4 ms·

I tried a few weeks of living opsec to get a feel for how practical this stuff is. Really got into it, to the point of wearing disposable gloves to get sorta un

I tried a few weeks of living opsec to get a feel for how practical this stuff is. Really got into it, to the point of wearing disposable gloves to get sorta untraceable currency and looking into body armour and secured living arrangements. It's probably easy to get too paranoid, and perhaps those people never end up launching a successful Onion site. But just quickly, he should have compartmentalized. Zero need to have all that data decrypted while doing day-to-day admin. A throwaway machine with Tails or something would suffice for management. Then, add some physical security, such as smartcards with removal events set to destroy and then chain it to your neck. Or there's little dongles that do proximity detection. Then get some physical security so your RAM is never exposed. The commercial phreaking devices were said to have thermite, but something explosive might look too much like terrorism. I'm not sure it'd be out of the question to wire up a short-circuit to your RAM at single click, although that would look bad, versus something less obvious. But really, this is apparently only because he messed up his server security so badly. Otherwise, they wouldn't have been there in person in the first place, right? It's probably safe to assume that if you're being physically targeted, you're going to have a bad time living a normal life. If you have a bunker or something where you can definitively see all approaches and have many minutes in case of a raid, eh, maybe. But by that time, there's probably some sort of correlation information or real-world bug going on, right? If Ross had been super careful, eventually they'd just bug his every movement, word, etc. Get video or audio on his keyboard, even, right? So worrying about this is the barn door question after horses have left, it feels.

tptacek 12y ago
You don't even need something like Tails. You just need encrypted disk images, and to keep them unmounted when you're not actively using them. This is a capability that is for instance built into Mac OS X.
- MichaelGG 12y ago
  Well, just as a defense-in-depth, in case of a Firefox 0-day (or 90-day) or something, it'd minimize a leak, slightly? Edit: Oh, also, since compulsion to reveal keys might be an issue, it's better if there's nothing around. In the US it seems to be if the prosecution can convince a judge that they really did see evidence but you since re-encrypted. I wouldn't want to rely on a judge in that case. Although at this point one is probably cooked but still.
- NietTim 12y ago
  In the case of OS X this would still mean that the password for the disk is stored in memory, right?
- nitrogen 12y ago
  What someone in that situation really needs is the opsec equivalent of a trap door function. Does such a thing exist that is easy to defend and difficult to attack? Could be very useful for e.g. rights activists in remote places of the world.
icpmacdo 12y ago
What conclusions did you come to on the body armour? Did you end up walking around with it on day to day? Any other interesting tid bits on your opsec journey?
- MichaelGG 12y ago
  It can devolve into "Reflections on Trust". I started auditing everything above the OS and VMware on my host. It's intractable. So I just had to start drawing lines. The beneficial part is to think of every action you do, how many bits is it leaking? What persona are you, at that moment? How is that persona contained? How will the traces you are leaving at the moment look to an investigator? A judge? A super power network analysis and correlation system? For each bit you're leaking, what specific steps are reducing it and how? Are you still in persona? If your persona is from County X, is he on at the right times? If not, and he makes casual comments, so they fit in persona? Eg if on late and the World Cup is being held in his come country, did the persona reference it accurately? (And the searches you performed to find out that info, can they be correlated back?) I'm sure this has a name but getting in the mindset and making sure you don't break character is key. I think it's probably best to minimize all statements. But, many records show people being found because they slipped up. Like one of the recent hacking groups, he told someone in chat "yeah well I was arrested for pot back in '06". Damn, you just cut your identity space from something like 2^28 to 2^20. Do that a couple more times and your toast. Hell, even picking a username from a great book you're reading might take off several bits (eg if you bought the book on Amazon, and are reading it on Kindle, a well funded adversary could correlate - there's probably many such casual " unrelated " influences that might be detectable. Personas need to extend to hardware, too. For example, cameras might have somewhat unique noise patterns. If you use your camera to take a pic of <something> , and with the same camera take pics to post on Facebook, it's plausible an adversary could get many bits of your ID. Fingerprints are everywhere, so minimize channels used to avoid surprises. It's probably good to try to do things in batch. Download data, manipulate on a limited offline device, then batch upload. This is easy to disguise, and could be set on timers to coincide with different personas, establishing alibis. It helps defeat simple traffic correlation, like "let's cut off access to ISP A, and see if our target chat user disconnects". If you were chatting all day on a server, such an attack could be very effective. I didn't do batch mode, because I didn't have any actual work, other than " buy btc and setup a single server hosting a single static page ". (I was thinning of a legal product (something like dropbox) aimed at privacy users and wanted to know how hard it'd be in real live... I decided the Onion service limitations would put my users at too much risk, and many users would fail to follow procedure when using the service, very high risk for them). The body armor idea was more an overreaction (it was mostly for at home/hotel/sleeping). Once you getting paranoid, it's a spiral. And hey, if you do get raided, there's probably a small benefit to be gained by having some accidental shots not be fatal, right? But no one takes any of this stuff seriously in general, so body armor is likely to get a friend to call the psych ward. Even the BTC or darknet forums. They suggest waking into a bank to buy BTC. Or meeting a stranger in public. Two great ways to link your meatspace and BTC identities! Sigh. Anyways I recovered by going back to axioms, or trust anchors. Stuff like, "I trust Tor will not reveal my source IP on this persona in under a month", then build from there. The product idea didn't work out, so I dropped the " experiment ". I kept smart cards, FDE, multi VM, and tamper evident seals/stickers, but otherwise went back to normal.

