11 ms·

It Was DPR, in the Tor HS, With the BTC

72 points by ctoth 13y ago

j_s 13y ago
Watch the author's 'OPSEC for hackers' presentation of the slides linked in the article: http://www.youtube.com/watch?v=9XaYdCdwiWU http://www.youtube.com/watch?v=9XaYdCdwiWU slides: http://www.slideshare.net/grugq/opsec-for-hackers http://www.slideshare.net/grugq/opsec-for-hackers
- grugq 13y ago
  ta.
  - ihsw 13y ago
    It's a pretty good presentation, and it cannot be understated that good security is hard to quantify until shit hits the fan. Especially in an environment where "hackers are no longer the apex predator." In case of living life on the edge (of legality), all it takes it one slip-up and then you're doing 40 years of hard time. In terms of predator-prey, hackers will now always be running and desperately looking behind them. Good advice: Predators always love playing with their prey, so make sure you're not being manipulated.
    - zalew 13y ago
      > Especially in an environment where "hackers are no longer the apex predator." and especially in an environment where your peers sing like canaries because they usually lack the (violence-driven) codex regarding the treatment of snitches. and yeah, I remember the case of that tortured guy from that cc forums, but from what I read about all those arrests, it's an exception that proves the rule.
      - ihsw 13y ago
        It has nothing to do with codex or creed or any of that, it's simply self-preservation. Most people aren't ideologues willing to go all the way (to death and destitution) for their ideals.
        zalew 13y ago
        yes. I misused the word, sorry. was thinking codex as a set of strict rules, not set of ideological values and mafia-family bullshit.
        grugq 13y ago
        There are almost no organisations that expect a code of silence indefinitely. It is not really a practical expectation of a human being. Most covert organisations (e.g. Hizbollah [0], KGB [1], IRA [2]) will expect their agents to remain silent long enough for everyone else at risk to escape. This is what happens when you remain silent rather than turn informant [3]. I have immense respect for Stephen Watt for keeping his honor, but I would not recommend taking that path to anyone in a similar situation. Lawyer up, and angle for the best plea deal you can get. [0] http://grugq.tumblr.com/post/61946725012/hizb-allah-resurrected-the-party-of-god-s-return-to http://grugq.tumblr.com/post/61946725012/hizb-allah-resurrec... [1] http://grugq.tumblr.com/post/59968838056/mastering-secret-work http://grugq.tumblr.com/post/59968838056/mastering-secret-wo... [2] http://tensmiths.files.wordpress.com/2012/08/15914572-ira-green-book-volumes-1-and-2.pdf http://tensmiths.files.wordpress.com/2012/08/15914572-ira-gr... [3] http://infiltratecon.com/watt.html http://infiltratecon.com/watt.html
        zalew 13y ago
        Tx for the links, seem interesting, saved them for a later read. Yeah, you are absolutely right, but still I wouldn't compare lulzsec to the orgs you mentioned or mobsters. Lets get this straight - no hacktivist or cracker was found hanging on the cell bars or shot in the woods, that's just not a comparable environment to serious organized crime. If nobody is afraid even of getting their knees broken, not to mention ditched in a hole, is there anything stopping them from snitching the minute le shows up at the door? Snitching is punishable for a reason, and there is a reason that ruleset goes all the way down to street level crime or even minor offences (that last one actually differs among places for cultural and political reasons).
      - gcb0 13y ago
        it is not lack of violence-driven knowledge about the ones that got caught. It is the lack of self preservation forward thinking of the ones not caught. Crime syndicates usually have insurance for families for people caught, and assurance that when they came out they will keep their share. If they didn't have this benefit they would be talking the same.
    - at-fates-hands 13y ago
      >>> it cannot be understated that good security is hard to quantify until shit hits the fan. One of the reasons I stopped being a hacker a long time ago. You never know how good you've covered tracks until the Feds show up in your dorm room, take you to a windowless room and grill you for about an hour, scaring the shit out of you in the process. I was lucky, I only lost some network privileges. Today the stakes are way higher and the Feds have some insane resources at their disposal. It's a zero sum game to them. You will lose every time.
