When "clever" cybercriminals get caught

Hey /sec/. It seems that almost everytime a big name cybercriminal is caught by law enforcement, it's always due to some egregious security mistake that anyone with a couple of working neurons shouldn't make - reusing usernames/mail addresses, getting tricked into sharing personal info, failing to use Tor. I'm aware that there are plenty of ways for someone to fuarrrk up and that criminals can be caught even if they don't actually fuarrrk up if LE decides to burn a 0 day or something, but I don't think that I have ever heard of anyone who got caught in such a way except for that one Tails exploit that Facebook paid for because the guy was literally admitting to crimes there or something along these lines. Do /sec/ lains know of any such examples? If so, please do share.

>>21229 Not sure I understood you. Did you mean caught by exploit or by using actual maintainers/developers via blackmail/bribery/etc? Or it doesn't matter? Both ways it will highly depend on country and\or willingness of devs to cooperate. Also not sure it fit there, but the first thing I though of was PirateBay the first time they were shut down and all similar stories, though since that many things'v changed and those torrents trackers and such sites found ways to overcome this one way or another. And I don't know that any of that platforms were caught since that.

It's possible that the federal government has some deep backdoor built into the architecture of tor - after all, they designed it - that they use to determine who the criminal really is, then they start monitoring that person very closely until there's some sort of minor opsec slip up that the government can use as a pretext for how they unmasked that person, while keeping the actual tor backdoor a secret.

When criminals are cought its usually due to incomptence/negligence/freak chance or because the authorities want to catch them. >>21235 The fbi is corrupt as hell, they will do anything they can that suits their agenda, usually hackers causing mischif is a good thing for them stir up soykaf and they can put on a big show for no reason and collect the tax money. Also remember corruption runs on all levels of the gov, anyone one of them will do what is most profitable to them since the days of hoover.

>>21233 Doesn't matter, as long as they didn't get caught due to stupidity. It could even be an opsec mistake, as long as it's subtle like i.e. correlation of interests or something along these lines.

>>21235 Wrong and irrelevant. Personally when I do my thing, I take precautions such that even with 100% surveillance of every cable in the world, a backdoor into every processor and cryptographic algorithm, and 24/7 high resolution aerial surveillance, I cannot be caught unless my physical location is deobfuscated and I am pursued in realtime. If these variables are not accounted for and the failure of a single tool is enough to sink someone, then you have what the kids call a 'skill issue'.

>cybercriminal >big name Man.... Haven't you spotted the common linking factor here yet? What component of these peoples' operations do you think allows them to be a focus of investigation in the first place? C'mon, I gave you a hint already, can't you figure it out?

>>21241 Which means you don't use networks or use only local private networks (lorawan, wifi, anything really), or maybe you use someone else's networks, how far from the truth am I? The problem is that this conditions you mentioned: >100% surveillance of every cable in the world >a backdoor into every processor >cryptographic algorithm makes it impossible any network that has bridges or overlays through www. Even more, you basically can't trust any processor in the last N years, probably that means you can use only diy machines.

>>21241 I would just like to throw out there that terrorists have been caught because their security was too good. Also every contact leaves a trace. Behavior that is too unique is targetable. You don't even know half of the technology that is out there. Most people get caught because it only takes one mistake. It is the inverse of the criminal: Security has to get it right every time, an attacker only has to succeed once.

>>21235 Okay, I have to chime in here, because I recall a Defcon talk given by one of the leads behind Tor. Good luck finding the link for it - I can't be bothered. He mentioned this exact argument against Tor and his response was something like: "The [government] didn't make Tor, *I* made Tor." and then the audience applauded. Also it's subject to heavy research and funding etc etc. So, you know, *maybe*, but highly unlikely. Tor is one of the real ones.

>>21245 A little tired of talk about Tor, but that's all the anonymity research i've read talking. There is no (hidden) vulnerability. There are a handful of exploitable vulnerabilities in Tor, and they are have been publicly known since even before the dang thing was implemented. I've even seen some powerpoint slides that Roger Dingledine (the dude who made Tor) made as a student, where he highlights these vulnerabilities and their mitigations (which were too expensive to justify at the turn of the century). Roughly every ~3 seconds count up the lengths of all IP datagrams for the uplink/downlink of every Tor user by monitoring an ISP as close as possible to every guard relay. Do the same thing for the stream of interest- this does not even require measurement of an exit node. If the server/network that the user connects to is doing high enough resolution logging, you can get this same information about the exit stream. Compare every ~3 second interval for up/down between the data collected for the entry stream and the exit stream. The user(s) who match the most of these intervals are the users of interest. Keep collecting as many of their streams as possible to minimize the likelihood of false positives. There you go, that's it. You didn't need to compromise a single relay operator, a single hosting provider, steal a single key, launch a single supply chain attack, burn a chain of expensive 0-days, or perform long-term espionage. You just needed to read the length field of a few IP datagrams. This is relatively easy to beat, but too expensive for volunteers. You would need to alter the Tor source code to emit some believable-looking stream of 'padding' cells to your guard relay constantly with some bandwidth a good bit higher than the stream you're looking to hide. The guard relay also needs to be configured to allow this and drop these packets. Then the client's Tor needs to simply swap out dummy cells with proper cells whenever it is used to send real data instead of fake data. The real cells would actually be forwarded across a Tor circuit, but the entry stream would would not match the exit stream. The most effective way to do this would be to have everyone do this all of the time- imagine, 1 million Tor users all uploading and downloading 1mb/s to the ~1000 guard relays. 24/7. 365 days a year. Even if you pay 0.02 USD for every 1 Gigabyte of traffic, each guard would be receiving 1gigabit/s all day, so you would need 0.02 * 0.125 * 60 * 24 * 365 = $1314 per year or $109.50 per month to run a guard relay and provide 1megabit to everyone, minimum. This ignores that you will also need to forward some % of that traffic, because some traffic will actually be non-fake.

>>21246 I forgot to multiply by an extra 60 to account for the number of minutes in an hour. The cost of an extremely anonymous Tor network for all is at least $6570 a month per guard relay, given providing 1mb symmetric to all. The cost would be orders of magnitude lower if you were just 'smoothing out' user streams to remove small, unique fluctuations. They should do that.

Police always boasts about their wins and hushes down their losses. Just like Ancient Egypt did with their wars. Also survivorship bias (those really REALLY good that actually never get caught)