(untitled)

This dude had the worst opsec ever. Repeatedly accessed RaidForums with his real IP, even asked omnipotent if a certain leak was incomplete because he couldn't find his info in it. He signed up for IntelligenceX with his real IP, and when he compromised .edu emails to get premium access to the site he would use it to search the personal emails of himself and his mom. One of his personal emails and soykafty password was caught in the inboot.me ddos website leak. Did a lot of soykaf on a goddamn windows 10 machine, had zero separation of his real identity and his dubious online shenanigans. This is a perfect case study in what complete absence of OPSEC can do.

You didn't even mention his more severe mistakes: 1) Using the same name in public for more than a day 2) Talking in public when not absolutely required 3) Not setting up firewall rules to prevent IP leakage in the first place 4) Not physically changing his location to cope with the failure of aforementioned software rules

>>21204 Why do you think he messed up his own security so bad? I'm genuinely curious how someone as (seemingly) knowledgeable as him wouldn't know how to stay anonymoous on the web

>>21204 Seems that there are five types of blackhats: The garden variety ones who constantly intermingle their personas with their legal personas. Probably hack for ego, probably possible to dox purely by OSINT, they download popular scripts and pay for the tools of the hour to inflate their sense of self-importance. They use free VPNs and other honeypot services marketed at them by the CIA so that intel agencies can hide behind petty criminals. They are after your Minecraft account. Most of their time is spent trying to convince each other to download crappy malware. The moderately intelligent thieves and sometimes decent hackers, this is the domain we're talking about when it comes to cracking forums like Breached. They have learned from the mistakes of the skiddies and usually have some set of precautions using proven technologies, but still have a tendency to do many hacks under the same name and still have a bit of an ego. These guys often don't take their safety very seriously because they are lazy or have some cope like thinking their country's feds will hire them, or more often than not they just think they are small fish and pray that only the big fish get hunted. Their mistakes chip away at the 33 information-theoretic bits of information needed to identify them such that the intersection of their various non-universal characteristics, across many open and private databases, eventually burn them after some years. They take much longer to catch in poorer countries. A combination of the last two, but sponsored by their government so they effectively become 'privateers' instead of pirates. This is like, russian ransomware f4gg0t$, Guccifer 2.0, whatever. They do whatever they want as long as their government approves, and in exchange they can't be arrested. The corporate category, effectively mercenaries, that sell tracking and spyware tools and services to governments so that their oligarchs can kill people they dislike. This means exploit brokers, hacking as a service, specially tailored malware, or even just tools meant for operating on huge amounts of human data for the purpose of tracking. These guys are generally older and more mature than category #2, and are afraid of being caught so they just sell their services to the people who would otherwise have caught them. Then you have those that take a more scientific approach to anonymity. This is like those romanian guys who ran a massive operation with botnets and mass thievery for over 16 years- even when police had bugged their meeting places, they had a routine of turning up the noise on their radio so they could not be overheard. People who use dedicated machines at dedicated locations, who tunnel their connections multiple kilometers away through chains of wireless routers, then through their own nodes over the internet. Those who do not interact in public, who overestimate their adversaries and assume their immediate deaths upon detection. They know that ever layer of the stack needs at least 2-3 protection mechanisms, and they constantly work to minimize their physical+social+digital attack surface. This is the type that attacks category #4 and gets away with it (https://theanarchistlibrary.org/library/phineas-fisher-hackback-a-diy-guide-ii). Be this guy please.

>>21206 The hackers that are actually skilled and knowledgeable are the ones who don't get caught. AVUnit is a good example of this. I also recommend you look at the affidavit the FBI agent arresting him wrote. It details pretty much all the mistakes he made. It was originally linked by InteligenceX's twitter but they got suspended, their tweets are still in my RSS feed though. https://storage.courtlistener.com/recap/gov.uscourts.vaed.535542/gov.uscourts.vaed.535542.2.0.pdf >>21205 Changing your name all the time sounds pretty stupid. After all, if your separation of your identity is good then your real life identity is just some dude, right? As for talking, he absolutely should have shut up when he was arrested. Rule 0 of talking to police is you don't talk to police, only a lawyer. He made so many mistakes, I wish I could have listed them all here lol *THE POMPOMPURIN MEGATHREAD* hehehe

>>21208 I think you put it pretty well here. The first kind are all over Instagram, Twitter and Discord. Ethical hacking discords are constantly being bombarded by fuarrrkwads who are all "plez heck me roblocks account backk"