6 ms·
> Kiberphant0m denied being in the U.S. Army or ever being in South Korea, and said all of that was a lengthy ruse designed to create a fictitious persona. >
by alsetmusic 2y ago
> Kiberphant0m denied being in the U.S. Army or ever being in South Korea, and said all of that was a lengthy ruse designed to create a fictitious persona.
>
> “Epic opsec troll,” they claimed.
If this were really a fictitious persona meant to lead investigators away from their true identity, they'd never admit to such. This sounds like someone trying to deflect upon being found out. I'd wager that this person is going to be caught.
Krebs has an image of a mind-map at the end of the article showing links between the aliases.
- rudolph9 2y agoOr it’s part of the troll.
- uoaei 2y agoBothsidesism has crept into ... US counterintel agitprop?
- horeszko 2y ago> Kiberphant0m denied being in the U.S. Army or ever being in South Korea, and said all of that was a lengthy ruse designed to create a fictitious persona. “Epic opsec troll,” they claimed. This is called a "double cover story", a classic deflection when someone is caught or exposed.
- asimjalis 2y agoIt could be a triple cover story. The faked double cover story is meant to deflect.
- tedunangst 2y agoMaybe even skipping the quadruple cover story and going straight to the quintuple. A true pro.
- function_seven 2y agoI always play the (2n+1) game myself. (Or do I??)
- the_af 2y agoThat's what they... er, you... er, somebody wants you to think?
- formerly_proven 2y agoThat’s my secret… I never think.
- banku_brougham 2y ago2n for me, probably
- User23 2y agoBetter than the 3n+1 game[1]. That one can really get you. [1] https://www.quantamagazine.org/why-mathematicians-still-cant-solve-the-collatz-conjecture-20200922/ https://www.quantamagazine.org/why-mathematicians-still-cant...
- _carbyau_ 2y ago"Fuck everything, we're doing five covers." ... "Put another misdirect on that fucker, too."
- deleted 2y ago[deleted]
- PittleyDunkin 2y agoEh; let's wait and see. For any claim for insight there's an equivalent claim for fabrication. any such analysis that relies on this is inherently flimsy.
- johndhi 2y agoIt also seems like a bad opsec if he creates multiple aliases for the same theme. Wouldn't you want to have one us soldier, one Russian, one African, etc. if you are trying to create red herrings?
- XorNot 2y agoEven the soldier persona is consistent though. The trouble with opsec like this is (1) you always have to win and (2) almost everything - even total randomness tends to create a pattern (since you the negative space of trying not to stand out itself tends to make you stand out).
- asimjalis 2y agoMaybe he is operating at the next level. He is deflecting because the investigators will think that he is trying to lead them away from this true identity and become even more convinced of it, which is exactly what he wants.
- CoastalCoder 2y agoTruly next level would be for him to be one of the investigators.
- dookahku 2y ago> This sounds like someone trying to deflect upon being found out. I'd wager that this person is going to be caught. that's what a super epic opsec troll would want you to think
- Terr_ 2y ago"You fell victim to one of the classic blunders! The most famous is 'never get involved in a(nother) land-war in Asia', but only slightly less well-known is this: Never go up against a once-Korean-resident when death is on the line! Aha-haha-hahaha!" https://www.youtube.com/watch?v=pRJ8CrTSSR0 https://www.youtube.com/watch?v=pRJ8CrTSSR0
- gostsamo 2y agoLet's just not believe anything said by an untrustworthy person. What they say should not calculate in what we believe to be true, but only evidence we can verify.
- skybrian 2y agoWell yes, but I doubt that Krebs is really posting this data dump for random Internet readers like us. Some other investigator might find some useful hints in it, though.
- Y_Y 2y agoI respectively disagree. If someone is shown to be unreliable then of course you won't take what they say at face value, but there's still information there. A deliberate lie may still contain something useful and reveal something about the person. In fact assuming someone to be truthful isn't a good prior, knowing that they may be "untrustworthy" doesn't tell me much, since I didn't start off thinking otherwise.
- gostsamo 2y agoYou can analyze a lie only if you know that the speaker is trying to convince you into performing an action. Binary statements about facts cannot be judged without knowing the truth. They could be used only for self-analysis of the analyzer and maybe if you want to exercise some tail chasing. Watch The Princess Bride and you will find a wonderful scene about choosing the right cup there.
