6 ms·
So what was his opsec mistake so that we can learn something from this case?
by siva7 2y ago
So what was his opsec mistake so that we can learn something from this case?
- throwaway290 2y ago> On November 26, KrebsOnSecurity published a story that followed a trail of clues left behind by Kiberphantom indicating he was a U.S. Army soldier stationed in South Korea Read the article, There is a link in that sentence.
- formerly_proven 2y agohttps://news.ycombinator.com/item?id=42251799 https://news.ycombinator.com/item?id=42251799
- oefrha 2y agoThe main takeaway for me is the following. Everything you post online will end up in a public archive. That includes everything you post to supposedly private or semi-private venues, like Telegram channels. Everything you posted when you were a dumb kid will be there too, however long ago that was. So, if you’re gonna be a cybercrminal, make absolutely sure that you start with a clean slate. No one can know the connections to your past, because even if you’re careful, other idiots can let slip (like using your old moniker to address you) at any time. And don’t post fucking photos, ever.
- gorbachev 2y agoAnd don't brag about your crimes after the fact online, or anywhere else either.
- oefrha 2y agoBoasting is required in his line of work, that's how they build street rep, sell their products/services, and recruit people. (Contrast this to spycraft where the acceptable amount of boasting is zero.) What did him in was boasting from a non-clean slate identity among other things. He needed strict separation between big time jobs which require an absolute clean slate because all the attention will be there, small time jobs that are likely numerous and sloppier but no one will bother to investigate, and pleasure. He didn't have that.
- Arrath 2y agoRemember kids, only break one law at a time. And once you're done, shut the hell up!!
- rscho 2y agoHilarious case in point https://www.cbsnews.com/news/carl-stewart-drug-dealer-identified-cheese-photo-encrochat/ https://www.cbsnews.com/news/carl-stewart-drug-dealer-identi...
- mvdtnz 2y agoI don't buy that they got his fingerprints and palm prints from that photo.
- wongarsu 2y agoWhy not? Seems like a pretty clear shot of three of his fingers and a good partial print of his thumb. I assume the original was higher resolution than the version in the article. The CCC made a point a couple years ago by publishing finger prints of high ranking German government officials extracted from photos
- machine_coffee 2y agoI think they went even further and 3d printed their thumbprint and unlocked their phone with it, if I remember correctly.
- GoblinSlayer 2y agoJust change your thumbprint after a leak, no problem.
- dylan604 2y agoA dedicated criminal wouldn’t have fingerprints.
- datavirtue 2y agoFingerprint tech is ridiculously advanced. I saw a documentary where they lifted a print off a pillow case decades later.
- grecy 2y agoThat is exactly how the Silk Road guy was finally identified and caught.
- avidiax 2y agoI once read a detailed account of how he was caught. It seemed like the kind of clues that you could only connect post-hoc. It seemed like parallel construction [1] to me. Considering that the NSA is known to give the DEA "tips" [2], and has a division specifically to start parallel construction investigations [3], and this was a high profile drug case, it would be odd that they didn't use parallel construction techniques. [1] https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction [2] https://arstechnica.com/tech-policy/2013/08/us-drug-agency-gets-intel-from-nsa-then-lies-about-its-origins-to-build-cases/ https://arstechnica.com/tech-policy/2013/08/us-drug-agency-g... [3] https://www.reuters.com/article/world/exclusive-u-s-directs-agents-to-cover-up-programme-used-to-investigate-americans-idUSBRE9740HP/ https://www.reuters.com/article/world/exclusive-u-s-directs-...
- grecy 2y agoI read the book about it, and it was actually an IRS agent who found a super old forum post where the guy announced he had created the Silk Road using a username that was easily linked to his real name. The IRS guy figured it out and nobody would act on it because they all figured the FBI would know better and they should wait for the FBI to do it right. ... but actually he nailed it.
- jasdi 2y agoThat's not enough. Even the best people and teams, can make mistakes and they do so all the time.
- Y_Y 2y agoBut how are they to be tied together? If you don't use the same name, or talk about very specific or correlateable things, then it's hard for me to imagine how you're tying my old IRC chats to my facebooks groups to my Telegram conspiracies. As far as I'm aware the really useful metadata is rarely available since only the site operator had that and most likely deleted it or threw it in a drawer.
- sjsdaiuasgdia 2y agoYou might want to give the prior Krebs post on this guy a read - https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/ https://krebsonsecurity.com/2024/11/hacker-in-snowflake-exto... It shows how small bits of information from several sources are used to tie this guy's aliases together.
- Y_Y 2y agoThanks, that's exactly what I was looking for.
- potato3732842 2y agoI'm worried this new "level up" of communication and record keeping technology at a time when fundamental ideological differences between groups in the western world are causing problems is going to result in a repeat of 1500s europe.
- warner25 2y agoThis reminds me of things that I've read about intelligence agencies increasingly finding it impossible to give agents fake identities for cover; everyone now has just left too much of a trail of data behind them. And if you find or create someone with no such trail, that stands out as being suspicious. As an aside, this is a paradox that has fascinated me for a while. Potentially any step that we take to be more private or anonymous makes us stand out more, thus easier to track and re-identify, because we end up in a smaller crowd (i.e. anonymity set).
