1
00:00:00,000 --> 00:00:07,180
Okay, guys. Let's start our next talk. We shall here. So give him a big

2
00:00:07,180 --> 00:00:07,760
applause, please.

3
00:00:31,980 --> 00:00:40,180
Okay. Everybody hear me okay? Good to go? Cool. So speaking today on operational security

4
00:00:40,180 --> 00:00:48,720
lessons from the dark web, a few kind of mandatory disclaimers before we proceed. The usual views

5
00:00:48,720 --> 00:00:53,820
and materials presented here do not represent any of my employer's past, present, or maybe

6
00:00:53,820 --> 00:00:59,100
future. I'm going to be talking about a number of dark web related criminal cases.

7
00:01:00,000 --> 00:01:08,100
I'm not discussing guilt or innocence. What I'm going to be discussing is evidence that

8
00:01:08,100 --> 00:01:14,360
was provided and what operational security mistakes that outlines and how to apply it

9
00:01:14,360 --> 00:01:23,800
for other enterprises. Also not going to be really discussing much the topic of parallel

10
00:01:23,800 --> 00:01:28,900
construction. For anybody that doesn't know, parallel construction is a practice used by

11
00:01:28,900 --> 00:01:29,620
law enforcement.

12
00:01:30,000 --> 00:01:37,340
Where if they are either unwilling or unable to divulge how information was gathered, say,

13
00:01:37,560 --> 00:01:44,320
by NSA surveillance, that sort of thing, they will essentially construct a parallel explanation

14
00:01:44,660 --> 00:01:49,280
that will be presented in court as to how the information was gathered.

15
00:01:50,440 --> 00:01:58,200
A little bit about myself. About 25 years in technology. Shifted to security about 10

16
00:01:58,200 --> 00:01:58,700
years ago.

17
00:01:58,880 --> 00:01:59,920
Have done a

18
00:02:00,000 --> 00:02:06,740
wide range of public and private sector work. Everything ranging from two person software

19
00:02:06,740 --> 00:02:13,040
startups up to multinationals. Currently working in the D.C. area. As you can see,

20
00:02:13,100 --> 00:02:20,780
I have the cutest dog in the world. Goals of this talk, as I mentioned a little bit,

21
00:02:20,960 --> 00:02:27,860
examine a number of criminal cases, what mistakes were made, and how the lessons learned from

22
00:02:27,860 --> 00:02:29,980
those mistakes can be applied to security. I'm going to be talking a little bit about

23
00:02:29,980 --> 00:02:36,760
some non-criminal activities. Starting with probably the most high profile one, and I

24
00:02:36,760 --> 00:02:41,020
won't go into kind of the build-up to the case that much, and that's the Dread Pirate

25
00:02:41,020 --> 00:02:47,420
Roberts Silk Road case. Been in the news a lot. Most people are probably familiar with

26
00:02:47,420 --> 00:02:49,380
the case, at least at a high level.

27
00:02:50,340 --> 00:02:57,860
Ross Ulbruch was arrested at a library in San Francisco while working on his laptop.

28
00:03:00,220 --> 00:03:07,120
One of the primary security mistakes made there, he'd chosen to work at a library, use their Wi-Fi.

29
00:03:07,300 --> 00:03:08,080
Makes sense.

30
00:03:08,840 --> 00:03:11,760
He was sitting at his table with his back to the room.

31
00:03:12,720 --> 00:03:15,220
Couldn't see anybody come in, couldn't see what was going on.

32
00:03:15,640 --> 00:03:22,940
The FBI agents that were there to arrest him thought they probably needed to make sure they could get his laptop before he could lock it.

33
00:03:23,160 --> 00:03:28,880
So they had a couple of FBI agents essentially getting into a screaming argument.

34
00:03:30,140 --> 00:03:34,020
He, we'd all do this, looked up from his laptop, looked around.

35
00:03:34,380 --> 00:03:37,240
There was someone standing almost right behind him before he knew it.

36
00:03:37,380 --> 00:03:38,380
Laptop's in their hands.

37
00:03:38,560 --> 00:03:39,440
They take it back.

38
00:03:39,580 --> 00:03:40,340
They image the laptop.

39
00:03:42,160 --> 00:03:50,980
He had encrypted the drive on the laptop, which would have helped if he'd been able to keep the FBI from getting to it before locking in.

