Anonimity

Does anyone here have material on how people are caught? Methods used(by the state, not skiddies doxxing each other) to break the anonymity of others, etc? Searching for methods of anonymizing yourself yields the cheap results, what i'm looking for is more towards edge cases when the state is targeting a specific person or demographic, what tools do they use and how accurate can they be etc.. That HOPE panel* is a good example, anything along those lines would be great, even better if it's more in depth than that. * https://www.youtube.com/watch?v=FHwl6AyL6js

Mostly because anonmyzing yourself is simple, i2p, tor, vpn (that you can trust), good opsec.

>>6183 This thread isn't about that.

People get caught mostly via bad opsec find some starting information than build on it here is a good tool for build on already found info https://inteltechniques.com/menu.html

a popular method I also keep seeing is calling a ISPs asking for info https://www.dailydot.com/layer8/dox-doxing-protection-how-to/

Subpoenas. To email providers, ISPs, VPN providers, etc. Any kind of log is useful - from IRC chats to VPN connection logs. People also tend to do things like think a burner phone is a meaningful protection against law enforcement - they will find out the store you bought it in and go and subpoena them for CCTV or any other records. People also regularly get sold out by their partners-in-crime or ex-lovers or whatever. The main mechanism people fuarrrk up is thinking that the state is somehow stymied by corporations, that your telco or VPN company will bother to find legal requests from the police (abso-fuarrrking-lutely not), or believe people who say they won't log, or just somehow think they're smarter than cops. People also have egos, and don't do the obvious thing - the more moving parts to a plan, or the more you interact with services or others, the more evidence you generate. The reality is, cops use every technique skids use to dox each other (including maltego), but they also have the power to legally compel anyone or anything a criminal touches to tell them exactly what went on, and they also have access to technical experts (real ones, not like most of the LARPers on here) to help them assess any relevant data.

Maybe i wasn't clear enough in the first post, but the idea of this thread is to provide material on the subject, not conjecture. Anyone here can imagine how people are caught, i'm not talking about that. I'm talking about the perspective either from people on the inside (HOPE conference guy, journalists, infosec people who researched on the subject, etc.. ) Articles, people talking about how they got busted, anything of the sort. Can you see the difference between that and conjecture? We all know about the cracker who used his personal e-mail by accident or shared a nickname in two forums, this ain't that bruh. I'm not talking about securing an op, i'm talking about, let's say, being a jew in 1940 if germans had widespread internet as we have today, and for that i need real research into how that stuff was done to people, not conjecture. I know you all mean well and i haven't contributed enough material for you to get an idea of what i'm looking for, it's just hard to find really.

>Hacker OpSec >http://grugq.github.io/ Pretty good series analyzing failures of operational security that are publicly documented.

>>6188 If your talking about tracking stuff like catching APT (state actors) it's things like honey pots and digital forensics. After looking at victims of targets, originating from similar malware types and C2 servers,you can build a map and idea who's behind it and why. just google apt attack papers and you will get a methodology on how they (the researchers) did it. if that isn't what you meant still, defcon talk about how tor users were caught https://www.youtube.com/watch?v=7G1LjQSYM5Q hope I helped OP >>6188

I think the best resource on this topic is just to follow the news and search the documents on gov sites after a few days, im not on this subject acctually but i have at least two good examples, being the first one the members of apophis squad which dont exists anymore, maybe you have seen something about atacks on protonmail and bomb threats, the guys failed hard on opsec and you can read about just making a quick search on justice.gov. The second example was somekind old and is about the 'fbiarelosers' they released the complete thing, step by step on how they caught him, i will not describe all here, but i will share the link: https://www.justice.gov/usao-ndil/file/900826/download You can do the same for lots of cases, another good way to know how the people got caught is to study on how darkmarkets got closed, you should read on SilkRoad end and a bonus is to read on FreedomHost owner arrest. I hope some of this give you some guideline.

>>6190 the grugq rules if you can stand using the terrible platform that is medium, i recommend his writings there - it's up to date

>>6188 the first reply answered your question accurately. silk road, lulzsec, etc etc etc were caught by making old-fashioned opsec errors, i.e. general stupidity, snitches, or carelessness, not by advanced, super-sophisticated hi-tech magic like in the movies/tv.

There's some good defcon talks on this like the Zoz one for example.

>>6187 this reply is off-topic >not like most of the LARPers on here) like you

Do you know that there are actually state actors actively searching for you? Get off the net, get rid of your phone. They'll keep at it until you slip—it's definitely safest and you shouldn't play games with this. If you just have a vague, ambient paranoia about it, then yeah follow the other advice. They probably don't care about you.

