We can speculate all we want about intent and who is and who isn’t fed to narrow down the stress of when we need to worry about OpSec.
But that is not good security practice
The point here is Genuine Operation security.
As far as public speaking behind a mask, that can not and never should ever happen. Especially considering posting it on social media with an account is a good way for anyone to correlate
you with the account as well any sects you’re involved with.
Remember that scene from V for Vendetta when V tells Evy why she couldn’t leave. remember that movie?. You know its underground. You know the color of the stone. That can be enough for a clever man.
He is right!
Do not ever tell anyone in real life anything about what your online activities entail. I do not care if you think a person would keep you safe or not. History has proven that people like law enforcement or extortioners will go
after anyone around you to pivot or leverage you by getting them to snitch. Remember this guy??? Sabu from LulzSec. Snitched on people like Barrett Brown and others that gave them prison terms.
See this video —->How Sabu Snitched
1390b9409444a15cb2d829f94dc1a7e7.jpg
You are your own security. Physical security is paramount in any of these situations. Never let a guard down and trust no one! I mean no one! if you have questions pertaining to trust than read the second paragraph again. Never use any internet service without a VPN!!! and I mean a paid VPN like IVPN or Mullvad.net.
Anywhere else you’re going to be BURNT.
3106091b21b1b4f66b52dafce73b37c4.jpg
Do not be the toast.
My thing is if your feeling like your OpSec has failed then you know what honestly it has.
At that point as far as your social media accounts are concerned… sorry to say this but it is like that toast up there. It is burnt.
Better get to removing EVERYTHING and abandon ship!
TOR was something that everyone saw was great. It kept peoples identity obfuscated, but yet who developed it?
THE US NAVY. If they built any encryption or technology… well they can break it.
Matter of fact as far as TOR is concerned, they already have. You can absolutely screw up and be de-anonymized by making mistakes in how you use TOR. Those are not failings in TOR, but user choice and error.
A good read right here —->How the feds broke tor security.
Do not tell doctors and or psychologists about these sorts of things if it incriminates you. Of course do whats best for your mind but do not come crying to me if they report you, because you know what? THEY ARE MANDATED REPORTERS!
Another side note. If you are a hacker and someone gets the dox on you, would you use the same accounts? Or would you have no fear and keep going with the same accounts? I only ask because An0nkn0wledge has, and still is. Anon2earth, GhostSec, all same.
If we talk about why then we have to arrive at the same conclusion.
In short, let us skip right to the conclusion. They are the guys doing the frisking.
a629ec499b3096dc560c0ea68a806cb2.jpg
As more data is collected at different layers of our digital lives an understanding of anonymity becomes a vital skill. While operational security (OPSEC) is important in practice, the technical setup for anonymity is a prerequisite to any operation. Given the range of use cases for anonymity and the many different actors who attempt to dismantle it, this design considers an environment in which everyone is an adversary. This article should serve as a start to finish guide on setting up a laptop for anonymous usage. While it will cover OPSEC in different sections this is not meant to be an exhaustive guide on the topic.
Introduction
Many companies are turning toward data collection and remote storage. This removes control from the consumer and provides their data and activities to be accessed by third parties. Each layer of usage provides a potential point for data insecurity; computer manufacturers, operating systems, applications, network access points, internet service providers, web pages, retailers, governments, and any partners of the controlling organizations with whom data is shared. Given the many points of failure and the possibility that any of these collections of data can be breached by an attacker, it is wise to treat every group as an adversary regardless of whether they are directly targeting you.OPSEC is critical at every stage of operation. To ensure anonymity, operations will require significant planning and care during execution. Security researcher the grugq sums it up well with the following –
STRONG OPSEC MEANS LOW EFFICIENCY, WHILE HIGH EFFICIENCY NECESSITATES WEAK OPSEC. THE STRENGTH OF THE OPPOSITIONAL FORCES DICTATE THE MINIMUM SECURITY REQUIREMENTS OF THE COVERT ORGANIZATION.