40
00:03:54,100 --> 00:03:58,220
One of the things he was accused of was ordering.

41
00:03:58,360 --> 00:03:58,780
Actually, it was.

42
00:03:58,880 --> 00:04:01,320
Either five or six murders.

43
00:04:02,690 --> 00:04:04,020
At least one.

44
00:04:04,040 --> 00:04:08,400
All of those were arranged through relatively anonymous means.

45
00:04:08,900 --> 00:04:13,740
At least one of the quote-unquote hitmen turned out to be a DEA agent.

46
00:04:14,240 --> 00:04:16,500
I'll actually talk about him later.

47
00:04:16,960 --> 00:04:21,780
In that instance, they actually faked the murder of the person in question.

48
00:04:22,860 --> 00:04:27,180
To the best of everyone's knowledge, no murders actually occurred.

49
00:04:27,440 --> 00:04:28,400
Payments were made.

50
00:04:28,400 --> 00:04:29,920
But no murders actually occurred.

51
00:04:30,620 --> 00:04:34,820
There's an old New Yorker cartoon that probably everyone has seen that says,

52
00:04:35,340 --> 00:04:37,220
On the Internet, No One Knows You're a Dog.

53
00:04:38,040 --> 00:04:40,240
After this, I'm considering there should be one that says,

54
00:04:40,340 --> 00:04:42,620
On the Internet, No One Knows You're Not Actually a Hitman.

55
00:04:47,060 --> 00:04:50,480
So, FBI was able to successfully image his laptop.

56
00:04:51,600 --> 00:04:58,200
He had copious documentation on Silk Road activities on the laptop.

57
00:04:58,400 --> 00:05:03,660
He had a personal journal on the laptop spanning many years.

58
00:05:04,200 --> 00:05:06,140
Detailed his plans for Silk Road.

59
00:05:06,280 --> 00:05:07,920
Detailed activities on Silk Road.

60
00:05:09,060 --> 00:05:16,680
Also had a large volume of chat logs between him and other administrators on Silk Road

61
00:05:16,680 --> 00:05:18,920
that were stored on his laptop completely unencrypted.

62
00:05:22,400 --> 00:05:27,120
Interestingly enough, in the very early days of Silk Road,

63
00:05:27,560 --> 00:05:33,880
he made a post, I don't remember where it was, using the handle Altoid.

64
00:05:34,200 --> 00:05:37,340
Basically saying, hey, has anybody heard of this Silk Road thing?

65
00:05:37,500 --> 00:05:38,680
I think it's pretty nifty.

66
00:05:39,420 --> 00:05:43,320
Kind of, I guess, very early guerrilla marketing of Silk Road.

67
00:05:43,740 --> 00:05:50,740
He then later on needed some pretty basic coding assistance.

68
00:05:50,980 --> 00:05:56,680
Posted to, I think it was Stack Exchange, a site like that, under the same handle.

69
00:05:57,120 --> 00:06:01,680
But whatever board he was posting on to ask for programming advice

70
00:06:01,680 --> 00:06:08,700
automatically made public the email address that you had registered the account under.

71
00:06:08,780 --> 00:06:14,140
His email address that he used to register the account in that case was rossalbrook at gmail.com.

72
00:06:18,020 --> 00:06:23,460
Some of the initial suspicion around him actually had very little to do with Silk Road itself.

73
00:06:23,800 --> 00:06:26,880
He ordered, I think, nine fake IDs.

74
00:06:27,700 --> 00:06:29,260
From a shipper in Canada.

75
00:06:30,000 --> 00:06:31,620
Very high quality fake IDs.

76
00:06:31,900 --> 00:06:32,640
They were shipped.

77
00:06:32,900 --> 00:06:38,120
The package set off some sort of alarm bells for Customs and Border Protection.

78
00:06:38,880 --> 00:06:39,940
They opened the package.

79
00:06:40,100 --> 00:06:41,100
They discovered what was inside.

80
00:06:41,440 --> 00:06:45,420
He had requested that it be shipped directly to the house he was living in in San Francisco.

81
00:06:46,380 --> 00:06:50,360
They showed up, knocked on his door, said, we'd like to have a little chat with you.

