Keynote the grugq opsec for russians

4,462
-1

Published on

0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
4,462
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
105
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

Keynote the grugq opsec for russians

  1. 1. OPSEC for hackers: РУССКИХ because jail is for wuftpd the.grugq@gmail.comMonday, November 19, 12
  2. 2. Overview • Intro to OPSEC • Methodology • lulzsec: lessons learned • Techniques • Technology • ConclusionMonday, November 19, 12
  3. 3. Avon:You only got to fuck up once… Be a little slow, be a little late, just once. How you ain’t gonna never be slow? Never be late? You can’t plan for that. Thats life.Monday, November 19, 12
  4. 4. Intro to OPSECMonday, November 19, 12
  5. 5. WTF is it?Monday, November 19, 12
  6. 6. OPSEC in a nutshell • Keep your mouth shut • Guard secrets • Need to know • Never let anyone get into position to blackmail youMonday, November 19, 12
  7. 7. STFUMonday, November 19, 12
  8. 8. Monday, November 19, 12
  9. 9. Monday, November 19, 12
  10. 10. Monday, November 19, 12
  11. 11. MethodologyMonday, November 19, 12
  12. 12. • put the plumbing in first • create a cover (new persona) • work on the legend (history, background, supporting evidence for the persona) • Create sub-aliases • NEVER CONTAMINATEMonday, November 19, 12
  13. 13. FREEDOM The 10 Hack FIGHTING CommandmentsMonday, November 19, 12
  14. 14. • Rule 1: Never reveal your operational details • Rule 2: Never reveal your plans • Rule 3: Never trust anyone • Rule 4: Never confuse recreation and hacking FREEDOM FIGHTING • Rule 5: Never operate from your own houseMonday, November 19, 12
  15. 15. • Rule 6: Be proactively paranoid, it doesn’t work retroactively FREEDOM • Rule 7: Keep personal life and hacking FIGHTING separated • Rule 8: Keep your personal environment contraband free • Rule 9: Don’t attract attention • Rule 10: Dont give anyone power over youMonday, November 19, 12
  16. 16. Why do you need OPSEC?Monday, November 19, 12
  17. 17. ProTip: Cover the webcam on your laptop.Monday, November 19, 12
  18. 18. It hurts to get fuckedMonday, November 19, 12
  19. 19. No one is going to go to jail for you.Monday, November 19, 12
  20. 20. Monday, November 19, 12
  21. 21. Your friends will betray you.Monday, November 19, 12
  22. 22. #lulzsec: lessons learnedMonday, November 19, 12
  23. 23. Monday, November 19, 12
  24. 24. Violation Never trust anyoneMonday, November 19, 12
  25. 25. ProTip: Don’t use your personal Facebook account to send defacement code to your friends FREEDOM FIGHTERSMonday, November 19, 12
  26. 26. ProTip: Don’t use your real first name as your usernameMonday, November 19, 12
  27. 27. Violation Don’t contaminateMonday, November 19, 12
  28. 28. Monday, November 19, 12
  29. 29. Violation Don’t contaminateMonday, November 19, 12
  30. 30. Monday, November 19, 12
  31. 31. Violation Keep personal life and FREEDOM hacking separate FIGHTINGMonday, November 19, 12
  32. 32. ProTip: Don’t connect to your target directly from your home IP addressMonday, November 19, 12
  33. 33. Violation Never operate from your homeMonday, November 19, 12
  34. 34. Monday, November 19, 12
  35. 35. Violation Never operate from your homeMonday, November 19, 12
  36. 36. Monday, November 19, 12
  37. 37. Violation Don’t reveal operational detailsMonday, November 19, 12
  38. 38. Monday, November 19, 12
  39. 39. Monday, November 19, 12
  40. 40. Monday, November 19, 12
  41. 41. Violation Don’t reveal operational detailsMonday, November 19, 12
  42. 42. Monday, November 19, 12
  43. 43. Monday, November 19, 12
  44. 44. Violation Be paranoidMonday, November 19, 12
  45. 45. Virus (10:30:18 PM): dont start accusing me of [being an informant] - especially after you disappeared and came back offering to pay me for shit - thats fed tactics Virus (10:30:31 PM): and then your buddy, topiary, who lives in the most random place Virus (10:30:36 PM): whos docs werent even public Virus (10:30:38 PM): gets owned Sabu (10:32:29 PM): offering to pay you for shit? Virus (10:32:55 PM): yeah, you offered me money for "dox" Virus (10:33:39 PM): only informants offer up cash for shit -- you gave yourself up with that oneMonday, November 19, 12
  46. 46. HAPPY ENDING Virus is still freeMonday, November 19, 12
  47. 47. Monday, November 19, 12
  48. 48. Violation Never contaminateMonday, November 19, 12
  49. 49. Monday, November 19, 12
  50. 50. Bonus: w0rmerMonday, November 19, 12
  51. 51. Monday, November 19, 12
  52. 52. Monday, November 19, 12
  53. 53. Monday, November 19, 12
  54. 54. TechniquesMonday, November 19, 12
  55. 55. PlumbingMonday, November 19, 12
  56. 56. It is boring.Monday, November 19, 12
  57. 57. You’ll know it worked if nothing happens.Monday, November 19, 12
  58. 58. Put it in place first.Monday, November 19, 12
  59. 59. Paranoia doesn’t work retroactivelyMonday, November 19, 12
  60. 60. PersonasMonday, November 19, 12
  61. 61. Spiros: He knows my name, but my name is not my name. And you... to them youre only "The Greek." The Greek: And, of course, Im not even Greek.Monday, November 19, 12
  62. 62. Problem: You are you.Monday, November 19, 12
