A gentle introduction to keeping your mouth shut. Video of the talk: https://www.youtube.com/watch?v=9XaYdCdwiWU

1. OPSEC for hackers:
because jail is for
wuftpd
the.grugq@gmail.com

2. OPSEC forFREEDOM FIGHTERS
hackers:
because jail is for
wuftpd
the.grugq@gmail.com

3. Overview
• Intro to OPSEC
• Methodology
• lulzsec: lessons learned
• Techniques
• Technology
• Conclusion

4. Avon:You only got to fuck up once… Be a little
slow, be a little late, just once. How you
ain’t gonna never be slow? Never be late?
You can’t plan for that. Thats life.

5. Intro
to
OPSEC

6. WTF is it?

7. OPSEC in a nutshell
• Keep your mouth shut
• Guard secrets
• Need to know
• Never let anyone get into position to
blackmail you

8. STFU

19. Methodology

20. • put the plumbing in first
• create a cover (new persona)
• work on the legend (history, background,
supporting evidence for the persona)
• Create sub-aliases
• NEVER CONTAMINATE

21. The 10 Hack
Commandments

22. FREEDOM
The 10 Hack
FIGHTING
Commandments

24. • Rule 1: Never reveal your operational
details

25. • Rule 1: Never reveal your operational
details
• Rule 2: Never reveal your plans

26. • Rule 1: Never reveal your operational
details
• Rule 2: Never reveal your plans
• Rule 3: Never trust anyone

27. • Rule 1: Never reveal your operational
details
• Rule 2: Never reveal your plans
• Rule 3: Never trust anyone
• Rule 4: Never confuse recreation and
hacking
FREEDOM FIGHTING

28. • Rule 1: Never reveal your operational
details
• Rule 2: Never reveal your plans
• Rule 3: Never trust anyone
• Rule 4: Never confuse recreation and
hacking
FREEDOM FIGHTING
• Rule 5: Never operate from your own
house

30. • Rule 6: Be proactively paranoid, it doesn’t work
retroactively

31. • Rule 6: Be proactively paranoid, it doesn’t work
retroactively
FREEDOM
• Rule 7: Keep personal life and hacking
FIGHTING
separated

32. • Rule 6: Be proactively paranoid, it doesn’t work
retroactively
FREEDOM
• Rule 7: Keep personal life and hacking
FIGHTING
separated
• Rule 8: Keep your personal environment
contraband free

33. • Rule 6: Be proactively paranoid, it doesn’t work
retroactively
FREEDOM
• Rule 7: Keep personal life and hacking
FIGHTING
separated
• Rule 8: Keep your personal environment
contraband free
• Rule 9: Don’t talk to the police

34. • Rule 6: Be proactively paranoid, it doesn’t work
retroactively
FREEDOM
• Rule 7: Keep personal life and hacking
FIGHTING
separated
• Rule 8: Keep your personal environment
contraband free
• Rule 9: Don’t talk to the police
• Rule 10: Don't give anyone power over you

35. Why do you need
OPSEC?

36. It hurts to get fucked

37. No one is going to go
to jail for you.

41. Your friends will betray
you.

42. #lulzsec:
lessons learned

46. never ever ever do this

47. Violation
Never trust anyone

51. ProTip: Don’t use your personal Facebook account
to send defacement code toFREEDOM FIGHTERS
your friends

59. Violation
Don’t contaminate

63. Violation
Keep personal life and
hacking separate

64. Violation
Keep personal life and
FREEDOM
hacking separate
FIGHTING

68. Violation
Never operate from
your home

73. Violation
Don’t reveal
operational details

82. Violation
Don’t reveal
operational details

87. Violation
Be paranoid

89. Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics

90. Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics
Virus (10:30:31 PM): and then your buddy, topiary,
who lives in the most random place

91. Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics
Virus (10:30:31 PM): and then your buddy, topiary,
who lives in the most random place
Virus (10:30:36 PM): who's docs weren't even public

92. Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics
Virus (10:30:31 PM): and then your buddy, topiary,
who lives in the most random place
Virus (10:30:36 PM): who's docs weren't even public
Virus (10:30:38 PM): gets owned

93. Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics
Virus (10:30:31 PM): and then your buddy, topiary,
who lives in the most random place
Virus (10:30:36 PM): who's docs weren't even public
Virus (10:30:38 PM): gets owned
Sabu (10:32:29 PM): offering to pay you for shit?

94. Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics
Virus (10:30:31 PM): and then your buddy, topiary,
who lives in the most random place
Virus (10:30:36 PM): who's docs weren't even public
Virus (10:30:38 PM): gets owned
Sabu (10:32:29 PM): offering to pay you for shit?
Virus (10:32:55 PM): yeah, you offered me money for
"dox"

95. Virus (10:30:18 PM): don't start accusing me of
[being an informant] - especially after you
disappeared and came back offering to pay me for
shit - that's fed tactics
Virus (10:30:31 PM): and then your buddy, topiary,
who lives in the most random place
Virus (10:30:36 PM): who's docs weren't even public
Virus (10:30:38 PM): gets owned
Sabu (10:32:29 PM): offering to pay you for shit?
Virus (10:32:55 PM): yeah, you offered me money for
"dox"
Virus (10:33:39 PM): only informants offer up cash
for shit -- you gave yourself up with that one

96. HAPPY ENDING
Virus is still free

99. Violation
Never contaminate

102. Bonus: w0rmer

106. Techniques

107. Plumbing

108. It is boring.

109. You’ll know it worked if
nothing happens.

110. Put it in place first.

111. Paranoia doesn’t work
retroactively

112. Personas

113. Spiros: He knows my name, but my name is
not my name. And you... to them you're
only "The Greek."
The Greek: And, of course, I'm not even Greek.

114. Problem:
You are you.

116. Solution:
Be someone else.

118. Personas
• Danger to personas is contamination
• Contact between personas (covers)
contaminates both
• Keep cover identities isolated from each
other

119. Layered defense

120. • Fail safe technological solution
• TOR all the things!
• Back stop persona
• Primary cover alias as first identity
• Secondary cover aliases (eg. handles)

121. Profiling data

122. Pitfalls
• Location revealing information
• Weather
• Time
• Political events
• Profiling data

123. Practice
• Amateurs practice until they get it right,
professionals practice until they can’t get it
wrong
• Practice makes perfect

124. Stringer: What you doing?
Shamrock: Robert's Rules says we got to
have minutes of the meeting.
These the minutes.
Stringer: Nigga, is you taking notes on a
criminal fucking conspiracy?

125. No logs. No crime.

126. Staying Anonymous

127. Personal info is profiling
info

128. Guidelines against
profiling
• Do not include personal informations in
your nick and screen name.
• Do not discuss personal informations in the
chat, where you are from...
• Do not mention your gender, tattoos,
piercings or physical capacities.

129. Guidelines, cont.
• Do not mention your profession, hobbies
or involvement in activist groups
• Do not use special characters on your
keyboard unique to your language
• Do not post informations to the regular
internet while you are anonymous in IRC.
• Do not use Twitter and Facebook

130. Guidelines, cont.
• Do not post links to Facebook images. The
image name contains a personal ID.
• Do not keep regular hours / habits (this can
reveal your timezone, geographic locale)
• Do not discuss your environment, e.g.
weather, political activities,

132. Hackers are no longer
the apex predator

133. Hackers are no longer
FREEDOM
FIGHTERS
the apex predator

134. That position has been
ceded to LEO

135. That position has been
ceded to LEO *
*Law Enforcement Officials

136. Technology

137. VPNs vs. TOR
• VPNs provide privacy
• TOR provides anonymity
• Confuse the two at your peril

138. • TOR connection to a VPN => OK
• VPN connection to TOR => GOTO JAIL

139. On VPNs
• Only safe currency is Bitcoins
• because they come from nothing
• Purchase only over TOR
• http://torrentfreak.com/which-vpn-
providers-really-take-anonymity-
seriously-111007/

141. Fail closed

143. PORTAL

144. PORTAL
Personal Onion Router To Avoid LEO

145. PORTAL
• Router ensuring all traffic is transparently
sent over TOR
• Reduce the ability to make mistakes
• Use mobile uplink
• Mobility (go to a coffee shop)
• Reduce risk of wifi monitoring

146. PORTAL
• Uses tricks to get additional storage space
on /

147. Hardware
• TP-LINK AR71xx personal routers
• MR-11U
• MR-3040
• MR-3020
• WR-703N

148. MR-3040 & MR-11U
• Battery powered
• Approx. 4-5 hrs per charge
• USB for 3G modem

149. http://torporfavor.org/
download/portal/

150. Conclusion

151. STFU

152. Questions?

154. If you think, don’t speak
If you speak, don’t write
If you write, don’t sign
If you sign, don’t be surprised