- laborcontract 2y agovon Neumann proved that you can extract fair results from a biased coin without knowing the bias. No truth needed. While it doesn’t really apply to this situation, it’s all to say that i disagree with you saying there’s only information in the truth.. There’s information in everything.
- red-iron-pine 2y agobut then we're not "trusting" what they're saying, just analyzing a statement for unintentional or partial truths. the assumption is not one of credibility. everything this person is doing is dubious as hell. this means every statement or action must be analyzed with the assumption is bunk, and then you pick out possible truths. the picture of the army gear, for example, consists of gear that could be purchased at any surplus store. I'm not in the US but I could easy acquire that, and I know enough about exif data to be able to alter an image to use GPS coordinates at a US Army barracks in SK. meanwhile if they were showing a picture of them sitting with, say, a 240B MG, or something that actually proves they're in the US Army I might believe them. while bartending back in the day I used to have a coworker who, after a few drinks one night, eventually confessed she was a camgirl for a while. she went by April, who was really Stefani -- nether of which were her real names, but were just layers to keep stalkers off of her back. she had friends on the other side of the country take pictures of their dorm to help further the story. I totally believe a serious cracker would take similar precautions; OPSEC on OPSEC
- kgeist 2y agoInterestingly, Kiber- is how a Russian would transliterate "Cyber-". At first I thought he must be Russian, by the nickname alone (I'm a Russian speaker).
- ANewFormation 2y agoSomething I don't understand is why people don't appreciate /expect misdirection. For instance, a malicious actor, of even basic sophistication, coming from a Russian ip and occasionally using Cyrillic and missing grammatic artcles is probably not Russian. Similarly a malcious actor with a pseudonym including the term patriot, coming from a US IP and using terms like howdy probably is not American. False attribution is a core lesson in malice 101.
- andrewflnr 2y agoThere's a case to be made for expecting misdirection more often, but the fact remains that most people, including malicious actors, don't have the foresight and skill to pull it off. You do need both. Unless you plan a consistent fake story from the very start of an identity, execute it consistently, and hermetically isolate it from any others, you'll leave clues.
- ykonstant 2y agoSpot on, chap.
- johnnyanmac 2y agoNot that it's necessarily the case here, but you'd be surprised how many grand capers were only busted because the actor made an embarrassingly dumb mistake in leaving some obvious trail. It's not unheard of to apply some occam's razor just in case while keeping misdirection in mind. Even masterminds aren't perfectly rational actors that cross all their t's.
- rightbyte 2y agoDoubly so since warmongerers will defend your persona and corparations will use the persona as a politically palatable scapegoat.
- hilbert42 2y agoRight, there's something odd about this. That image from 2022 of a person's legs [Kiberphant0m?] in army fatigues ought to be a dead giveaway. For starters why would anyone be stupid enough to do that, second I'd recon the floor pattern alone might be enough to reveal the person, again why do that? Surely those involved would have have thought of that? Alternately they're on the room-temperature side of dumb. Of course, that doesn't include the image being a ruse for other schema.
- bayindirh 2y ago> Alternately they're on the room-temperature side of dumb. When combined with the uses the claimed for their botnet, the person we're talking about leaves an impression of having emotional maturity of a 10 year old. So, you might not be very far when it comes to non-technical skills.
- krisoft 2y ago> why would anyone be stupid enough to do that To prove their "credentials" that they are a real world "though guy", in the hopes of gaining social clout in among their peers. Same reason why some posts classified information on Discord or War Thunder.
- seanhunter 2y agoYes. I'm pretty sure if you spoke to an intelligence analyst they would tell you there's no such thing as an opsec troll. Everything your target does (including misdirection) gives or risks giving away information, and there's no way someone who is actually in control of events would blow a cover because even if you were 99% certain it was false, you would have to continually waste resources trying to confirm that. In particular if they invested a lot in building this persona and you were on to them it's much more likely they would just go dark, wait and plan how to pick up with a new persona.
- InDubioProRubio 2y agoThere are robots for everything social now- including manufacturing personas.
- datadrivenangel 2y agoIt's not about the volume of manufactured personas, it's about the tool-marks that can be analyzed.
- Oarch 2y agoYou'll never catch me!