      - ihsw 13y ago
        Even worse is the speed of escalation -- organizations didn't used to go right to the feds, and when they did then the feds didn't immediately use 4am SWAT teams. Nowadays the rate at which you'll get fucked hard is pretty fast, and they won't waste their time washing you through the legal system instead of letting you stew in a holding cell. Sure you'll get your plea bargain, but you won't like the part where you're forced to work as an informant immediately.
    - saraid216 13y ago
      It's funny how being top dog always seems to turn around and bite you in the ass eventually when you find out someone else made their way to the top.
kiba 13y ago
If I were still an anarchist/hardcore libertarian, hiring hitman would still be unacceptable. (It doesn't still make me root for the FBI though)
- grugq 13y ago
  The issue is less about any specific ideology, but rather the social environment he was immersed in. Other than radicals, drug seekers, drug dealers and undercover law enforcement officials, he doesnt seem have had much social interaction. His peer group was ideologically warped far away from societal norms. He had no outlet for either gaining ego validation (e.g. going to a bar and griping about his crap day at his startup cause some weed dealer ran off with $200,000); or social validation (e.g. "Hey everyone, my startup marketplace is doing really well! I've struck it rich due to my hard work and clever understanding of Austrian School economic theory!"). He had to talk with the same people that were drawing him further away from society, because he could not talk to anyone in mainstream society. This is a problem for almost everyone living a "high security" covert life. I also strongly suspect that many of the undercover agents were acting as agent provocateurs, urging him on towards more extreme positions and actions. The Maryland Indictment reads like a set piece put-up job. I can believe that it was an operation with the dual intent of (a) documenting DPR committing a heinous crime, and (b) unmasking DPR, most likely though the wire transfer. Even if (b) failed, they would still have (a) to prosecute him with later.
- VMG 13y ago
  still, there was interesting discussion and even some praise in /r/Anacap: http://www.reddit.com/r/Anarcho_Capitalism/comments/1nlyfd/lets_clear_the_air_in_here_facing_the_alleged/ccjulyl http://www.reddit.com/r/Anarcho_Capitalism/comments/1nlyfd/l...
- lmm 13y ago
  Seriously? If you genuinely tried to hire a hitman then you're a danger to society and I'll side with pretty much anyone against you.
- MichaelGG 13y ago
  He was left in a very terrible situation and decision. He was facing someone who was willing to destroy many other people's lives (assuming drug dealers would be arrested). If you take that as a given prior, then the step of deciding to prevent that person from hurting others seems like basic self defense (while noting that the USG prevented him from using other measures). Edit: There's always still the possibility that DPR was aware he wasn't hiring hitmen, but felt it was the best negotiation tactic.
nachteilig 13y ago
I remain surprised that he operated from America, especially if he was truly as socially isolated as this post suggests.
- grugq 13y ago
  I am very surprised he remained in the US. I would have thought he'd take his BTC and run off to live with McAfee in Belize.
  - sschueller 13y ago
    Isn't McAfee back in the US?
    - grugq 13y ago
      Now, yes. But Dread Pirate Roberts should have fled as soon as the first Congressman said "why can't we shut down Silk Road?"
      - tedunangst 13y ago
        hubris? They'll never catch me, the fools!
- MichaelGG 13y ago
  His operational model should have been fine. He should have acted as if he was acting on the DEA's front lawn. He made fatal operational mistakes. If he was somewhere else, he may have even acted more carelessly. Living somewhere else would be a minor hurdle. SR was an international site. Even without an extradition treaty, the feds would go to the country, say "psst, wanna hit a major international drug dealer?" And local police could bust him, jail him, then deport him, and then the USG could try him too. If your opsec relies on you laughing from some small country, hoping legal barriers prevent your capture, you've totally failed. Edit: He should have panicked as soon as agents visited him, but I guess he probably talked himself down. Probably figured "well they already have me or they don't", which, was probably true.
