Going Dark (Grey) How to be pre1y anonymous online Prior art • @thegrugq – OPSEC for freedom fighters • this.lightVersion(“hands-on”) • Focus on Gothenburg, Sweden, today – on my way here – TIL: never redecorate the house, arrange two OWASP meetups, be presenter on one of them and give another presenta?on for a customer and start a new assignment on the same week Why? • The plumbing is boring and hard to get right – pracOce makes perfect – you never know when you are going to need it • 45 yo, father of 2, living in the suburbs, driving a Volvo… – not much 1337 • Responsible disclosure – currently seams to be responsible only one way Some of the commandments • Never operate from your house • Keep personal life and freedom fighOng separated – don’t contaminate • STFU FAIL Architecture teh Internetz SITE BASE MOBILE ME Challenges • TOR and/or VPN? • Hardware? • How to buy stuff? Tor • Provides anonymity • Anonymity protects you – Data leaving Tor through exit node is not protected. – CorrelaOon of entry and exit? – Not foolproof, but pre1y ok unless you have naOon states as adversaries VPN • Provides privacy • Privacy protects your data – Tunnel endpoint IP can be detected – VPN provider can have logs – Traffic correlaOon? Tor and/or VPN • “TOR -> VPN – OK” – Anonymous person within the Tor cloud connect to a VPNexit on the internet. • Or directly to your persistence-plaiorm • Looks like HTTPS locally? • “VPN -> TOR – GOTO JAIL” – An IP connected to a person and/or geolocaOon connects to the Tor cloud. CommunicaOons from Tor to Internet/ target/plaiorm are monitored. • Can you VPN to Tor? Through your own server? • Running Tor through a VPN tunnel? Tor and/or VPN • Prepaid mobile broadband – Not from home, not connected to me – Can of course be tracked to a locaOon • VPN – An extra step to keep ISP eyes away Hardware • Mobile broadband – Prepaid starter kit • Amazon plaiorm – Probably monitored, but will not leave trace on your.. • Mobile unit – Buy a laptop or use your old one • Personal Onion Router To Avoid Leo – Fail close and a fun project – Raspberry 2? Money • Purchase VPN over TOR with bitcoins – Anonymous but, can be traced • don’t mix wallets • use mixers • Light – Prepaid credit cards • Tied to physical locaOon • CCTV • Purchases are monitored Case study for lazy and moderately evil ha><><0rz • Walk into 7Eleven or Pressbyrån – Buy a prepaid credit card – Buy a mobile broadband modem • ISP starter pack, from 199:- • Kjell&Co 399:- – Use cash and your favorite hoodie • Use credit card to order a VPN – and create an amazon account • Email, cell phone no • Done Oh, and you need at least one persona and a couple of hacker nicks as well
Click on a date/time to view the file as it appeared at that time.
|current||16:04, 23 October 2015||(1.11 MB)||Peter Magnusson||Going Dark (Grey) How to be pre1y anonymous online Prior art • @thegrugq – OPSEC for freedom fighters • this.lightVersion(“hands-on”) • Focus on Gothenburg, Sweden, today – on my way here – TIL: never redecorate the house, arrange...|
- You cannot overwrite this file.