Keynote The Grugq

OPSEC for hackers:
because jail is for

wuftpd
the.grugq@gmail.com
Monday, November 19, 12

Overview
Intro to OPSEC
Methodology
lulzsec: lessons learned
Techniques
Technology
Conclusion
Avon:You only got to fuck up once Be a little
slow, be a little late, just once. How you
aint gonna never be slow? Never be late?
You cant plan for that. Thats life.

Intro
to
OPSEC

WTF is it?

OPSEC in a nutshell
Keep your mouth shut

Guard secrets
Need to know
Never let anyone get into position to
blackmail you

STFU

Methodology

put the plumbing in first
create a cover (new persona)
work on the legend (history, background,
supporting evidence for the persona)
Create sub-aliases
NEVER CONTAMINATE
FREEDOM
The 10 Hack
FIGHTING
Commandments

Rule 1: Never reveal your operational
details
Rule 2: Never reveal your plans

Rule 3: Never trust anyone
Rule 4: Never confuse recreation and
hacking FIGHTING
FREEDOM
Rule 5: Never operate from your own

house

Rule 6: Be proactively paranoid, it doesnt work
retroactively
FREEDOM
Rule 7: Keep personal life and hacking
FIGHTING
separated
Rule 8: Keep your personal environment

contraband free
Rule 9: Dont attract attention

Rule 10: Don't give anyone power over you
Why do you need
OPSEC?

ProTip: Cover the webcam on your laptop.

It hurts to get fucked

No one is going to go
to jail for you.

Your friends will betray
you.

#lulzsec:
lessons learned
Violation
Never trust anyone

ProTip: Dont use your personal Facebook account
to send defacement code to your friends
FREEDOM FIGHTERS

ProTip: Dont use your real first name as your
username
Violation
Dont contaminate

Violation
Dont contaminate

Violation
Keep personal life and
FREEDOM
hacking
FIGHTING separate

ProTip: Dont connect to your target directly from your
home IP address

Violation
Never operate from
your home

Violation
Never operate from
your home

Violation
Dont reveal
operational details

Violation
Dont reveal
operational details

Violation
Be paranoid

Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics
Virus (10:30:31 PM): and then your buddy, topiary,
who lives in the most random place
Virus (10:30:36 PM): who's docs weren't even public
Virus (10:30:38 PM): gets owned
Sabu (10:32:29 PM): offering to pay you for shit?
Virus (10:32:55 PM): yeah, you offered me money for
"dox"
Virus (10:33:39 PM): only informants offer up cash
for shit -- you gave yourself up with that one

HAPPY ENDING
Virus is still free

Violation
Never contaminate

Bonus: w0rmer
Techniques

Plumbing

It is boring.

Youll know it worked if
nothing happens.

Put it in place first.

Paranoia doesnt work
retroactively

Personas
Spiros: He knows my name, but my name is
not my name. And you... to them you're
only "The Greek."
The Greek: And, of course, I'm not even Greek.

Problem:
You are you.

Solution:
Be someone else.

Personas
Danger to personas is contamination

Contact between personas (covers)
contaminates both
Keep cover identities isolated from each
other

Layered defense

Fail safe technological solution
TOR all the things!
Back stop persona
Primary cover alias as first identity
Secondary cover aliases (eg. handles)

Profiling data

Pitfalls
Location revealing information

Weather
Time
Political events
Profiling data

Practice
Amateurs practice until they get

it right
Professionals practice until they
cant get it wrong

Stringer: What you doing?
Shamrock: Robert's Rules says we got to
have minutes of the meeting.
These the minutes.
Stringer: Nigga, is you taking notes on a
criminal fucking conspiracy?

No logs. No crime.

Staying Anonymous
Personal info is profiling
info

Anti-Profiling
Guidelines
Do not include personal information in

your nick and screen name.
Do not discuss personal information in the
chat, where you are from...

Anti-Profiling
Guidelines
Do not mention identifying details, e.g. your
gender, tattoos, piercings or physical
capacities
Do not mention your profession, hobbies,
involvement in political/activist groups

Anti-Location Profiling
Guidelines
Do not use special characters on your
keyboard unique to your language
Do not keep regular hours / habits (this can
reveal your timezone, geographic locale)
Do not discuss the environment, e.g.
weather, political activities, etc
Dont talk about the weather!
Anti Contamination
Guidelines
Do not use Twitter and Facebook

Never post links to Facebook images.
Do not post informations to the regular
internet while you are anonymous in IRC.

Hackers are no longer
FREEDOM
FIGHTERS
the apex predator

That position has been
ceded to LEO *
*Law Enforcement Officials

Technology

Operations Platform
Console for accessing your staging box
Staging Platform / Launch Pad
Box with attack tools
Bounces
Reach your target objectives without
leaving a trail

Operations Platform

Essentially a modern VT100
Provides access to operational resources
Non incriminating, ideally dual use, device
RaspberryPi, AllWinner miniPC, etc.

+
+ =
Operations Box

Staging Platform

Jump box
The first stop from the operations
platform
Not used directly for attacks, this is

$HOME
Storage for logs, data and tools

Launch Pad

Used for launching attacks
Disposable
Maybe in China?

$HOME lp
>_

Bounces

VPNs vs. TOR
VPNs provide privacy

TOR provides anonymity
Confuse the two at your peril

TOR connection to a VPN => OK
VPN connection to TOR => GOTO JAIL

On VPNs
Only safe currency is Bitcoins
Because they come from nothing
Purchase only over TOR
http://torrentfreak.com/which-vpn-
providers-really-take-anonymity-
seriously-111007/

On Bitcoins
Bitcoins are anonymous, not private

They can be traced
Unique, uncontaminated, wallet per cover
Use mixers to sanitize BTC

Fail closed

PORTAL
Personal Onion Router To Assure Liberty

PORTAL
Router ensuring all traffic is transparently
sent over TOR
Reduce the ability to make mistakes
Use mobile uplink
Mobility (go to a coffee shop)
Reduce risk of wifi monitoring
PORTAL
Uses tricks to get additional storage space

on /

Hardware
TP-LINK AR71xx personal routers

MR-11U
MR-3040
MR-3020
WR-703N

MR-3040 & MR-11U
Battery powered
Approx. 4-5 hrs per charge
USB for 3G modem

http://grugq.github.com/
portal

Conclusion

STFU

If you hack, dont speak
If you speak, dont write
If you write, dont sign
If you sign, dont be surprised

Keynote The Grugq

Uploaded by

Copyright:

Available Formats

Keynote The Grugq

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Keynote The Grugq

Uploaded by

Copyright:

Available Formats

OPSEC for hackers:

because jail is for

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Keep your mouth shut

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Rule 2: Never reveal your plans

Rule 5: Never operate from your own

Monday, November 19, 12

Rule 8: Keep your personal environment

Rule 9: Dont attract attention

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Danger to personas is contamination

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Location revealing information

Monday, November 19, 12

Amateurs practice until they get

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Monday, November 19, 12

Do not include personal information in

Monday, November 19, 12