  63. 63. Monday, November 19, 12
  64. 64. Solution: Be someone else.Monday, November 19, 12
  65. 65. Monday, November 19, 12
  66. 66. Personas • Danger to personas is contamination • Contact between personas (covers) contaminates both • Keep cover identities isolated from each otherMonday, November 19, 12
  67. 67. Layered defenseMonday, November 19, 12
  68. 68. • Fail safe technological solution • TOR all the things! • Back stop persona • Primary cover alias as first identity • Secondary cover aliases (eg. handles)Monday, November 19, 12
  69. 69. Profiling dataMonday, November 19, 12
  70. 70. Pitfalls • Location revealing information • Weather • Time • Political events • Profiling dataMonday, November 19, 12
  71. 71. Practice Amateurs practice until they get it right Professionals practice until they can’t get it wrongMonday, November 19, 12
  72. 72. Stringer: What you doing? Shamrock: Roberts Rules says we got to have minutes of the meeting. These the minutes. Stringer: Nigga, is you taking notes on a criminal fucking conspiracy?Monday, November 19, 12
  73. 73. No logs. No crime.Monday, November 19, 12
  74. 74. Staying AnonymousMonday, November 19, 12
  75. 75. Personal info is profiling infoMonday, November 19, 12
  76. 76. Anti-Profiling Guidelines • Do not include personal information in your nick and screen name. • Do not discuss personal information in the chat, where you are from...Monday, November 19, 12
  77. 77. Anti-Profiling Guidelines • Do not mention identifying details, e.g. your gender, tattoos, piercings or physical capacities • Do not mention your profession, hobbies, involvement in political/activist groupsMonday, November 19, 12
  78. 78. Anti-Location Profiling Guidelines • Do not use special characters on your keyboard unique to your language • Do not keep regular hours / habits (this can reveal your timezone, geographic locale) • Do not discuss the environment, e.g. weather, political activities, etc • Don’t talk about the weather!Monday, November 19, 12
  79. 79. Anti Contamination Guidelines • Do not use Twitter and Facebook • Never post links to Facebook images. • Do not post informations to the regular internet while you are anonymous in IRC.Monday, November 19, 12
  80. 80. Monday, November 19, 12
  81. 81. Hackers are no longer FREEDOM FIGHTERS the apex predatorMonday, November 19, 12
  82. 82. That position has been ceded to LEO * *Law Enforcement OfficialsMonday, November 19, 12
  83. 83. TechnologyMonday, November 19, 12
  84. 84. • Operations Platform • Console for accessing your staging box • Staging Platform / Launch Pad • Box with attack tools • Bounces • Reach your target objectives without leaving a trailMonday, November 19, 12
  85. 85. Operations PlatformMonday, November 19, 12
  86. 86. • Essentially a modern VT100 • Provides access to operational resources • Non incriminating, ideally dual use, device • RaspberryPi, AllWinner miniPC, etc.Monday, November 19, 12
  87. 87. + + =Monday, November 19, 12
  88. 88. Operations BoxMonday, November 19, 12
  89. 89. Staging PlatformMonday, November 19, 12
  90. 90. • Jump box • The first stop from the operations platform • Not used directly for attacks, this is $HOME • Storage for logs, data and toolsMonday, November 19, 12
  91. 91. Launch PadMonday, November 19, 12
  92. 92. • Used for launching attacks • Disposable • Maybe in China?Monday, November 19, 12
  93. 93. $HOME lp >_Monday, November 19, 12
  94. 94. BouncesMonday, November 19, 12
  95. 95. VPNs vs. TOR • VPNs provide privacy • TOR provides anonymity • Confuse the two at your perilMonday, November 19, 12
  96. 96. • TOR connection to a VPN => OK • VPN connection to TOR => GOTO JAILMonday, November 19, 12
  97. 97. On VPNs • Only safe currency is Bitcoins • “Because they come from nothing” • Purchase only over TOR • http://torrentfreak.com/which-vpn- providers-really-take-anonymity- seriously-111007/Monday, November 19, 12
  98. 98. On Bitcoins • Bitcoins are anonymous, not private • They can be traced • Unique, uncontaminated, wallet per cover • Use mixers to sanitize BTCMonday, November 19, 12
  99. 99. Monday, November 19, 12
  100. 100. Fail closedMonday, November 19, 12
  101. 101. PORTAL Personal Onion Router To Assure LibertyMonday, November 19, 12
  102. 102. Monday, November 19, 12
  103. 103. PORTAL • Router ensuring all traffic is transparently sent over TOR • Reduce the ability to make mistakes • Use mobile uplink • Mobility (go to a coffee shop) • Reduce risk of wifi monitoringMonday, November 19, 12
  104. 104. PORTAL • Uses tricks to get additional storage space on /Monday, November 19, 12
  105. 105. Hardware • TP-LINK AR71xx personal routers • MR-11U • MR-3040 • MR-3020 • WR-703NMonday, November 19, 12
  106. 106. MR-3040 & MR-11U • Battery powered • Approx. 4-5 hrs per charge • USB for 3G modemMonday, November 19, 12
  107. 107. http://grugq.github.com/ portalMonday, November 19, 12
  108. 108. ConclusionMonday, November 19, 12
  109. 109. STFUMonday, November 19, 12
  110. 110. Monday, November 19, 12
  111. 111. If you hack, don’t speak If you speak, don’t write If you write, don’t sign If you sign, don’t be surprisedMonday, November 19, 12

×