82
00:06:51,160 --> 00:06:53,340
Weren't there to arrest him, just wanted to have a little chat.

83
00:06:53,540 --> 00:06:55,400
He said, no, absolutely not.

84
00:06:55,540 --> 00:06:57,040
Slammed the door in their face.

85
00:06:57,120 --> 00:06:59,340
Which is entirely his right to do.

86
00:07:00,720 --> 00:07:04,620
But maybe shouldn't have had the IDs shipped to his home.

87
00:07:06,880 --> 00:07:10,300
I mentioned earlier I wasn't going to talk about parallel construction.

88
00:07:10,620 --> 00:07:14,980
I'm going to make myself a liar for a moment and talk about parallel construction a little bit.

89
00:07:16,120 --> 00:07:23,140
One of the things the law enforcement agencies investigating needed to do was try to find the actual servers in question.

90
00:07:24,020 --> 00:07:26,940
One of the back-end servers they were trying to find.

91
00:07:27,120 --> 00:07:28,420
Turned out to be in Iceland.

92
00:07:29,510 --> 00:07:37,680
The official story on how that was found was that that server was misconfigured.

93
00:07:37,780 --> 00:07:48,620
So everything was served via Tor except the CAPTCHA on the login screen, which was transmitted over regular internet.

94
00:07:49,220 --> 00:07:52,560
Rob Graham has a really good analysis of that.

95
00:07:52,640 --> 00:07:56,780
Points out why it's actually likely that probably wasn't.

96
00:07:57,120 --> 00:07:57,700
What happened.

97
00:07:57,880 --> 00:08:05,300
But the thing he does point out is through analysis of the evidence the U.S. government released,

98
00:08:06,220 --> 00:08:10,480
the server in question was horribly insecurely configured.

99
00:08:10,940 --> 00:08:18,640
His theory, which makes sense to me, is that the server was actually found through widespread internet scanning by the NSA.

100
00:08:19,360 --> 00:08:25,680
Looking for a couple of things that could link this server back to Silk Road.

101
00:08:25,680 --> 00:08:35,740
The server was allowing regular internet traffic, it just wasn't necessarily through the serving of the CAPTCHA.

102
00:08:37,500 --> 00:08:42,720
So, some lessons learned from this case, configure systems securely.

103
00:08:44,380 --> 00:08:54,420
If you're doing sensitive work and you need for whatever reason to hide what you're doing, don't reuse your personal identifiers.

104
00:08:55,680 --> 00:09:02,520
If you need to ship something securely, think about using a mail drop, something like that.

105
00:09:02,620 --> 00:09:03,700
Don't have it sent to your home.

106
00:09:04,080 --> 00:09:09,680
Also, don't send it from your home, which I'll get into a little bit later in one of the additional cases.

107
00:09:12,720 --> 00:09:13,820
Know who to trust.

108
00:09:14,160 --> 00:09:23,860
Now, this is a very difficult problem when you're dealing with an environment where people are at least somewhat anonymous.

109
00:09:23,860 --> 00:09:29,860
I mean, how do you find, well, I guess the question of how do you find a hitman you can trust, period, is a big one.

110
00:09:29,960 --> 00:09:36,060
But how do you find a hitman you can trust when you can't, do you ask for references for a hitman?

111
00:09:36,160 --> 00:09:36,480
I don't know.

112
00:09:36,560 --> 00:09:42,900
But how do you find a hitman you can trust when anybody can claim to be a hitman and you have no way of knowing if they are or not?

113
00:09:43,900 --> 00:09:48,660
This obviously goes a lot deeper than just hiring people to assassinate other people.

114
00:09:48,940 --> 00:09:51,860
But be aware of your surroundings, as I said.

115
00:09:51,860 --> 00:09:57,540
If you're in a potentially physically hostile environment, don't sit with your back to the room.

116
00:09:59,380 --> 00:10:05,080
And also, if there is a commotion and you need to look up, shut your laptop.

117
00:10:06,440 --> 00:10:11,780
And if you're doing sensitive work as much as possible, don't document your activities.

118
00:10:12,580 --> 00:10:20,440
You're just providing basically free information for whoever your adversary is, be it a nation, state, whatever.

119
00:10:22,260 --> 00:10:29,680
Next case I wanted to look at is called, some that went under the, well, several aliases.