– THE GRUGQ (SOURCE)
SIMPLY PUT, YOU MUST BE WILLING TO JUMP THROUGH HOOPS IN ORDER TO PRESERVE YOUR ANONYMITY.THE DESIGN COVERED IN THIS GUIDE IS BASED OFF OF A LAPTOP AND A RASPBERRY PI. IT UTILIZES THE GRUGQ’S PORTALOFPI ROUTER WHICH TURNS THE RASPBERRY PI INTO A TOR ROUTER. THAT IS, ALL TRAFFIC ROUTED THROUGH THE PI WILL BE SENT THROUGH TOR.
Acquiring Materials
THE FIRST STAGE IN AN OPERATION IS SECURELY GATHERING THE REQUIRED EQUIPMENT. SYSTEM ATTRIBUTES WILL BE LEAKED DURING NORMAL OPERATION. FOR EXAMPLE, YOUR NETWORK ADAPTER’S MAC ADDRESS IS AVAILABLE TO THE NETWORK ACCESS POINT YOUR ARE CONNECTING THROUGH. IF THE MAC ADDRESS IS ASSOCIATED WITH A SPECIFIC LAPTOP MANUFACTURER, STORE, OR REGION, THAT CAN HELP NARROW DOWN IDENTIFICATION. WHILE YOU CAN RANDOMIZE A MAC ADDRESS, NOT ALL SYSTEM ATTRIBUTES ARE ABLE TO BE CHANGED. DUE TO THIS, IT IS NECESSARY TO DISSOCIATE ANY PURCHASE FROM YOUR CONCRETE IDENTITY.IN ORDER TO DO THIS YOU NEED A CURRENCY THAT IS NOT ASSOCIATED WITH YOUR IDENTITY. MOST IMPORTANTLY, NO CREDIT AND DEBIT CARDS. CASH IS AN EXCELLENT OPTION, AS ARE PREPAID GIFT CARDS (HOWEVER, YOU WILL LIKELY NEED TO PURCHASE THESE WITH CASH). IT IS UNLIKELY THAT THERE IS A MAJOR SCHEME GOING ON THAT CORRELATES BILL SERIAL NUMBERS TO DEBIT WITHDRAWALS. HOWEVER, UNDER THE EVERYONE IS AN ADVERSARY THREAT MODEL, IT IS SAFER TO ACQUIRE CASH VIA CASHBACK OR OTHER MEANS (WORKING, PAN HANDLING, ETC).OUR BILL OF MATERIALS:
Laptop
Raspberry Pi 2
Micro SD Card
WiFi Adapter
Ethernet Cable
Burner Phone
USB Ethernet Adapter (optional)
Second Ethernet Cable (optional)
Bitcoin / Cash Cards
ALTOGETHER THESE ITEMS CAN BE PURCHASED FOR LESS THAN 500$. IT IS IMPORTANT TO PURCHASE THEM FROM A PHYSICAL RETAILER SO THAT THEY ARE NOT SUBJECT TO INTERDICTION BY AN ADVERSARY.IT IS POSSIBLE THAT SOMETIME IN THE FUTURE THE DEVICE YOU PURCHASED WILL BE RECOVERED BY AN ADVERSARY. THE SERIAL NUMBERS OF THE VARIOUS PARTS OF YOUR DEVICE MAY BE TRACKED TO THAT SPECIFIC RETAILER. IT WOULD THEN BE POSSIBLE TO RECOVER CLUES TO YOUR IDENTITY FROM THE SECURITY FOOTAGE. IT CAN BE BENEFICIAL TO WEAR CLOTHING THAT MASKS YOUR FACE, FOR EXAMPLE, SUNGLASSES AND A BASEBALL CAP. THERE HAVE BEEN METHODS RESEARCHED TO DEFEAT AUTOMATED FACIAL RECOGNITION, HOWEVER, THESE METHODS MAY DRAW MORE ATTENTION THAN DESIRED.BITCOIN IS THE CRYPTOCURRENCY OF CHOICE RIGHT NOW. IT IS EASY TO OBTAIN AND ACCEPTED BY MANY RETAILERS. THERE ARE A FEW WAYS TO ACQUIRE BITCOIN, NONE OF WHICH ARE FOOL-PROOF IN PROTECTING