111
OPSEC for hackers: because jail is for wuftpd [email protected] РУССКИХ Monday, November 19, 12

Keynote the grugq opsec for russians

  • View
    3.532

  • Download
    8

Embed Size (px)

DESCRIPTION

 

Citation preview

Page 1: Keynote the grugq   opsec for russians

OPSEC for hackers: because jail is for

[email protected]

РУССКИХ

Monday, November 19, 12

Page 2: Keynote the grugq   opsec for russians

Overview

• Intro to OPSEC

• Methodology

• lulzsec: lessons learned

• Techniques

• Technology

• Conclusion

Monday, November 19, 12

Page 3: Keynote the grugq   opsec for russians

Avon: You only got to fuck up once… Be a little slow, be a little late, just once. How you ain’t gonna never be slow? Never be late? You can’t plan for that. Thats life.

Monday, November 19, 12

Page 4: Keynote the grugq   opsec for russians

Intro to OPSEC

Monday, November 19, 12

Page 5: Keynote the grugq   opsec for russians

WTF is it?

Monday, November 19, 12

Page 6: Keynote the grugq   opsec for russians

OPSEC in a nutshell

• Keep your mouth shut

• Guard secrets

• Need to know

• Never let anyone get into position to blackmail you

Monday, November 19, 12

Page 7: Keynote the grugq   opsec for russians

STFU

Monday, November 19, 12

Page 8: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 9: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 10: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 11: Keynote the grugq   opsec for russians

Methodology

Monday, November 19, 12

Page 12: Keynote the grugq   opsec for russians

• put the plumbing in first

• create a cover (new persona)

• work on the legend (history, background, supporting evidence for the persona)

• Create sub-aliases

• NEVER CONTAMINATE

Monday, November 19, 12

Page 13: Keynote the grugq   opsec for russians

The 10 Hack Commandments

FREEDOM FIGHTING

Monday, November 19, 12

Page 14: Keynote the grugq   opsec for russians

• Rule 1: Never reveal your operational details

• Rule 2: Never reveal your plans

• Rule 3: Never trust anyone

• Rule 4: Never confuse recreation and hacking

• Rule 5: Never operate from your own house

FREEDOM FIGHTING

Monday, November 19, 12

Page 15: Keynote the grugq   opsec for russians

• Rule 6: Be proactively paranoid, it doesn’t work retroactively

• Rule 7: Keep personal life and hacking separated

• Rule 8: Keep your personal environment contraband free

• Rule 9: Don’t attract attention

• Rule 10: Don't give anyone power over you

FREEDOM FIGHTING

Monday, November 19, 12

Page 16: Keynote the grugq   opsec for russians

Why do you need OPSEC?

Monday, November 19, 12

Page 17: Keynote the grugq   opsec for russians

ProTip: Cover the webcam on your laptop.

Monday, November 19, 12

Page 18: Keynote the grugq   opsec for russians

It hurts to get fucked

Monday, November 19, 12

Page 19: Keynote the grugq   opsec for russians

No one is going to go to jail for you.

Monday, November 19, 12

Page 20: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 21: Keynote the grugq   opsec for russians

Your friends will betray you.

Monday, November 19, 12

Page 22: Keynote the grugq   opsec for russians

#lulzsec:lessons learned

Monday, November 19, 12

Page 23: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 24: Keynote the grugq   opsec for russians

Violation

Never trust anyone

Monday, November 19, 12

Page 25: Keynote the grugq   opsec for russians

ProTip: Don’t use your personal Facebook account to send defacement code to your friendsFREEDOM FIGHTERS

Monday, November 19, 12

Page 26: Keynote the grugq   opsec for russians

ProTip: Don’t use your real first name as your username

Monday, November 19, 12

Page 27: Keynote the grugq   opsec for russians

Violation

Don’t contaminate

Monday, November 19, 12

Page 28: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 29: Keynote the grugq   opsec for russians

Violation

Don’t contaminate

Monday, November 19, 12

Page 30: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 31: Keynote the grugq   opsec for russians

Violation

Keep personal life and hacking separateFREEDOM FIGHTING

Monday, November 19, 12

Page 32: Keynote the grugq   opsec for russians

ProTip: Don’t connect to your target directly from your home IP address

Monday, November 19, 12

Page 33: Keynote the grugq   opsec for russians

Violation

Never operate from your home

Monday, November 19, 12

Page 34: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 35: Keynote the grugq   opsec for russians

Violation

Never operate from your home

Monday, November 19, 12

Page 36: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 37: Keynote the grugq   opsec for russians