120
00:10:29,720 --> 00:10:31,600
Primary alias is Willie Clock.

121
00:10:33,120 --> 00:10:43,380
Young gentleman in Uganda, legal name Ryan Gustafson, had a pretty successful counterfeiting operation,

122
00:10:43,740 --> 00:10:51,840
which was discovered after someone was found trying to buy a $3.85, I think, cup of coffee with a counterfeit hot dog.

123
00:10:51,860 --> 00:10:52,820
$100 bill in Pittsburgh.

124
00:10:54,740 --> 00:11:00,020
Managed to trace back, they thought it was to Uganda, not sure who it was coming from.

125
00:11:03,640 --> 00:11:09,820
He, again, we see this a lot, reused personal email address.

126
00:11:10,140 --> 00:11:18,700
For one reason or another, I still don't understand why his Jack Farrell alias he set up a pretty full-fledged Facebook page for.

127
00:11:20,020 --> 00:11:29,680
The email address he used for that was the same email he used for his passport application for a legitimate U.S. passport.

128
00:11:33,520 --> 00:11:39,700
In addition, he put a profile picture on this fake Facebook page.

129
00:11:40,560 --> 00:11:42,200
Okay, you know, makes sense.

130
00:11:42,280 --> 00:11:46,180
If you're creating a Facebook page, you want to make it look as realistic as possible.

131
00:11:47,080 --> 00:11:48,680
But he used that.

132
00:11:48,680 --> 00:11:57,020
He used a photo of himself that they were able to match via facial recognition to his state of Texas driver's license.

133
00:11:59,000 --> 00:12:01,500
I have two issues here.

134
00:12:01,620 --> 00:12:05,760
If you're doing something like this, why are you creating a Facebook profile for your alias?

135
00:12:05,900 --> 00:12:11,060
And given that you probably will never be meeting people in person under that name,

136
00:12:11,220 --> 00:12:15,740
if you have to to make it look like a convincing person, just pick a random photo of somebody.

137
00:12:18,800 --> 00:12:23,160
So again, we have the don't reuse identifiers issues.

138
00:12:23,340 --> 00:12:29,000
And if you're trying to set up a cover identity, for the love of God, don't use your real photo.

139
00:12:31,260 --> 00:12:34,740
This kind of now loops back to the Silk Road case.

140
00:12:37,620 --> 00:12:46,460
This, appropriately enough, the fake hitman who turned out to be a DEA agent was incredibly corrupt, among other things.

141
00:12:46,460 --> 00:12:49,040
Ended up stealing hundreds of thousands of dollars.

142
00:12:50,560 --> 00:12:57,720
He was in contact with Dread Pirate Roberts under the alias Knob.

143
00:12:57,940 --> 00:13:00,980
That was a legitimate part of the investigation.

144
00:13:01,400 --> 00:13:07,560
He also, however, created two additional handles to communicate with Ross Ulbrich.

145
00:13:07,660 --> 00:13:10,760
French Made and then one called Death From Above.

146
00:13:14,000 --> 00:13:16,440
Neither the French Made or the French Made,

147
00:13:16,440 --> 00:13:22,880
or Death From Above handles were part of the official investigation.

148
00:13:22,900 --> 00:13:27,760
They weren't endorsed by the people running the multi-agency investigation.

149
00:13:30,640 --> 00:13:38,420
He communicated as both French Made and Death From Above using his DEA work laptop.

150
00:13:39,000 --> 00:13:44,300
Not only that, using his DEA work laptop that was set up because it was being used

151
00:13:44,300 --> 00:13:46,340
for the endorsed communication.

152
00:13:46,340 --> 00:13:47,140
His communication is Knob.

153
00:13:47,220 --> 00:13:49,060
It was set up to log everything.

154
00:13:50,220 --> 00:13:54,720
So they have literal full video recordings of all of his communication.

155
00:13:55,780 --> 00:14:00,620
Pretending to be a hitman, trying to extort money out of him, so on and so forth.

156
00:14:01,100 --> 00:14:06,420
As I mentioned, he ended up attempting to abscond with a pretty large amount of money.