tptacek 12y ago

You don't even need something like Tails. You just need encrypted disk images, and to keep them unmounted when you're not actively using them. This is a capability that is for instance built into Mac OS X.

MichaelGG 12y ago
Well, just as a defense-in-depth, in case of a Firefox 0-day (or 90-day) or something, it'd minimize a leak, slightly? Edit: Oh, also, since compulsion to reveal keys might be an issue, it's better if there's nothing around. In the US it seems to be if the prosecution can convince a judge that they really did see evidence but you since re-encrypted. I wouldn't want to rely on a judge in that case. Although at this point one is probably cooked but still.
NietTim 12y ago
In the case of OS X this would still mean that the password for the disk is stored in memory, right?
nitrogen 12y ago
What someone in that situation really needs is the opsec equivalent of a trap door function. Does such a thing exist that is easy to defend and difficult to attack? Could be very useful for e.g. rights activists in remote places of the world.

icpmacdo 12y ago

What conclusions did you come to on the body armour? Did you end up walking around with it on day to day? Any other interesting tid bits on your opsec journey?

MichaelGG 12y ago
It can devolve into "Reflections on Trust". I started auditing everything above the OS and VMware on my host. It's intractable. So I just had to start drawing lines. The beneficial part is to think of every action you do, how many bits is it leaking? What persona are you, at that moment? How is that persona contained? How will the traces you are leaving at the moment look to an investigator? A judge? A super power network analysis and correlation system? For each bit you're leaking, what specific steps are reducing it and how? Are you still in persona? If your persona is from County X, is he on at the right times? If not, and he makes casual comments, so they fit in persona? Eg if on late and the World Cup is being held in his come country, did the persona reference it accurately? (And the searches you performed to find out that info, can they be correlated back?) I'm sure this has a name but getting in the mindset and making sure you don't break character is key. I think it's probably best to minimize all statements. But, many records show people being found because they slipped up. Like one of the recent hacking groups, he told someone in chat "yeah well I was arrested for pot back in '06". Damn, you just cut your identity space from something like 2^28 to 2^20. Do that a couple more times and your toast. Hell, even picking a username from a great book you're reading might take off several bits (eg if you bought the book on Amazon, and are reading it on Kindle, a well funded adversary could correlate - there's probably many such casual " unrelated " influences that might be detectable. Personas need to extend to hardware, too. For example, cameras might have somewhat unique noise patterns. If you use your camera to take a pic of <something> , and with the same camera take pics to post on Facebook, it's plausible an adversary could get many bits of your ID. Fingerprints are everywhere, so minimize channels used to avoid surprises. It's probably good to try to do things in batch. Download data, manipulate on a limited offline device, then batch upload. This is easy to disguise, and could be set on timers to coincide with different personas, establishing alibis. It helps defeat simple traffic correlation, like "let's cut off access to ISP A, and see if our target chat user disconnects". If you were chatting all day on a server, such an attack could be very effective. I didn't do batch mode, because I didn't have any actual work, other than " buy btc and setup a single server hosting a single static page ". (I was thinning of a legal product (something like dropbox) aimed at privacy users and wanted to know how hard it'd be in real live... I decided the Onion service limitations would put my users at too much risk, and many users would fail to follow procedure when using the service, very high risk for them). The body armor idea was more an overreaction (it was mostly for at home/hotel/sleeping). Once you getting paranoid, it's a spiral. And hey, if you do get raided, there's probably a small benefit to be gained by having some accidental shots not be fatal, right? But no one takes any of this stuff seriously in general, so body armor is likely to get a friend to call the psych ward. Even the BTC or darknet forums. They suggest waking into a bank to buy BTC. Or meeting a stranger in public. Two great ways to link your meatspace and BTC identities! Sigh. Anyways I recovered by going back to axioms, or trust anchors. Stuff like, "I trust Tor will not reveal my source IP on this persona in under a month", then build from there. The product idea didn't work out, so I dropped the " experiment ". I kept smart cards, FDE, multi VM, and tamper evident seals/stickers, but otherwise went back to normal.