Violation

Don’t reveal operational details

Monday, November 19, 12

Page 38: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 39: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 40: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 41: Keynote the grugq   opsec for russians

Violation

Don’t reveal operational details

Monday, November 19, 12

Page 42: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 43: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 44: Keynote the grugq   opsec for russians

Violation

Be paranoid

Monday, November 19, 12

Page 45: Keynote the grugq   opsec for russians

Virus (10:30:18 PM): don't start accusing me of [being an informant] - especially after you disappeared and came back offering to pay me for shit - that's fed tacticsVirus (10:30:31 PM): and then your buddy, topiary, who lives in the most random placeVirus (10:30:36 PM): who's docs weren't even publicVirus (10:30:38 PM): gets ownedSabu (10:32:29 PM): offering to pay you for shit?Virus (10:32:55 PM): yeah, you offered me money for "dox"Virus (10:33:39 PM): only informants offer up cash for shit -- you gave yourself up with that one

Monday, November 19, 12

Page 46: Keynote the grugq   opsec for russians

HAPPY ENDING

Virus is still free

Monday, November 19, 12

Page 47: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 48: Keynote the grugq   opsec for russians

Violation

Never contaminate

Monday, November 19, 12

Page 49: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 50: Keynote the grugq   opsec for russians

Bonus: w0rmerMonday, November 19, 12

Page 51: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 52: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 53: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 54: Keynote the grugq   opsec for russians

Techniques

Monday, November 19, 12

Page 55: Keynote the grugq   opsec for russians

Plumbing

Monday, November 19, 12

Page 56: Keynote the grugq   opsec for russians

It is boring.

Monday, November 19, 12

Page 57: Keynote the grugq   opsec for russians

You’ll know it worked if nothing happens.

Monday, November 19, 12

Page 58: Keynote the grugq   opsec for russians

Put it in place first.

Monday, November 19, 12

Page 59: Keynote the grugq   opsec for russians

Paranoia doesn’t work retroactively

Monday, November 19, 12

Page 60: Keynote the grugq   opsec for russians

Personas

Monday, November 19, 12

Page 61: Keynote the grugq   opsec for russians

Spiros: He knows my name, but my name is not my name. And you... to them you're only "The Greek."The Greek: And, of course, I'm not even Greek.

Monday, November 19, 12

Page 62: Keynote the grugq   opsec for russians

Problem: You are you.

Monday, November 19, 12

Page 63: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 64: Keynote the grugq   opsec for russians

Solution: Be someone else.

Monday, November 19, 12

Page 65: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 66: Keynote the grugq   opsec for russians

Personas

• Danger to personas is contamination

• Contact between personas (covers) contaminates both

• Keep cover identities isolated from each other

Monday, November 19, 12

Page 67: Keynote the grugq   opsec for russians

Layered defense

Monday, November 19, 12

Page 68: Keynote the grugq   opsec for russians

• Fail safe technological solution

• TOR all the things!

• Back stop persona

• Primary cover alias as first identity

• Secondary cover aliases (eg. handles)

Monday, November 19, 12

Page 69: Keynote the grugq   opsec for russians

Profiling data

Monday, November 19, 12

Page 70: Keynote the grugq   opsec for russians

• Location revealing information

• Weather

• Time

• Political events

• Profiling data

Pitfalls

Monday, November 19, 12

Page 71: Keynote the grugq   opsec for russians

Practice

Amateurs practice until they get it right

Professionals practice until they can’t get it wrong

Monday, November 19, 12

Page 72: Keynote the grugq   opsec for russians

Stringer: What you doing?Shamrock: Robert's Rules says we got to have minutes of the meeting. These the minutes.Stringer: Nigga, is you taking notes on a criminal fucking conspiracy?

Monday, November 19, 12

Page 73: Keynote the grugq   opsec for russians

No logs. No crime.

Monday, November 19, 12

Page 74: Keynote the grugq   opsec for russians

Staying AnonymousMonday, November 19, 12

Page 75: Keynote the grugq   opsec for russians

Personal info is profiling info

Monday, November 19, 12

Page 76: Keynote the grugq   opsec for russians

Anti-Profiling Guidelines

• Do not include personal information in your nick and screen name.

• Do not discuss personal information in the chat, where you are from...

Monday, November 19, 12

Page 77: Keynote the grugq   opsec for russians

Anti-Profiling Guidelines

• Do not mention identifying details, e.g. your gender, tattoos, piercings or physical capacities

• Do not mention your profession, hobbies, involvement in political/activist groups

Monday, November 19, 12

Page 78: Keynote the grugq   opsec for russians

Anti-Location Profiling Guidelines

• Do not use special characters on your keyboard unique to your language

• Do not keep regular hours / habits (this can reveal your timezone, geographic locale)

• Do not discuss the environment, e.g. weather, political activities, etc

• Don’t talk about the weather!