157
00:14:07,280 --> 00:14:13,020
He transferred all of that into bank accounts that were in,

158
00:14:14,620 --> 00:14:15,860
let's just say locations,

159
00:14:15,860 --> 00:14:18,420
with not super strict banking secrecy laws.

160
00:14:18,600 --> 00:14:20,780
And he set them up in his own legal name

161
00:14:21,740 --> 00:14:24,820
with his full legitimate contact information,

162
00:14:25,060 --> 00:14:27,500
home address, phone number, you name it.

163
00:14:31,180 --> 00:14:38,440
So again, we kind of keep coming back to things around segregating your activities.

164
00:14:38,620 --> 00:14:41,760
Whether it's don't reuse identifiers or

165
00:14:43,700 --> 00:14:44,980
don't use,

166
00:14:44,980 --> 00:14:48,300
use a device that you know full well is going to be monitored

167
00:14:48,980 --> 00:14:50,880
to conduct sensitive operations.

168
00:14:52,980 --> 00:14:56,900
Additionally, if you're needing to communicate with someone

169
00:14:56,900 --> 00:14:58,300
and you don't want it traced back to you,

170
00:14:58,340 --> 00:14:59,680
consider the use of aliases.

171
00:14:59,740 --> 00:15:04,000
Although, once again, maybe don't use your personal photograph

172
00:15:04,000 --> 00:15:08,900
if you're creating a social media presence for that.

173
00:15:10,100 --> 00:15:13,740
Next case I want to talk about is Shiny Flakes.

174
00:15:13,740 --> 00:15:18,260
This was a pretty large-scale drug trafficking operation based out of Germany.

175
00:15:18,680 --> 00:15:22,320
It was run by a 20-year-old actually out of his childhood bedroom.

176
00:15:23,120 --> 00:15:28,380
When police arrested him, they confiscated about 48,000 euros in cash,

177
00:15:28,760 --> 00:15:31,260
320 kilograms of various drugs,

178
00:15:31,460 --> 00:15:34,800
and reportedly, although this is somewhat debated,

179
00:15:35,500 --> 00:15:37,920
about 325,000 euros in Bitcoin.

180
00:15:39,020 --> 00:15:42,740
That then led to 38 additional raids following.

181
00:15:42,740 --> 00:15:44,280
Following that arrest.

182
00:15:44,960 --> 00:15:46,700
He's since been convicted.

183
00:15:48,100 --> 00:15:50,980
One of the big mistakes that he made was

184
00:15:51,660 --> 00:15:55,100
almost every single shipment of drugs he sent

185
00:15:55,500 --> 00:16:00,000
was sent from the exact same DHL package station.

186
00:16:00,280 --> 00:16:03,140
It was DHL package station 145,

187
00:16:03,360 --> 00:16:05,220
relatively close to his home.

188
00:16:05,400 --> 00:16:10,360
It was in a location that was under ongoing CCTV surveillance.

189
00:16:11,740 --> 00:16:15,820
Once they figured that that's where the packages were coming from,

190
00:16:15,860 --> 00:16:17,080
narrowed down immediately

191
00:16:19,900 --> 00:16:22,400
what sort of area they needed to look in.

192
00:16:26,140 --> 00:16:29,600
The other mistake that was made was encryption,

193
00:16:29,760 --> 00:16:31,900
or actually complete and total lack thereof.

194
00:16:33,560 --> 00:16:37,820
He stored all of the information about customer transactions,

195
00:16:37,860 --> 00:16:40,140
plans for what he was doing,

196
00:16:40,360 --> 00:16:43,680
all that information in an unencrypted format

197
00:16:43,680 --> 00:16:46,300
on an unencrypted hard drive on his laptop.

198
00:16:50,020 --> 00:16:54,120
Again, kind of linking back to Silk Road,

199
00:16:54,260 --> 00:16:57,880
he also had all of his plans for his activities,

200
00:16:58,700 --> 00:17:03,780
as well as an unencrypted list of all of his logins and passwords

201
00:17:04,200 --> 00:17:08,260
for all of the various selling platforms he was using,

202
00:17:08,340 --> 00:17:09,500
all that sort of information.

203
00:17:11,960 --> 00:17:13,340
So, lessons learned.

