Skip to content
Hallway
0:00 / 0:00

#opsec#tor#vpn

#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd

Hack In The Box Security Conference

21K subscribers • 2 videos on Hallway

YouTube
  • Recommended by 9 people: 9 on Hacker News.
  • A classic. People kept recommending it from 2013 to 2024.
  • Presented by The Grugq

Intermediate. Assumes working knowledge.

157K views13 years ago9 recommendations

SecurityPrivacy and surveillanceWeb and application security

The Grugq explains operational security principles and methodologies for maintaining online anonymity and avoiding detection based on real-world hacker arrests.

PRESENTATION MATERIALS: conference.hitb.org/hitbsecconf2012kul/materials/ PRESENTATION ABSTRACT: Drawing on lessons gleaned from recent hacker indictments, research on surveillance, espionage and counter-intelligence, this talk focuses on practical operational security (OPSEC) measures to avoid detection and prevent arrest by Law Enforcement Officials. The target audience for this talk are hacktivists whose primary mission requires strong online anonymity in the face of intense scrutiny from well funded antagonists. Starting with a review of OPSEC goals and moving onto methodologies, techniques and technologies, this presentation will enable the target audience to devise and implement robust OPSEC measures. Effective OPSEC requires combining strong technology solutions with disciplined cautious actions to minimize the exposure of "protected information". The talk will enumerate OPSEC principles and techniques to deny protected information to LEO, and equip hacktivists with the tools necessary to successfully conduct online operations while avoiding capture. ABOUT THE GRUGQ A licensed manicurist by trade, the grugq rose from the ranks of the PLA's gold farming division to become one of the lead clicky-clicky technologists within the offensive cyber sphere. Currently under the patronage of the Asian Godfather of Hacking, living an austere existence as a practicing Buddhist monk in the mountains of Bangkok, The Grugq continues to advance the art of hiding things from the authorities.

Why it's here

9 people recommend this

What people say. Recommended as a classic and highly entertaining presentation on operational security and how famous hackers got caught despite thinking they were secure.

hackermaticon Hacker News • Recommends

On “DNS traffic can leak outside the VPN tunnel on Android”

Edit: Other commenters report that Android will silently re-enable cell data under various conditions, so this isn't a surefire solution, either. The Grugq created a tool for this a decade ago (sadly unmaintained): link as part of a presentation about operational security for hackers. It's a great watch if you're interested in how various (in)famous hackers thought they were secure and got busted anyway. link to this video
View on Hacker News

notaddictedon Hacker News • Recommends

On “The Best Anonymous VPNs For 2013”

Any thoughts on Mullvad? ( link ) I also like the conference talk "#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd" most of it is based on hackers that have been jailed lately and specifically what they did to end up in jail, but there is also some techinal stuff about privacy and anonymity, specifically about TOR+VPN here: link to this video EDIT: RE: Mullvad, AFAIK they don't have any presence outside SE, NL, or DE so I think your speeds will take a hit coming from outside Western Europe.
View on Hacker News

iuguyon Hacker News • Recommends

On “Poll: Do you use your real identity on HN?”

Using a pseudonym may be great, but there's always the temptation to be more abrasive, offensive or obnoxious when using one. The longer you keep an identity online in public forums the more information you tend to leak through side channels and should your identity end up compromised you risk having a lot more exposed than if you never covered at all and thought (mostly) before posting. I've chosen to use my real name here because of the level of conversation when I joined and because I've associated HN initially more with the traditional hacker world than the blackhat type. Those of you using pseudonyms could do worse than learn from the Grugq1. 1 - link to this video
View on Hacker News

j_son Hacker News • Recommends

On “It Was DPR, in the Tor HS, With the BTC”

Watch the author's 'OPSEC for hackers' presentation of the slides linked in the article: link to this video slides: link
View on Hacker News

j_son Hacker News • Recommends

On “Steps You Can Take Right Now Against Internet Surveillance”

'grugq' shares current best practice, and recently stopped by HN when his blog came up for discussion: Anonymity Is Hard link OPSEC for Hackers (video) link to this video
View on Hacker News

WestCoastJustinon Hacker News • Recommends

On “Interview: OPSEC with the grugq”

There is a really good video of OPSEC by grugq on YouTube from Hack In The Box Security Conference. Basically gives you some rules and things to think about, but also talks about where lulzsec went off the rails, and how they were caught. Really interesting talk. link to this video
View on Hacker News

epsylonon Hacker News • Recommends

On “The boy who stole Half Life 2 source code (2011)”

I must have been following the grugq1 way too much because all I couldn't help thinking about the massive OPSEC mistakes he did. Fortunately he was apprehended by the German Police, but things would've been way different had took that plane. 1 There's a great presentation from him on video, including analysis of OPSEC failures from other hacker groups: link to this video 2 Another timeless classic: "Don't talk to the police", which explains why it is never in your interest to talk to the police when you are suspected of a crime (even if you are innocent): link
View on Hacker News

blauwbilgorgelon Hacker News • Recommends

On “Doxxing defense: Remove your personal info from data brokers”