Stately 13y ago
Am I the only person who was sure this post was going to mock excessive use of acronyms?
- hackerboos 13y ago
  I just thought it was a Cluedo (http://en.wikipedia.org/wiki/Cluedo http://en.wikipedia.org/wiki/Cluedo) joke.
  - grugq 13y ago
    Yeah, it is.
- deleted 13y ago
  [deleted]
- grugq 13y ago
  Sorry.
- saraid216 13y ago
  I'm personally disappointed he didn't round out the set of TLAs with THS.
- fennecfoxen 13y ago
  Actually, I was expecting the democratic peoples' republic of China. But then I realized it was missing a C.
AJ007 13y ago
Criminals isolate, target, and research individuals based on this information. This includes everything from simple identity theft to murder. You may also recall numerous yahoo email address "hacks" based off easily locatable answers to security questions of public figures. There are some basic lessons here that are applicable to anyone using the internet, even just for casual reasons. That includes your parents or grandparents. What do you think the chances are that they would be able to proactively defend themselves against someone tearing apart their private lives based on information they didn't even know was public? -Not sharing/linking email addresses an alias How is this relevant? This could be as basic as not wanting to link your persona as a member of the town council to your postings in a World of Warcraft forum. Even if your life is mundane and none of your hobbies are embarrassing this is still important. Forum posts, which most users treat as casual chat, along with many social media interactions are permanent, public, and searchable. There is no compelling reason to allow anyone in the world to know an enormous amount of personal details about you. At least on your Facebook page, if Zuckerburg hasn't recently screwed with your privacy settings, you are narrowing the number of people who can look at these things. I'm not going to endorse any particular services, but many sites allow you to search accounts by email address. Amazon, in particular, can reveal your public wishlist based on email address (rossulbricht@gmail.com shows an account but not a wishlist.) You can figure out a lot about a person from their wishlist + reviews. Quite frankly I think this all is very relevant and mass marketable to anyone building tools and products to firewall personal information.
pearjuice 13y ago
Funny how everybody says that he should have done this and not done that. It is really an overwhelming experience to speculate and comment on past matters but don't forget that it was him who actually did it. Who actually ran the market place. Who cashed out and probably has reserves here and there. Who pressed that "submit" button on stackoverflow. You weren't capable of doing so. You think you have better ideas about it. That you could "disappear" and never get linked to the real "you". I am not daring you to do try it, as it can land you behind bars, but I am just saying that unless you actually experienced and lived all of this - the commentary is nothing more than a theoretical shim which will never become reality.
- pstuart 13y ago
  Ah, I could have written it in a weekend.... /s
- toadi 13y ago
  This happens all the time. It's easy to make decisions if you now all the variables post factum. Sometimes you make decisions without all the knowledge. For people analyzing the lessons learned it's easy...
- MichaelGG 13y ago
  I'd agree with this sentiment except the mistake is a very fundamental, very flawed one: reusing the same ID. And it was made right at the beginning, when energy is highest. It's not like he made long mistakes over the years leading to an eventual arrest. He allegedly started off by posting with the same ID as his physical person.
  - esrauch 13y ago
    Honestly it is more understandable to make that type of mistake at the beginning; there is no way he could have reasonably assumed that he would later have the level of fame that would make the feds run a high priority effort specifically to catch him.
- grugq 13y ago
  Without performing "lessons learned" analysis on failures, how will we ever learn? Conducting this sort of exercise is critical to improving the capabilities of everyone who engages in clandestine activities. Dismissing it out of hand is remarkably short sighted.