204
00:17:13,480 --> 00:17:15,520
If you're shipping something sensitive,

205
00:17:16,180 --> 00:17:19,040
if you're, for instance, a whistleblower,

206
00:17:19,100 --> 00:17:25,580
and you need to send a large volume of paper documents to a reporter,

207
00:17:26,520 --> 00:17:28,960
maybe split those up into multiple shipments

208
00:17:28,960 --> 00:17:31,100
and scatter where you're sending them from.

209
00:17:32,160 --> 00:17:35,320
Encrypt your data, and again, for the love of God,

210
00:17:35,480 --> 00:17:37,360
don't document your activities.

211
00:17:39,380 --> 00:17:42,360
Very recent case was AlphaBay,

212
00:17:43,020 --> 00:17:47,200
which kind of became one of the successors of Silk Road.

213
00:17:48,160 --> 00:17:51,000
That pretty much dominated the marketplace,

214
00:17:51,240 --> 00:17:56,240
mostly in the area of selling and purchasing illicit substances

215
00:17:56,240 --> 00:17:58,700
following the shutdown of Silk Road.

216
00:17:59,360 --> 00:18:01,480
Servers for that were located in Quebec.

217
00:18:02,540 --> 00:18:07,000
The alleged administrator was living in Thailand,

218
00:18:07,360 --> 00:18:11,640
and I say alleged because there was very good evidence against him.

219
00:18:11,680 --> 00:18:16,440
He chose to take his own life while awaiting extradition to the U.S.

220
00:18:17,120 --> 00:18:22,180
That was shut down this month, I think July 4th of this year.

221
00:18:22,580 --> 00:18:25,100
At its peak, they estimated that AlphaBay

222
00:18:25,100 --> 00:18:29,940
was making between $600,000 and $800,000 U.S. in revenue.

223
00:18:33,820 --> 00:18:37,340
Again, welcome messages and password requests

224
00:18:37,340 --> 00:18:39,760
reset messages for AlphaBay were sent

225
00:18:40,340 --> 00:18:42,480
using the administrator's Hotmail account,

226
00:18:43,140 --> 00:18:46,540
which was, I think, his name was Alex.

227
00:18:46,620 --> 00:18:49,160
I think the email address was

228
00:18:50,720 --> 00:18:52,380
pimpalexnumericstring at hotmail.com,

229
00:18:53,180 --> 00:18:56,100
which he also used for lots of other personal communication,

230
00:18:56,360 --> 00:18:57,260
that sort of stuff.

231
00:18:59,620 --> 00:19:01,180
Again, lesson learned.

232
00:19:01,300 --> 00:19:03,880
Segregate your activities and your communications method

233
00:19:03,880 --> 00:19:06,940
if you're performing some sort of sensitive activity.

234
00:19:09,100 --> 00:19:11,920
One last case that I wanted to talk about,

235
00:19:12,040 --> 00:19:15,460
and this was a number of years ago.

236
00:19:15,560 --> 00:19:21,140
It's a little different in that it's not actually a dark web case.

237
00:19:21,600 --> 00:19:24,400
This was all performed on ClearNet.

238
00:19:25,060 --> 00:19:27,420
The arrest was made in 2014.

239
00:19:28,980 --> 00:19:33,920
A gentleman from Russia by the name of Roman Seliznev

240
00:19:33,920 --> 00:19:36,520
went under these various handles.

241
00:19:36,520 --> 00:19:38,040
What he would do is, essentially,

242
00:19:38,180 --> 00:19:39,640
when investigators got close,

243
00:19:39,780 --> 00:19:41,280
he would shut down operations,

244
00:19:41,660 --> 00:19:44,620
open up operations immediately on Carter forums

245
00:19:45,360 --> 00:19:47,040
under a new alias.

246
00:19:47,640 --> 00:19:50,200
One of the ways that they initially started

247
00:19:50,200 --> 00:19:51,900
suspecting that it was the same person

248
00:19:51,900 --> 00:19:55,320
is he would start up under a new alias

249
00:19:55,320 --> 00:19:57,060
on a Carter forum

250
00:19:57,060 --> 00:20:00,380
and immediately be elevated to the highest trust levels,

251
00:20:01,680 --> 00:20:04,900
which normally you wouldn't see in that sort of environment

252
00:20:04,900 --> 00:20:06,460
for a new seller.

253
00:20:06,680 --> 00:20:09,260
He was arrested in 2014, as I said.