>>9173 >They probably don't care about you i get sick of seeing people trying to downplay what we know now is very common. a lot of people that ask for this kind of advice may indeed have state actors actively pursuing or at least monitoring them. bolivians, HKers, chileans, brazilians are all facing this kind of active monitoring. there are cases of it recently happening with activists in the US, germany, and france, as well. >Do you know that there are actually state actors actively searching for you? Get off the net, get off your phone. if activists get off the net they are even more vulnerable. you are the reason the internet is like kicking dead whales down the beach, *you* get off the net. stop giving advice, it's obvious you understand fuarrrkall.

hey lain, here's some good info, and something that i've been studying recently. It's called " Author Attribute Anonymity," "noise injection," and "data pollution." This has been a recurrent thought of mine for some time now, just today i came across some good soykaf: https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-shetty.pdf (A4NT: Author Attribute Anonymity by Adversarial Training of Neural Machine Translation) https://cariagiovannib.wordpress.com/2019/09/27/ricerca-noise-injection-per-la-protezione-della-privacy/ https://github.com/essandess/isp-data-pollution Even if you're setup with a cool setup like a dedicated laptop private radio mesh to hidden iot network gateway, tor, etc. need to find ways to guarantee that no one can track you according to your browsing behavior and way you write. must be always mindful of ways your activity can be correlated over time. if you find yourself in a situation where you have panopticon-like adversaries with a regional monopoly of force and justice be careful with subtleties. good advice ive seen from grugq (he's got some great vids and articles) is the generation of multiple identities. he teaches how to manage them. it's important to try to silo your politically controversial behavior in one of your (at least 3) identities. try not to cross content and website accesses for these identities. the actual generation of these identities is important for you the user because it creates the mental model necessary to prevent the crossing of content.

I have a great material of a guy that wasn't caught. https://pastebin.com/GrV3uYh5

>>6182 >(by the state, not skiddies doxxing each other) you just called yourself a skid. as said ITT all documented cases are just the user being an idiot.

>>9174 I'm not talking about actual activists, yes of course they have legitimate worries. I'm talking about paranoid channers. Not especially much overlap I think. lol how does getting off the net make you more vulnerable? If you think a state actor is watching you, minimizing your activity is absolutely sound advice. It isn't quite as fun to pretend you're a hacker or whatever when you do that but c'mon, let's not be cute.

>>9197 minimize is not the same as 'get off the net.' should one change their behavior? perhaps. though not in a way that is easily observable. Cutting off, diminishing, or changing activity is not a good idea. As I said, you should stop giving advice about this for now. You're a walking example of Dunning-Kruger, sorry to be harsh. It's better to try to keep your digital activity constant, or even reverse yourself and try to appear 'reformed' or back in line. While also adding gain to the models about you by automating activity in fake interests and the like, see links here >>9175 . I've never used automation to do this, but I am stoked to start twerking with it to see what happens. about how to proceed, i'll just do what i have learned how to do best

>>9198 Hey, suit yourself. Remember that everyone thinks they're slick and clever as a fox—until they get caught. It's nice that you learned about that one psychological bias that literally everyone on reddit has been telling each other about non-stop for the past like five years. I don't see why you think cutting off activity would be a bad idea; why you have to keep your activity 'constant.' Getting offline isn't illegal. If they already are watching you they probably already have some data points. Might not want to keep feeding them more. Especially with posts like this on the clearnet explaining your plans? Using some noise generators isn't a bad idea, though, and is pretty standard even for people who just want to shake off advertising.

>>6182 https://eldritchdata.neocities.org/TXT/Sec+/DoxingIntroAndMethodology.txt Article // blog post about doxing and the process.

* https://www.wired.com/story/confessions-marcus-hutchins-hacker-who-saved-the-internet/ Fitting wired article about how the FBI caught Marcus Hutchins and his whole experience. The tools are mostly time and data/information. It's rarely some fancy exploit or technology when the usual stuff makes tried and true methods so much easier. The people who get caught up in this world aren't always who you think, and the ones they look for can change on a dime. Look at how long they sat on dirt about Marcus until the opportunity arose.

>>6183 tor alone does not anonymize you lol

Remember lulzsec? And sabu got caught and ratted on the others I think? Does anyone know how they got him in the first place?

