#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd

Edit: Other commenters report that Android will silently re-enable cell data under various conditions, so this isn't a surefire solution, either. The Grugq created a tool for this a decade ago (sadly unmaintained): [LINK] as part of a presentation about operational security for hackers. It's a great watch if you're interested in how various (in)famous hackers thought they were secure and got busted anyway. [VIDEO]

Any thoughts on Mullvad? ( [LINK] ) I also like the conference talk "#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd" most of it is based on hackers that have been jailed lately and specifically what they did to end up in jail, but there is also some techinal stuff about privacy and anonymity, specifically about TOR+VPN here: [VIDEO] EDIT: RE: Mullvad, AFAIK they don't have any presence outside SE, NL, or DE so I think your speeds will take a hit coming from outside Western Europe.

Using a pseudonym may be great, but there's always the temptation to be more abrasive, offensive or obnoxious when using one. The longer you keep an identity online in public forums the more information you tend to leak through side channels and should your identity end up compromised you risk having a lot more exposed than if you never covered at all and thought (mostly) before posting. I've chosen to use my real name here because of the level of conversation when I joined and because I've associated HN initially more with the traditional hacker world than the blackhat type. Those of you using pseudonyms could do worse than learn from the Grugq[1]. [1] - [VIDEO]

Watch the author's 'OPSEC for hackers' presentation of the slides linked in the article: [VIDEO] slides: [LINK]

'grugq' shares current best practice, and recently stopped by HN when his blog came up for discussion: Anonymity Is Hard [LINK] OPSEC for Hackers (video) [VIDEO]

There is a really good video of OPSEC by grugq on YouTube from Hack In The Box Security Conference. Basically gives you some rules and things to think about, but also talks about where lulzsec went off the rails, and how they were caught. Really interesting talk. [VIDEO]

I must have been following the grugq[1] way too much because all I couldn't help thinking about the massive OPSEC mistakes he did. Fortunately he was apprehended by the German Police, but things would've been way different had took that plane. [1] There's a great presentation from him on video, including analysis of OPSEC failures from other hacker groups: [VIDEO] [2] Another timeless classic: "Don't talk to [the] police", which explains why it is never in your interest to talk to the police when you are suspected of a crime (even if you are innocent): [LINK]

Just because a data aggregation site does not show your data on the front-end, does not mean they deleted it from the back-end. So now you can charge 50$ for people to search in the "special" data pile, where people took the effort to remove it from the front-end. These data brokers crawl publicly available information. Telling them to remove your data, only slows down the doxxer, it does not stop them at all, since the data was already shared. It is not plugging the leak, it is mopping up some of the water. A false sense of security and a clear sign to the doxxer that you care about your anonymity (so more "lulz" to be had). A proper doxxing is also much more than entering a name in some search engines. Especially hackers do not like to be doxxed. For internet civilians who already put this data out there (on social media) a simple data broker doxxing is a mere reminder that such data is public to everyone, not just friends. Doxxing defense is guarding your anonymity online. Everywhere. Doxxing defense is knowing when to change persona's, and when to log off. That is: If you care about it at all. If you care about keeping your identity a secret online, see: [VIDEO] (The Grugq - OPSEC: Because Jail is for wuftpd).