ANONYMITY. FOR EXAMPLE, BITCOIN ATMS HAVE CAMERAS AND REQUIRE A PHONE NUMBER. MINING OVER TOR PROVIDES MORE SECURITY THAN BITCOIN DOES BY DEFAULT, BUT TOR USERS CAN BE DEANONYMIZED WITH CERTAIN ATTACKS AND IT IS LIKELY THAT YOU WOULD BE MINING FROM AN IP ADDRESS ASSOCIATED WITH YOU. DUE TO THIS IT IS CRUCIAL TO USE MIXERS. THERE IS A POSSIBILITY THAT A MIXER IS CONTROLLED BY YOUR ADVERSARY SO USING MULTIPLE MIXERS IS ADVISED.THE BURNER PHONE IS ANOTHER CONSIDERATION. IT SHOULD BE PURCHASED IN A SIMILAR MANNER TO THE REST OF THE HARDWARE; AS ANONYMOUSLY AS POSSIBLE.
Hardware and Software Setup
THE LAPTOP WILL BE THE MAIN DEVICE AND SHOULD BE PROPERLY SECURED. THE WEBCAM AND MICROPHONE SHOULD BE DISCONNECTED. THE BATTERY SHOULD BE REMOVED SO IT CAN BE POWERED DOWN EASILY. ANY RADIOS, SUCH AS BLUETOOTH AND WIFI, SHOULD BE REMOVED OR DISABLED.THE OPERATING SYSTEM CHOICE IS UP TO THE USER. THE OS THAT THE USER IS MOST KNOWLEDGEABLE OF IS WHAT THEY WILL BE ABLE TO OPERATE MOST SECURELY ON. WITH THAT SAID, THERE ARE SOME GOOD CHOICES FOR THE HOST SYSTEM DEPENDING ON PREFERENCE:
Qubes OS isolates different areas of the system using virtualization, also sandboxes networking code and USB drivers.
Subgraph OS implements application containment, hardened kernel, and optional Tor proxy layer.
Hardened BSD is a great choice if you are partial toward BSD, it implements security features that are missing from FreeBSD.
Xubuntu does not contain any hardening features, but it is often chosen because so many applications are built for Ubuntu. Xubuntu is preferred over Ubuntu as the lighter desktop environment may run better on a budget laptop. (Edit: Thanks to Reddit user bestbirdaround for pointing out that stock Ubuntu does offer full disk encryption on install.)
FOR ANY OPERATING SYSTEM THE DISKS SHOULD BE ENCRYPTED. THIS PREVENTS YOUR ADVERSARY FROM RECOVERING DATA FROM YOUR DISKS WHEN THE SYSTEM IS NOT POWERED. IT WAS MENTIONED PREVIOUSLY TO REMOVE THE BATTERY FROM THE LAPTOP. THIS IS SO THAT IF YOUR LAPTOP IS STOLEN IN A SNATCH AND GRAB OPERATION IT WILL SHUT DOWN WHEN REMOVED FROM THE POWER SOURCE.THE RASPBERRY PI WILL BE USED AS A TOR ROUTER THAT FAILS CLOSED. THIS DESIGN UTILIZES THE PORTALOFPI BUILD SCRIPT FROM SECURITY RESEARCHER THE GRUGQ. THERE ARE PENDING PULL REQUESTS THAT ADD ADDITIONAL SECURITY FEATURES TO THE SYSTEM THAT SHOULD BE CONSIDERED. THIS SCRIPT CONFIGURES AN ARCH LINUX RASPBERRY PI INSTALLATION TO ACT AS A ROUTER FOR ANY COMPUTER CONNECTED TO THE ETHERNET