>>11101 They got him because he reused nicknames like a dumbass, and there was already (allegedly) connections on his part from his home IP address Apparently he claims that he never did that, and that the feds instead found his personal info because he was doxxed on efnet a couple of years prior, I'm not too sure when or why.

>>10328 404, got another link/re-up?

>>11113 This link seems to work https://eldritchdata.neocities.org/Sec/DoxingIntroAndMethodology.html Lean to go into main directory next time before you ask.

>>11083 Why did they wait? They should have already known where he lived. Were they waiting for him to do something more? I think that was bad timing for them as he got less time because of it

>>11101 Official story is he forgot to turn on TOR when connecting to the IRC at one point. I find it interesting how the official story of how cybercriminals get caught always points to some easily avoidable mistake. See also Marcus Hutchins sharing personal info or Ross Ulbricht reusing usernames. Either the official story is frequiently a lie to cover up some kind of surveillance mechanisms the state has Or practicing good opsec consistently is so much harder than it seems and as a matter of time, eventually security-conscious people make dumbass opsec mistakes, and one mistake is enough to get booked

>>11128 1. He lived in the UK. The US three-letter-agencies aren't gonna kick down doors in the UK unless in very exceptional circumstances (Megaupload was apparently sufficiently exceptional to warrant door-kicking in NZ) 2. He may not have been high-profile enough to warrant constant monitoring, so he could've visited and left the US after his crimes but before wannacry, just because of the FBI allocating resources differently while he was visiting. After wannacry he was famous and during defcon, the FBI was informed via social media that Hutchins was in the States, so they can allocate more resources because they have an opportunity.

>>11133 Another way of viewing it is that with enough precautions, government entities really don't have any way to get to you until you fuarrrk up on your own. For all these criminal minds who were caught, there are orders of magnitude more who have managed to stay off the radar. But still, it's a matter of time before anyone makes such a small, fatal mistake.

I think everyone here knows the story of ross ulbricht, but it is worth re-telling. He was caught basically because he marketed his website on other forums. The first posts about silk road were all done under one pseudonym "Altoid" and they were all like "hey guys did you see this site" type of soykafty marketing that wouldn't fly today. In the end that was the first real connection to his identity. Next, he would breadcrum his soykafty ideology everywhere, even on Linkedin, talking about how he wants to change the world and stuff. Even though he used VPN for his forum postings (and VPN gave the IPs of origin which was a caffee to police) the clear connection was when police asked google for his IP logins on gmail. This was an even clearer connection.

>>11101 Speaking of lulzsec, the member Avunit was never found because he was cautious with his opsec. Didn't reveal any sort of personal info to other members, used proxies, etc.

I recently noticed that the darknetstats.com news articles go into a lot of detail describing operational failures, what led to an arrest, etc. Some interesting details: https://www.darknetstats.com/category/news-articles/

https://www.recordedfuture.com/tessa88-identity-revealed/

>>11083 A better article with factual data that doesn't read like a cheap cyberpunk novel: https://krebsonsecurity.com/2017/09/who-is-marcus-hutchins/

>>11268 >use leaked databases to deanonymize leaked database seller spooky >mad lad outright doxes himself on imgur, what a convenient coincidence Meh, this all could have been a one giant ruse set up for these "OSINT" cokesuckers. Actually, they proved nothing, just a bunch of social network accounts with pics of a street gopnik lad in le anonymous mask who allegedly managed to extract databases from giant corporations and sell them on darknet, was he an accomplice of real hackers who done security breach and why would they hire someone like him, or did he come up with fraud scheme to sell fake data on these forums, earned some money in the process whilst these forums usually explicitly enforce escrow service for such risky deals, and was derezzed shortly after therefore not committing any actual crime against corporations but still earning big bux? Overall this "investigation" is nothing compared to what have been done with NTechLab FindFace when it was in public access. You provide a still from 360p porn video filmed in 2000, and it finds all participants with 80% accuracy. His photos and videos are probably all copied from other social network accounts which are not scanned by search engines, osint larpers can't just "google" them, only Russian police which has access to FindFace can. If these accounts were used in his daily life as they supposedly contain his real photos and name, he'd have at least a dozen of listed friends and such.

https://nakedsecurity.sophos.com/2012/12/03/john-mcafee-location-exif/ >"Vice Magazine reporters are indeed with me in Guatemala. Yesterday was chaotic due to the accidental release of my exact co-ordinates by an >unseasoned technician at Vice headquarters. We made it to safety in spite of this handicap. I had to cancel numerous interviews with the press >yesterday because of this and I apologize to all of those affected."