present against you, so as long as you keep doctor-hopping and never admit to anything, nobody can touch you. These people tend to be reclusive and not public-facing, but with such low risk comes low reward-- there's no real money to be made in it. (...unless you're the doctor knowingly signing off on false diagnoses. This increases scale, at which point, the more of those you write, the greater the chances of some mistake made by you or any single one of your patients bringing the whole enterprise down.)
      - ziddoap 4y ago
        >What sort of answer are you looking for? They said that some of the 3 I listed by name had "great opsec". I am curious which one of those they thought was great, and laid out why I think the opsec in these cases was really far from "great". Maybe when they said "those listed", they were referring to the list on the website and not my list. In that case, I misunderstood and obviously my comment doesn't make much sense. But I presumed they were referring to my list. >Humans make mistakes and act irrationally at times. Criminal enterprises are complex. Agreed on both fronts. But I think that the severity of mistakes is a scale, and some of the really big players on the darknet have made mistakes that I argue is much closer to the "really dumb mistake, trivially avoided" end of the scale, such as using your LinkedIn email to run your multi-million dollar black market. >Opportunity for mistakes increases with scale. Agreed. But none of the three examples I listed by name were affected by scale. Using outdated software with known vulnerabilities, posting your own email, and using an email connected to your LinkedIn are all not issues of scale. Edit to clarify, as I think people may be misunderstanding me (maybe? hard to tell from just downvotes and no replies): Opsec is hard. 100%. You have to maintain it basically forever, which makes it really hard. But, if I walk into a bank intending to rob it and start shouting out my full name and address (or, say, left my drivers license at the scene), people would have a jolly laugh at how bad of a robber I was. This is analogous to using the same email to run your multi-million dollar black market as well as sign up for a LinkedIn account. Most people would agree that in my hypothetical, the robber made some really trivial mistakes. I'm not sure why it's so hard to say that for these darknet operators that basically did the same thing, but in computer form.
- 111111101101 4y ago
  You have to be a certain level of stupid to attempt these crimes, especially when you're up against such powerful nation-state adversaries. Stupid probably isn't the right word though. Lazy and arrogant might be more accurate.

FredPret 4y ago

The genius is the one selling the shovels to the gold diggers

amelius 4y ago
It's still illegal, so they might be exposed at some point through their "non-genius" clients.

pcthrowaway 4y ago

I suspect anywhere in the world, if you're capable of avoiding all 3 of these, you can get a job that pays in the 85th-99th percentile for your country, and 60th percentile globally. It's not a particularly high bar, but I suspect the majority of technically apt people would fail it. People with lucrative work available legally have more to lose and less desperation to engage in activities that are both illegal and malicious

varispeed 4y ago
> you can get a job that pays in the 85th-99th percentile Being in 85th-99th is no longer attractive. Because of extreme level of taxation people who earn real money are not included in those statistics, as in they are not paid a salary. In my country (UK) being in 85th-99th percentile, means you'll have okay-ish life. After years of saving you may be able to afford an old terraced house, second hand, couple of years old car. Oh and if you decide to have family and your spouse won't be working, then you are screwed. These indicators are no longer what they used to be.
- throwawa-y123 4y ago
  notwithstanding a slight bump due to covid, taxes across the West are at the lowest levels they’ve been since before WW2

anothernewdude 4y ago

Developers aren't Ops.