PORT. IT FORWARDS ALL TRAFFIC THROUGH TOR AND WHEN IT CANNOT ESTABLISH A CONNECTION THROUGH TOR IT FAILS CLOSED. IF THE LAPTOP IS COMPROMISED, THIS ROUTER ADDS AN ADDITIONAL LAYER OF PROTECTION FROM THE PUBLIC IP ADDRESS BEING LEAKED.THIS SETUP IS SIGNIFICANTLY MORE SECURE IF THE RASPBERRY PI CONNECTS TO THE INTERNET VIA AN ETHERNET CONNECTION. THIS IS INCREDIBLY INCONVENIENT SINCE MOST PUBLICLY AVAILABLE INTERNET IS OFFERED THROUGH WIFI. IN ORDER TO ESTABLISH A CONNECTION VIA WIFI, THE LAPTOP WILL NEED TO HAVE SOME ACCESS TO THE RASPBERRY PI IN ORDER TO SELECT NETWORKS AND ENTER PASSWORDS. THIS ACCESS IS ESTABLISHED VIA SSH WHICH REQUIRES SOME MODIFICATIONS TO THE IPTABLES RULES ON THE RASPBERRY PI. THIS SSH CONNECTION IS WHAT PROVIDES ATTACKERS THE OPPORTUNITY TO LEAK THE PUBLIC IP ADDRESS OF THE SYSTEM. IF AN ATTACKER WERE TO COMPROMISE THE LAPTOP, WITH ACCESS TO KEYLOGGING OR SSH KEYS, THEY COULD THEN MOVE TO THE RASPBERRY PI. THIS WOULD ALLOW THEM TO LEAK THE PUBLIC IP ADDRESS, CIRCUMVENTING TOR AND DEANONYMIZING THE USER. FURTHER RESEARCH IS NEEDED TO LOCK DOWN AND ISOLATE THE SSH ACCOUNT AND HAVE IT ABLE TO SELECT AND CONFIGURE WIFI CONNECTIONS. CONSIDER ALTERNATE METHODS TO ACCESS THE PI, SUCH AS A MONITOR AND KEYBOARD.THE COMPLETE SETUP IS THE LAPTOP CONNECTED TO THE RASPBERRY PI VIA ETHERNET, AND THE RASPBERRY PI CONNECTED TO THE INTERNET EITHER VIA A USB WIFI ADAPTER OR A USB ETHERNET ADAPTER.BURNER PHONES REQUIRE ACTIVATION AND SOME BLOCK ACTIVATION VIA PAYPHONE. HOWEVER, IT IS POSSIBLE TO ACTIVATE THEM ONLINE VIA TOR. A PHONE IS GENERALLY REQUIRED WHEN OPERATING ANONYMOUSLY AS MANY SITES REQUIRE SMS VERIFICATION. BITCOIN ATMS ALSO REQUIRE A MOBILE NUMBER.A BITCOIN WALLET SHOULD BE CREATED TO CAPTURE THE BITCOINS YOU PURCHASE. THE BITCOIN CORE CLIENT SYNCS THE ENTIRE BLOCKCHAIN TO YOUR COMPUTER. SINCE THE COMPUTER IS OPERATING OVER TOR THIS IS INCREDIBLY SLOW. TWO ALTERNATIVES ARE THE ELECTRUM CLIENT (NATIVE) AND BLOCKCHAIN.INFO (WEB).
Operating Securely
THERE ARE SOME BASIC OPSEC PRINCIPLES THAT SHOULD BE ESTABLISHED. A LOT OF THESE POINTS ARE SOURCED FROM THE GRUGQ’S TALK OPSEC, ZOZ’S TALK DON’T FUCK IT UP, AND WHONIX’S DONOT LIST.
Never operate from a location associated with you. There are attacks against Tor that can reveal your IP address. If your public IP address is revealed as your home or business then you are immediately identified. By operating from somewhere not associated with you, this will ideally only reveal your general location.