72 points by ctoth 13y ago

j_s 13y ago

Watch the author's 'OPSEC for hackers' presentation of the slides linked in the article: http://www.youtube.com/watch?v=9XaYdCdwiWU http://www.youtube.com/watch?v=9XaYdCdwiWU slides: http://www.slideshare.net/grugq/opsec-for-hackers http://www.slideshare.net/grugq/opsec-for-hackers

grugq 13y ago
ta.
- ihsw 13y ago
  It's a pretty good presentation, and it cannot be understated that good security is hard to quantify until shit hits the fan. Especially in an environment where "hackers are no longer the apex predator." In case of living life on the edge (of legality), all it takes it one slip-up and then you're doing 40 years of hard time. In terms of predator-prey, hackers will now always be running and desperately looking behind them. Good advice: Predators always love playing with their prey, so make sure you're not being manipulated.
  - zalew 13y ago
    > Especially in an environment where "hackers are no longer the apex predator." and especially in an environment where your peers sing like canaries because they usually lack the (violence-driven) codex regarding the treatment of snitches. and yeah, I remember the case of that tortured guy from that cc forums, but from what I read about all those arrests, it's an exception that proves the rule.
    - ihsw 13y ago
      It has nothing to do with codex or creed or any of that, it's simply self-preservation. Most people aren't ideologues willing to go all the way (to death and destitution) for their ideals.
      - zalew 13y ago
        yes. I misused the word, sorry. was thinking codex as a set of strict rules, not set of ideological values and mafia-family bullshit.
        grugq 13y ago
        There are almost no organisations that expect a code of silence indefinitely. It is not really a practical expectation of a human being. Most covert organisations (e.g. Hizbollah [0], KGB [1], IRA [2]) will expect their agents to remain silent long enough for everyone else at risk to escape. This is what happens when you remain silent rather than turn informant [3]. I have immense respect for Stephen Watt for keeping his honor, but I would not recommend taking that path to anyone in a similar situation. Lawyer up, and angle for the best plea deal you can get. [0] http://grugq.tumblr.com/post/61946725012/hizb-allah-resurrected-the-party-of-god-s-return-to http://grugq.tumblr.com/post/61946725012/hizb-allah-resurrec... [1] http://grugq.tumblr.com/post/59968838056/mastering-secret-work http://grugq.tumblr.com/post/59968838056/mastering-secret-wo... [2] http://tensmiths.files.wordpress.com/2012/08/15914572-ira-green-book-volumes-1-and-2.pdf http://tensmiths.files.wordpress.com/2012/08/15914572-ira-gr... [3] http://infiltratecon.com/watt.html http://infiltratecon.com/watt.html
        zalew 13y ago
        Tx for the links, seem interesting, saved them for a later read. Yeah, you are absolutely right, but still I wouldn't compare lulzsec to the orgs you mentioned or mobsters. Lets get this straight - no hacktivist or cracker was found hanging on the cell bars or shot in the woods, that's just not a comparable environment to serious organized crime. If nobody is afraid even of getting their knees broken, not to mention ditched in a hole, is there anything stopping them from snitching the minute le shows up at the door? Snitching is punishable for a reason, and there is a reason that ruleset goes all the way down to street level crime or even minor offences (that last one actually differs among places for cultural and political reasons).
    - gcb0 13y ago
      it is not lack of violence-driven knowledge about the ones that got caught. It is the lack of self preservation forward thinking of the ones not caught. Crime syndicates usually have insurance for families for people caught, and assurance that when they came out they will keep their share. If they didn't have this benefit they would be talking the same.
  - at-fates-hands 13y ago
    >>> it cannot be understated that good security is hard to quantify until shit hits the fan. One of the reasons I stopped being a hacker a long time ago. You never know how good you've covered tracks until the Feds show up in your dorm room, take you to a windowless room and grill you for about an hour, scaring the shit out of you in the process. I was lucky, I only lost some network privileges. Today the stakes are way higher and the Feds have some insane resources at their disposal. It's a zero sum game to them. You will lose every time.
    - ihsw 13y ago
      Even worse is the speed of escalation -- organizations didn't used to go right to the feds, and when they did then the feds didn't immediately use 4am SWAT teams. Nowadays the rate at which you'll get fucked hard is pretty fast, and they won't waste their time washing you through the legal system instead of letting you stew in a holding cell. Sure you'll get your plea bargain, but you won't like the part where you're forced to work as an informant immediately.
  - saraid216 13y ago
    It's funny how being top dog always seems to turn around and bite you in the ass eventually when you find out someone else made their way to the top.

kiba 13y ago

If I were still an anarchist/hardcore libertarian, hiring hitman would still be unacceptable. (It doesn't still make me root for the FBI though)

grugq 13y ago
The issue is less about any specific ideology, but rather the social environment he was immersed in. Other than radicals, drug seekers, drug dealers and undercover law enforcement officials, he doesnt seem have had much social interaction. His peer group was ideologically warped far away from societal norms. He had no outlet for either gaining ego validation (e.g. going to a bar and griping about his crap day at his startup cause some weed dealer ran off with $200,000); or social validation (e.g. "Hey everyone, my startup marketplace is doing really well! I've struck it rich due to my hard work and clever understanding of Austrian School economic theory!"). He had to talk with the same people that were drawing him further away from society, because he could not talk to anyone in mainstream society. This is a problem for almost everyone living a "high security" covert life. I also strongly suspect that many of the undercover agents were acting as agent provocateurs, urging him on towards more extreme positions and actions. The Maryland Indictment reads like a set piece put-up job. I can believe that it was an operation with the dual intent of (a) documenting DPR committing a heinous crime, and (b) unmasking DPR, most likely though the wire transfer. Even if (b) failed, they would still have (a) to prosecute him with later.
VMG 13y ago
still, there was interesting discussion and even some praise in /r/Anacap: http://www.reddit.com/r/Anarcho_Capitalism/comments/1nlyfd/lets_clear_the_air_in_here_facing_the_alleged/ccjulyl http://www.reddit.com/r/Anarcho_Capitalism/comments/1nlyfd/l...
lmm 13y ago
Seriously? If you genuinely tried to hire a hitman then you're a danger to society and I'll side with pretty much anyone against you.
MichaelGG 13y ago
He was left in a very terrible situation and decision. He was facing someone who was willing to destroy many other people's lives (assuming drug dealers would be arrested). If you take that as a given prior, then the step of deciding to prevent that person from hurting others seems like basic self defense (while noting that the USG prevented him from using other measures). Edit: There's always still the possibility that DPR was aware he wasn't hiring hitmen, but felt it was the best negotiation tactic.

nachteilig 13y ago

I remain surprised that he operated from America, especially if he was truly as socially isolated as this post suggests.

