Skip to content
0:00 / 0:00

#opsec#surveillance#nsa

DEF CON 22 - Zoz - Don't Fuck It Up!

DEFCONConference

419K subscribers • 61 videos on Hallway • Conference channel

YouTube
  • Recommended by 4 people: 3 on Hacker News and 1 in engineering communities.
  • A classic. People kept recommending it from 2015 to 2019.
  • Presented by Zoz, robotics engineer

Intermediate. Assumes working knowledge.

545K views11 years ago4 recommendations

SecurityPrivacy and surveillanceExploits and vulnerabilities

Zoz delivers a racy and practical talk on the extreme difficulty of maintaining operational security and anonymity under modern pervasive surveillance.

Slides Here: defcon.org/images/defcon-22/dc-22-presentations/Zoz/DEFCON-2… Don't Fuck It Up! Zoz ROBOTICS ENGINEER Online antics used to be all about the lulz; now they're all about the pervasive surveillance. Whether you're the director of a TLA just trying to make a booty call or an internet entrepreneur struggling to make your marketplace transactions as smooth as silk, getting up to any kind of mischief involving electronic communications now increasingly means going up against a nation-state adversary. And if even the people who most should know better keep fucking it up, what does that mean for the rest of us? What do the revelations about massive government eavesdropping and data ingestion mean for people who feel they have a right if not a duty to occasionally be disobedient? It's time for a rant. Analyzing what is currently known or speculated about the state of online spying through the prism of some spectacular fuckups, this talk offers an amusing introduction to how you can maximize your chances of enduring your freedom while not fucking it up. Learn how not to fuck up covering your tracks on the internet, using burner phones, collaborating with other dissidents and more. If you have anything to hide, and all of us do, pay attention and Don't. Fuck. It. Up! Zoz is a robotics engineer, prankster and general sneaky bastard. He has been pretty successful at pulling some cool subversive shit and not fucking it up and getting caught. He once faked a crop circle for the Discovery Channel and it was all uphill from there.

Why it's here

4 people recommend this

What people say. Highly recommended as an entertaining and eye-opening overview of modern OPSEC and the difficulty of staying anonymous.

pdkl95on Hacker News • Recommends

On ““Reverse location” search warrants identify all cellphones near a crime scene”

According to Zoz in his excellent DEFCON 22 talk "Don't Fuck It Up!"1 on the difficulties of OPSEC, this type of correlation has been in use for years. >2 Matching entry / exit point – we know specifically they look for that, so don’t match the last use and first use of phones, overlap it. 1 link to this video 2 link

bluejellybeanon Hacker News • Recommends

On “The Gig Economy (2018)”

I'm always reminded of Zoz's awesome talk "Don't Fuck It Up!"0. There's a ton of sketchy shit you can unfortunately (or fortunately depending on who you are) do online but not getting caught is still a non-trivial task. Successfully hiding is dependent upon the people who you're trying to hide from and your sophistication in hiding. 0 link to this video

pdkl95on Hacker News • Recommends

On “Cops can easily get months of location data, appeals court rules”

> leaves their cellphones at home while committing crimes, using burner phones for any contact they need during that time That's getting a lot harder to do in practice. OPSEC is hard when you have to care about stuff like overlapping usage of the burner so the movement logs of the regular phone stopping don't correlate with when the burner starts moving. Zoz gave a great overview1 of modern cellphone OPSEC at DEFCON 22. 1 link to this video

_asummerson Hacker News • Recommends

On “Cloudflare ReCAPTCHA De-Anonymizes Tor Users”

There's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up". link to this video

pdkl95on Hacker News • Recommends

On “Tracking the Owner of Kickass Torrents – Schneier on Security”

OPSEC in the age of mass surveillance is incredibly hard. Zoz gave1 has a very good overview of modern OPSEC. Staying anonymous requires an attention to detail that most people probably cannot do. The hindsight bias is realizing how serious the situation might be and the level of OPSEC that is required. When the torrent site was first created the risk level wasn't known and most people didn't understand how hard it is to avoid the ubiquitous sensors of the surveillance-industriual-complex. Yes, more people probably should have assumed this level of risk much earlier, but that's easy to say now when we know names like Prism and XKEYSCORE. 1 (note: contains rude/strong language) link to this video

pdkl95on Hacker News • Recommends

On “‘Five Eyes’ Nations Quietly Demand Government Access to Encrypted Data”

> you're only fucked if your OPSEC is weak The problem is that actually implementing not-weak OPSEC is much harder than most people understand (even those with technical backgrounds). For example, is your "secret" activity on TOR easily tied to your non-secret activity from a search of network entry/exit times (i.e. "secret" activity is the complement "non-secret" activity)? I recommend Zoz's DEFCON talk, "Don't Fuck It Up!"1, for a very good overview of how hard OPSEC has become. 1 link to this video

u/teamevilin r/netsec • Recommends

DEF CON 22 - Zoz - Don't Fuck It Up!

fuck_dangon Hacker News • Mentions

On “NSA Chief Hacker Explains How to Avoid NSA Spying”

Our friend Zoz of Defcon fame has a talk about NSA spying that enumerates and gives details to some of the ways that the NSA can 'see' you. link to this video

pdkl95on Hacker News • Mentions

On “Facebook recommended that a psychiatrist’s patients friend each other”

That would create very conspicuous network exit/entry points at the office. According to Zoz's DEFCON 22 talk1 about modern OPSEC, these are specifically targeted by various agencies, so I'm sure Facebook finds entry/exit data points just as interesting. 1 (warning: strong language) link to this video

pdkl95on Hacker News • Mentions

On “UK spies using social media data for mass surveillance”

Dan Geer, CISO at In-Q-Tel , on1 why this is patently incorrect: > Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? ... Privacy will be ... the effective capacity to misrepresent yourself. > Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some o…

mwcmitchellon Hacker News • Mentions

On “Signal partners with Microsoft to bring end-to-end encryption to Skype”

skype had this already before ms. ms opened skype up to government ages ago so this doesn't mean much of anything, there are backdoors. link to this video

pdkl95on Hacker News • Mentions

On “White House weighs encryption crackdown”

> if police work becomes effectively impossible It hasn't. That's a lie. Police/etc have far more resources available to them than they've had at any point in history. The trail of digital exhaust we leave behind is only increasing, which makes OPSEC much harder 1. End to end encryption doesn't prevent metadata analysis2, network usage/timing analysis (e.g. 3), or investigation of the massive amount of data that isn't end to end encrypted.. 1 link to this video 2 The NSA admits4 metadata tells them far more than the message contents. 3 link edit: 4 "We kill people based on metadata" link

pdkl95on Hacker News • Mentions

On “37-Year-Old Mom Spent Seven Days Online as an 11-Year-Old Girl”

…only using privacy tools when you’re up to no good." >> "For example, investigators could look at who went and downloaded the Tor Browser Bundle right before the bomb threat got called in; or look at everyone who connected to a known Tor entry node at that time, or who accessed the Tor directory servers. ... no compromise of Tor necessary." 1 link to this video…

pdkl95on Hacker News • Mentions

On “Ask HN: How much is Google collecting and keeping on Android if not signed in?”

…eo game design is difficult. > you need to be Jason Bourne -levels of vigilant to not create a trackable fingerprint online. As Zoz said, "Don't Fuck It Up!"1. Any type of OPSEC has become extremely difficult . Even technically knowledgeable people that risk consequences of failure far worse than being tracked by Google screw up their OPSEC. 1 link to this video…