Be conscious of being tracked in public. There are technologies that make it easy to track people in public. Automated license plate recognition (ALPR) systems have been deployed on many police vehicles as well as by private companies. These systems use computer vision to extract the text of license plates. The license plate is associated with the location it is spotted at, effectively tracking any vehicle that is seen. There also exists a company Persistent Surveillance Systems that monitors large areas using high powered cameras attached to airplanes. This allows their customers to rewind on the movement of an area, tracking vehicles and people back to their source. Given these technologies and their limitations, it is best to travel more than 15 miles from any place associated with you, in a vehicle that cannot be tied to anyone you know. Consider using public transportation, though there are likely cameras monitoring both the vehicles and the stations. Bicycles and mopeds that do not require registration are a great solution. So may be a hired car in which you can pay cash.
Do not wear your regular uniform. Many people have a limited wardrobe. If what you wear can help narrow you down, (e.g., the person in Sometown, USA who wears all black) it is critical to wear different clothing while operating. Also cover any recognizable markings on your body, including tattoos.
Leave your personal cellphone no where near where you operate. Cellphones connect to many different companies during normal operation. Most significantly, the cell service provider for coverage and the operating system manufacturer for system analytics and built-in services. Any applications on the phone could also collect data. Each time the phone connects to a cell tower during normal operation, it should be assumed that the connection is logged and that your phone has then been associated with that location. There are also IMSI catchers that act as fake cell towers and collect a log of phones in that area. With all these technologies it is very easy for your phone to place you in a location at a specific time. It is best to simply leave the phone behind or disable it by removing the battery. Turning it off when you are operating can lead to a correlation between your phone being down and operations taking place. It should instead be kept in a plausible location that indicates normal use.
Keep the battery removed from the burner phone when it is not in use. Malware has been known to fake the phone off-state. In order to make sure that any phone is in the off state the battery should be removed.
Only turn on the burner cellphone at locations that are not associated with you. Given the nature of the burner phone and its strong connections to your anonymous accounts, ensure that it is never turned on in a location associated with your real identity.
Never call anyone associated with you from the burner cellphone.Given the metadata that is collected in regards to who is in contact with whom, calling someone you know can link that phone to a social graph associated with you.
Store your devices securely when they are not in use. The Raspberry Pi is not configured to have an encrypted disk. This means that an adversary who gains physical access to the SD card can modify it arbitrarily. As well, physical implants could be installed on the laptop and the adapters (WiFi or Ethernet) could be replaced with dummy devices designed to call out to your adversary. Due to these physical attacks it is critical to store the devices in a reasonably secure and tamper evident manner when they are unattended.
Never log into accounts that are associated with your anonymous identities without Tor. It should be assumed that every site is logging the IPs associated with each account. Even a single login can circumvent the protection that Tor provides, revealing general information about your location and operations.
Never log into your personal accounts at the same time or from the same systems as your anonymous accounts. If logged in at the same time a correlation can develop between the two accounts. It should also be assumed that a system could be compromised. Logging into a personal account from a compromised system would give an adversary a direct revelation of who is operating on the system.
Be conscious of advertisements and cookies that track users between sites. While this tracking does not directly reveal your identity, it can associate operations or remove separation between multiple identities that are being managed. You should take the necessary measures to avoid being tracked online while operating. This can include regularly clearing cookies, installing adblocking software, and disabling JavaScript where possible.
Dissociate from yourself any cryptocurrency that is linked to your real identity. There are very few ways to acquire a cryptocurrency without revealing pieces of your identity to some entity. Purchasing in person will allow the person you are purchasing from to see your face. However unlikely, this person may be an agent of your adversary. Bitcoin ATMs will have a camera and require your burner’s SMS number (this also associates a picture of you with your burner number). Mining can reveal your IP address as it is a rather stationary activity. Connecting to a mining pool via Tor is a good option but Tor users’ IP addresses can be revealed by an attacker with sufficient resources. Given these constraints, you should always utilize mixers before spending your coins. Using multiple mixers is advisable in case the mixer you use is controlled by your adversary.