grugq 13y ago
I am very surprised he remained in the US. I would have thought he'd take his BTC and run off to live with McAfee in Belize.
- sschueller 13y ago
  Isn't McAfee back in the US?
  - grugq 13y ago
    Now, yes. But Dread Pirate Roberts should have fled as soon as the first Congressman said "why can't we shut down Silk Road?"
    - tedunangst 13y ago
      hubris? They'll never catch me, the fools!
MichaelGG 13y ago
His operational model should have been fine. He should have acted as if he was acting on the DEA's front lawn. He made fatal operational mistakes. If he was somewhere else, he may have even acted more carelessly. Living somewhere else would be a minor hurdle. SR was an international site. Even without an extradition treaty, the feds would go to the country, say "psst, wanna hit a major international drug dealer?" And local police could bust him, jail him, then deport him, and then the USG could try him too. If your opsec relies on you laughing from some small country, hoping legal barriers prevent your capture, you've totally failed. Edit: He should have panicked as soon as agents visited him, but I guess he probably talked himself down. Probably figured "well they already have me or they don't", which, was probably true.

Stately 13y ago

Am I the only person who was sure this post was going to mock excessive use of acronyms?

hackerboos 13y ago
I just thought it was a Cluedo (http://en.wikipedia.org/wiki/Cluedo http://en.wikipedia.org/wiki/Cluedo) joke.
- grugq 13y ago
  Yeah, it is.
deleted 13y ago
[deleted]
grugq 13y ago
Sorry.
saraid216 13y ago
I'm personally disappointed he didn't round out the set of TLAs with THS.
fennecfoxen 13y ago
Actually, I was expecting the democratic peoples' republic of China. But then I realized it was missing a C.

AJ007 13y ago

Criminals isolate, target, and research individuals based on this information. This includes everything from simple identity theft to murder. You may also recall numerous yahoo email address "hacks" based off easily locatable answers to security questions of public figures. There are some basic lessons here that are applicable to anyone using the internet, even just for casual reasons. That includes your parents or grandparents. What do you think the chances are that they would be able to proactively defend themselves against someone tearing apart their private lives based on information they didn't even know was public? -Not sharing/linking email addresses an alias How is this relevant? This could be as basic as not wanting to link your persona as a member of the town council to your postings in a World of Warcraft forum. Even if your life is mundane and none of your hobbies are embarrassing this is still important. Forum posts, which most users treat as casual chat, along with many social media interactions are permanent, public, and searchable. There is no compelling reason to allow anyone in the world to know an enormous amount of personal details about you. At least on your Facebook page, if Zuckerburg hasn't recently screwed with your privacy settings, you are narrowing the number of people who can look at these things. I'm not going to endorse any particular services, but many sites allow you to search accounts by email address. Amazon, in particular, can reveal your public wishlist based on email address (rossulbricht@gmail.com shows an account but not a wishlist.) You can figure out a lot about a person from their wishlist + reviews. Quite frankly I think this all is very relevant and mass marketable to anyone building tools and products to firewall personal information.

pearjuice 13y ago

Funny how everybody says that he should have done this and not done that. It is really an overwhelming experience to speculate and comment on past matters but don't forget that it was him who actually did it. Who actually ran the market place. Who cashed out and probably has reserves here and there. Who pressed that "submit" button on stackoverflow. You weren't capable of doing so. You think you have better ideas about it. That you could "disappear" and never get linked to the real "you". I am not daring you to do try it, as it can land you behind bars, but I am just saying that unless you actually experienced and lived all of this - the commentary is nothing more than a theoretical shim which will never become reality.

pstuart 13y ago
Ah, I could have written it in a weekend.... /s
toadi 13y ago
This happens all the time. It's easy to make decisions if you now all the variables post factum. Sometimes you make decisions without all the knowledge. For people analyzing the lessons learned it's easy...
MichaelGG 13y ago
I'd agree with this sentiment except the mistake is a very fundamental, very flawed one: reusing the same ID. And it was made right at the beginning, when energy is highest. It's not like he made long mistakes over the years leading to an eventual arrest. He allegedly started off by posting with the same ID as his physical person.
- esrauch 13y ago
  Honestly it is more understandable to make that type of mistake at the beginning; there is no way he could have reasonably assumed that he would later have the level of fame that would make the feds run a high priority effort specifically to catch him.
grugq 13y ago
Without performing "lessons learned" analysis on failures, how will we ever learn? Conducting this sort of exercise is critical to improving the capabilities of everyone who engages in clandestine activities. Dismissing it out of hand is remarkably short sighted.