- qingcharles 2y agoI would imagine they just buy old accounts on black hat sites and reuse them? Or use leaked login credentials for abandoned accounts.
- grumple 2y agoHe expressed negative sentiments about South Korea and showed he accessed a particular website at a given time. Don’t post anything on the internet if you wish to remain anonymous. Don’t express opinions about anything. We’ve had a few different posts on HN demonstrating that it is trivial to link aliases based on writing style. To avoid this you’d have to pipe everything you write through an LLM. And then you have another potential data point.
- staunton 2y ago> We’ve had a few different posts on HN demonstrating that it is trivial to link aliases based on writing style. Do you have a link? I wasn't able to find it...
- ailef 2y agohttps://news.ycombinator.com/item?id=33755016 https://news.ycombinator.com/item?id=33755016
- randunel 2y agoIn spite of every programmer at work following the same styling guidelines and programming patterns, I can quite easily identify the author of a pull request by reading their code alone. The commenter's claim seems plausible to me.
- Marsymars 2y agoI might actually have an easier time identifying authors by commit messages/patterns rather than their content since the styling guidelines are mostly handled by linters.
- ilamont 2y agoSomeone created a tool two years ago that does this, https://stylometry.net https://stylometry.net but it appears to be offline. The creator at the time said: This site lets you put in a username and get the users with the most similar writing style to that user. It confirmed several users who I suspected were alts and after informally asking around has identified abandoned accounts of people I know from many years ago. I made this site mostly to show how easy this is and how it can erode online privacy. If some guy with a little bit of Python, and $8 to rent a decent dedicated server for a day can make this, imagine what a company with millions of dollars and a couple dozen PhD linguists could do. https://news.ycombinator.com/item?id=33755016 https://news.ycombinator.com/item?id=33755016 It's also possible to eyeball similar writing styles, although not at scale. That's how "Fake Steve Jobs" was uncovered in 2007: Last year, his agent showed the manuscript to several book publishers and told them the anonymous author was a published novelist and writer for a major business magazine. The New York Times found Mr. Lyons by looking for writers who fit those two criteria, and then by comparing the writing of “Fake Steve” to a blog Mr. Lyons writes in his own name, called Floating Point https://www.nytimes.com/2007/08/06/technology/06steve.html#:~:text=The%20New%20York%20Times%20found,Mr https://www.nytimes.com/2007/08/06/technology/06steve.html#:....
- jcpham2 2y agoThe previous Krebs article [1] on this walks through the opsec mistake(s) but it always comes down to email address re-use and nickname/ handle re-usage. As more data breaches happen the likelihood of an opsec mistake increases. Once a handle is burned it’s best to never re-use it again… ever. Even if it’s been a decade. Also, the reuse of email or any form of contact information on a service/ web hosting or DNS registration is another common opsec oopsie [1] https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/ https://krebsonsecurity.com/2024/11/hacker-in-snowflake-exto...
- lawgimenez 2y agoLoose lips, sink ships. Based on the articles he brags too much.
- markus_zhang 2y agoI have watched a Defcon tall about a drug dealer and his opsec was already pretty good (fake name and address, yagi for wifi, etc.) but he still got caught because of one of the guys he used to launder Bitcoin was caught. So I think the point is not to get into the bullseye of the state.
- red-iron-pine 2y agoit we're thinking of the same one it's this: https://www.youtube.com/watch?v=01oeaBb85Xc https://www.youtube.com/watch?v=01oeaBb85Xc DEF CON 30 - Sam Bent - Tor - Darknet Opsec By a Veteran Darknet Vendor
- markus_zhang 2y agoYep that's him!
- seanhunter 2y agoHe committed the oldest opsec mistake of all - bragging about what he did. "He who would keep a secret must keep secret that he has a secret to keep" - Sir Humphrey Appleby but I think he was paraphrasing Goethe That said, opsec is (to all practical intents and purposes) impossible in the long run in the face of a very determined adversary. If they want to find you, you will have done something to give someone a lead and there will be enough pieces to put the picture together.
- silvestrov 2y ago"He that would keep a secret must keep it secret, that he hath the secret to keep." Who said that? It was Sir Humphrey. - Who said it originally? - Francis Bacon, wasn't it? Starting a subtitle 2653 in https://yes-minister.com/ym2x01-2x07.srt https://yes-minister.com/ym2x01-2x07.srt
- FredPret 2y agoBest show ever
- ratherbefuddled 2y agoStill perfectly relevant today as well.
- moomin 2y agoI read an OpSec manual around the time of GamerGate. One truly basic thing: never do anything to link two accounts together. Never mention it, never promote it. I doubt many people know who I am on reddit but I 100% know that anyone sufficiently inclined could identify me. Next: obviously avoid biographical details. People can compile a lot of information about you online.
- bookofjoe 2y agoI can't help but recall a NYC robbery around 20-30 years ago where the perps took photos of each other with a Polaroid camera they found at the scene and left the Polaroids behind.
- bradly 2y ago> So what was his opsec mistake so that we can learn something from this case? From the article: "Anonymously extorting the President and VP as a member of the military is a bad idea, but it’s an even worse idea to harass people who specialize in de-anonymizing cybercriminals"