…l media) a simple data broker doxxing is a mere reminder that such data is public to everyone, not just friends. Doxxing defense is guarding your anonymity online. Everywhere. Doxxing defense is knowing when to change persona's, and when to log off. That is: If you care about it at all. If you care about keeping your identity a secret online, see: link to this video (The Grugq - OPSEC: Because Jail is for wuftpd).…
View on Hacker News

fabuliston Hacker News • Recommends

On “How to Learn Hacking”

This guide is very hand-wavey. Tor alone is a poor operational security strategy; using nikto and unix-privesc-check does not a hacker make. This may be a decent place to begin one's inquiry, but don't let it end here too. Here are some talks I recommend: Tricks for Defeating SSL in Practice - Moxie Marlinspike link OPSEC: Because Jail is for wuftpd - thegrugq link to this video
View on Hacker News

Esauon Hacker News • Recommends

On “Ask HN: What is your favorite YouTube channel for developers?”

I have to say that I had no use for YouTube until I realized that these kind of talks were on there. In addition to what you mentioned, some I like: The Gruqg on OpSec: link to this video Russ Cox's ACME tutorial: link Jessie Frazelle on running containers on the desktop: link
View on Hacker News

narsilon Hacker News • Mentions

On “OPSEC for hackers”

From the Q&A at the end ( link to this video ), Grug has this to say on TOR: "Against Law Enforcement Officials, it's fine. Against a nation-state, the TOR network has insufficient resources and has sufficient bad actors that it is not actually secure. So if you're going to hack the shit out of the NSA and do really really bad planning and do not actually evalute the targets you are after, you will go to jail." He also expands on how to unmask a user by controlling both the exit and entry nodes: "So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month, you will be able to uncover a large number of users. ... You are better of sele…
View on Hacker News

narsilon Hacker News • Mentions

On “The feds pay for 60 percent of Tor’s development. Can users trust it?”

From the Q&A at the end ( link to this video ), Grug has this to say on TOR: "Against Law Enforcement Officials, it's fine. Against a nation-state, the TOR network has insufficient resources and has sufficient bad actors that it is not actually secure. So if you're going to hack the shit out of the NSA and do really really bad planning and do not actually evalute the targets you are after, you will go to jail." He also expands on how to unmask a user by controlling both the exit and entry nodes: "So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month, you will be able to uncover a large number of users. ... You are better of sele…
View on Hacker News

gpczon Hacker News • Mentions

On “FBI struggles to seize 600,000 Bitcoins from alleged Silk Road founder”

OPSEC for Hackers ( link to this video ) uses a quote from The Wire to reference what you're talking about: “The thing is, you only got to fuck up once. Be a little slow, be a little late, just once. And how you ain’t never gonna be slow, never be late? You can’t plan for no shit like this, man. It’s life.” The Grugq addresses this issue by recommending that one set up an entire fake persona before doing anything, and then doing all the activities "in character" as that persona. If you stay in character, then even making the types of mistakes DPR made would only lead the authorities to the persona rather than yourself. Granted, this video didn't exist when DPR made Silk Road...
View on Hacker News

Tangokaton Hacker News • Mentions

On “U.S. Government vs. Hackers”

The US prison system is completely insane whether you are a hacker or not. It is baffling to me why you would want to send non-violent criminals to prison with hardened criminals in the first place, the rehabilitation is likely to be higher (and cheaper) with something like an ankle bracelet. Also an interesting idea to have hackers teaching hardcore criminials about OPSEC. Although you could make the argument that the hackers who get caught aren't usually very good at OPSEC to begin with - I suspect that they are learning though, even the Grugq has a video about it 1. [video ]
View on Hacker News

j_son Hacker News • Mentions

On “Cloudflare ReCAPTCHA De-Anonymizes Tor Users”

link link These discussions are definitely post-mortem analysis but there is also discussion on another OpSec presentation: link to this video
View on Hacker News

micaksicaon Hacker News • Mentions

On “Javascript exploit actively used against TorBrowser”

TL;DR: A plurality of Tor users are from Western countries with arguably decent judicial frameworks. Those that have life-or-death consequences to network anonymity will need a lot, lot more than the Tor Browser Bundle or Tor itself. > If their location and they get it with the equivalent of their local government's "search warrant", it's more likely a raid, interrogation, threats, harassment, censorship, and possibly torture and death. This is not who is primarily using Tor. 1/5 directly connecting users of Tor are in the United States. See: link This doesn't change even for bridge users: link So, the majority of Tor users are in places I think we'd consider have somewhat working judici…
View on Hacker News