Manage multiple plausible identities that would be investigated if your machine becomes compromised. Many people sabotage their own attempts at anonymity by using pieces of their real name as a username or a username that is associated with them in real life. In order to avoid this pitfall, it is suggested that while operating you work under an assumed identity.
Change out your hardware. Given the possibility of compromise, and the contamination that can occur if any device you use becomes associated with you in real life, it is important to change devices. For example, using a burner cell phone to purchase Bitcoins from an ATM will associate that phone number with your picture. That phone should be considered compromised after such a usage and a new phone should be purchased.
Don’t make friends. Getting friendly and sharing details about your life will destroy your anonymity. Do not attempt to make personal connections when operating.
ONCE YOU ARE SETUP THERE ARE ADDITIONAL MEASURES THAT CAN BE TAKEN TO HARDEN YOUR SECURITY. UTILIZING SERVICES THAT PROVIDE END-TO-END ENCRYPTION IS GOOD. UTILIZING PGP ACHIEVES THE SAME GOAL AND DOES NOT RELY ON TRUSTING A SERVICE PROVIDER. IF NOT, USING A HOST THAT COMPARTMENTALIZES PROGRAMS AND DATA USING VIRTUAL MACHINES CAN ADD A LAYER OF PROTECTION AGAINST SYSTEM COMPROMISE.YOU SHOULD ALSO ACQUIRE A JUMPBOX, A SERVER TO BE USED THAT IS PURCHASED ANONYMOUSLY AND NOT ASSOCIATED WITH YOU IN ANY WAY. THIS SERVER IS WHERE YOU WILL STORE ANY INFORMATION ON YOUR OPERATION SUCH THAT IF YOUR HARDWARE IS COMPROMISED YOU DO NOT BECOME TIED TO AN OPERATION. THIS SHOULD BE PURCHASED WITH BITCOIN THAT HAS BEEN MIXED.WHILE A SMART BURNER PHONE MAY INCREASE THE ATTACK SURFACE THROUGH WHICH YOU COULD BE DEANONYMIZED, IF ONE IS REQUIRED FOR USE OF MODERN APPLICATIONS IT IS RECOMMENDED TO USE A HARDENED OPERATING SYSTEM. ONE SOLUTION TO THIS IS COPPERHEADOS, A HARDENED VERSION OF ANDROID. UNFORTUNATELY FOR THIS SOLUTION, THE SUPPORTED DEVICES ARE EXPENSIVE AND DO NOT QUALIFY AS GOOD BURNER PHONES FOR ANYONE WITHOUT AN EXTENSIVE BUDGET.ADDITIONALLY, USING TOR, YOU WILL OFTEN RUN INTO SERVICES LIKE CLOUDFLARE THAT REQUIRE VERIFICATION BEFORE ACCESSING A WEBSITE. THIS BECOMES INCREDIBLY TEDIOUS. UTILIZING A VPN THAT YOU CONNECT TO THROUGH TOR WILL GIVE YOU A CLEAN IP ADDRESS. YOU MUST BE CAREFUL TO NOT USE THE SAME IP ADDRESS OR VPN PROVIDER ACROSS MULTIPLE IDENTITIES AS THIS CAN LEAD TO A BREAK DOWN IN THEIR COMPARTMENTALIZATION.
Conclusion
OPERATING SECURELY DOES REQUIRE A SIGNIFICANT BUDGET, IN TERMS OF BOTH TIME AND MONEY. IT IS NOT AN EASY PROCESS, AND FOR THE AVERAGE PERSON IT WILL LIKELY BE VIEWED AS AN UNNECESSARY EXPENSE. ANONYMITY ALSO REQUIRES TECHNICAL KNOWLEDGE. NO SOLUTION IS COMPLETELY SECURE, BUT TO HAVE REASONABLE LEVELS OF CONFIDENCE IN A SYSTEM ONE MUST HAVE THE TECHNICAL UNDERSTANDING OF WHY AND HOW IT WORKS AND WHAT ITS WEAK POINTS ARE.