Monday, November 19, 12

Page 79: Keynote the grugq   opsec for russians

Anti Contamination Guidelines

• Do not use Twitter and Facebook

• Never post links to Facebook images.

• Do not post informations to the regular internet while you are anonymous in IRC.

Monday, November 19, 12

Page 80: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 81: Keynote the grugq   opsec for russians

Hackers are no longer the apex predator

FREEDOM FIGHTERS

Monday, November 19, 12

Page 82: Keynote the grugq   opsec for russians

That position has been ceded to LEO

*Law Enforcement Officials

*

Monday, November 19, 12

Page 83: Keynote the grugq   opsec for russians

Technology

Monday, November 19, 12

Page 84: Keynote the grugq   opsec for russians

• Operations Platform

• Console for accessing your staging box

• Staging Platform / Launch Pad

• Box with attack tools

• Bounces

• Reach your target objectives without leaving a trail

Monday, November 19, 12

Page 85: Keynote the grugq   opsec for russians

Operations Platform

Monday, November 19, 12

Page 86: Keynote the grugq   opsec for russians

• Essentially a modern VT100

• Provides access to operational resources

• Non incriminating, ideally dual use, device

• RaspberryPi, AllWinner miniPC, etc.

Monday, November 19, 12

Page 87: Keynote the grugq   opsec for russians

+

+ =

Monday, November 19, 12

Page 88: Keynote the grugq   opsec for russians

Operations Box

Monday, November 19, 12

Page 89: Keynote the grugq   opsec for russians

Staging Platform

Monday, November 19, 12

Page 90: Keynote the grugq   opsec for russians

• Jump box

• The first stop from the operations platform

• Not used directly for attacks, this is $HOME

• Storage for logs, data and tools

Monday, November 19, 12

Page 91: Keynote the grugq   opsec for russians

Launch Pad

Monday, November 19, 12

Page 92: Keynote the grugq   opsec for russians

• Used for launching attacks

• Disposable

• Maybe in China?

Monday, November 19, 12

Page 93: Keynote the grugq   opsec for russians

>_

$HOME lp

Monday, November 19, 12

Page 94: Keynote the grugq   opsec for russians

Bounces

Monday, November 19, 12

Page 95: Keynote the grugq   opsec for russians

VPNs vs. TOR

• VPNs provide privacy

• TOR provides anonymity

• Confuse the two at your peril

Monday, November 19, 12

Page 96: Keynote the grugq   opsec for russians

• TOR connection to a VPN => OK

• VPN connection to TOR => GOTO JAIL

Monday, November 19, 12

Page 98: Keynote the grugq   opsec for russians

On Bitcoins

• Bitcoins are anonymous, not private

• They can be traced

• Unique, uncontaminated, wallet per cover

• Use mixers to sanitize BTC

Monday, November 19, 12

Page 99: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 100: Keynote the grugq   opsec for russians

Fail closed

Monday, November 19, 12

Page 101: Keynote the grugq   opsec for russians

PORTALPersonal Onion Router To Assure Liberty

Monday, November 19, 12

Page 102: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 103: Keynote the grugq   opsec for russians

PORTAL

• Router ensuring all traffic is transparently sent over TOR

• Reduce the ability to make mistakes

• Use mobile uplink

• Mobility (go to a coffee shop)

• Reduce risk of wifi monitoring

Monday, November 19, 12

Page 104: Keynote the grugq   opsec for russians

PORTAL

• Uses tricks to get additional storage space on /

Monday, November 19, 12

Page 105: Keynote the grugq   opsec for russians

Hardware

• TP-LINK AR71xx personal routers

• MR-11U

• MR-3040

• MR-3020

• WR-703N

Monday, November 19, 12

Page 106: Keynote the grugq   opsec for russians

MR-3040 & MR-11U

• Battery powered

• Approx. 4-5 hrs per charge

• USB for 3G modem

Monday, November 19, 12

Page 108: Keynote the grugq   opsec for russians

Conclusion

Monday, November 19, 12

Page 109: Keynote the grugq   opsec for russians

STFU

Monday, November 19, 12

Page 110: Keynote the grugq   opsec for russians

Monday, November 19, 12

Page 111: Keynote the grugq   opsec for russians

If you hack, don’t speakIf you speak, don’t writeIf you write, don’t signIf you sign, don’t be surprised

Monday, November 19, 12