254
00:20:09,640 --> 00:20:12,120
He was on vacation in the Maldives,

255
00:20:12,140 --> 00:20:15,020
found with a laptop with just under 2 million

256
00:20:15,020 --> 00:20:16,460
stolen credit cards on it.

257
00:20:20,400 --> 00:20:24,420
As I mentioned, the sites that he ran

258
00:20:24,420 --> 00:20:27,040
for selling stolen credit cards were on the ClearNet.

259
00:20:27,280 --> 00:20:29,360
When he registered the domains for those,

260
00:20:29,540 --> 00:20:31,920
he used his personal email address.

261
00:20:33,300 --> 00:20:38,180
Most of the sites were served from a server

262
00:20:38,180 --> 00:20:41,560
from a provider in McLean, Virginia.

263
00:20:42,360 --> 00:20:47,100
He also used that server as basically his workstation.

264
00:20:47,280 --> 00:20:49,800
He did things like make travel plans,

265
00:20:50,140 --> 00:20:50,980
order tickets,

266
00:20:51,840 --> 00:20:54,400
order tickets transmitting his passport number,

267
00:20:54,640 --> 00:20:55,780
those sorts of things.

268
00:20:56,640 --> 00:20:59,840
And, again, his, like we saw before,

269
00:21:00,100 --> 00:21:01,900
laptop had,

270
00:21:01,920 --> 00:21:04,520
had a large volume of plain text passwords

271
00:21:04,520 --> 00:21:06,680
for his sites, that sort of thing,

272
00:21:06,800 --> 00:21:09,340
just stored unencrypted on the laptop.

273
00:21:11,920 --> 00:21:14,860
Again, I'm apparently just going to keep hammering this point

274
00:21:14,860 --> 00:21:15,560
until I'm done.

275
00:21:16,480 --> 00:21:18,100
Don't document your activities,

276
00:21:18,220 --> 00:21:20,460
unless there's a really good reason for it.

277
00:21:21,000 --> 00:21:23,080
And, again, segregate your activities.

278
00:21:23,240 --> 00:21:27,280
If you're using a system for sensitive activities

279
00:21:27,280 --> 00:21:29,080
that you don't want traced back to you,

280
00:21:29,480 --> 00:21:30,880
maybe don't use it to buy

281
00:21:31,920 --> 00:21:33,800
airplane tickets for you and your wife to go on vacation.

282
00:21:34,600 --> 00:21:37,080
The email address that he used for,

283
00:21:38,880 --> 00:21:40,920
for registering websites was also used

284
00:21:40,920 --> 00:21:43,160
for registering a PayPal account for himself

285
00:21:43,740 --> 00:21:45,140
and sending his wife flowers,

286
00:21:45,620 --> 00:21:46,980
which is a wonderful thing to do,

287
00:21:47,020 --> 00:21:48,700
but maybe use a different email address for that.

288
00:21:54,820 --> 00:21:55,260
So,

289
00:21:55,960 --> 00:21:58,020
ooh, that ended a lot quicker than I expected.

290
00:21:58,100 --> 00:21:58,720
In conclusion,

291
00:21:58,720 --> 00:22:01,780
kind of a summary of the,

292
00:22:01,780 --> 00:22:04,000
the common lessons learned we see here

293
00:22:04,000 --> 00:22:05,660
are configure systems securely,

294
00:22:05,940 --> 00:22:07,360
know who to trust,

295
00:22:07,520 --> 00:22:09,980
which obviously in an anonymized environment

296
00:22:09,980 --> 00:22:11,740
is very difficult to do.

297
00:22:11,900 --> 00:22:14,700
I don't have any solutions on that.

298
00:22:14,760 --> 00:22:15,900
If someone does,

299
00:22:16,100 --> 00:22:18,220
I would love to hear some ideas

300
00:22:18,220 --> 00:22:19,980
during the Q&A section.

301
00:22:20,620 --> 00:22:22,340
Always be aware of your surroundings.

302
00:22:23,200 --> 00:22:24,700
Don't document your activities,

303
00:22:24,960 --> 00:22:25,920
encrypt your data,

304
00:22:26,000 --> 00:22:28,700
and, again, segregate your activities.

305
00:22:28,700 --> 00:22:30,320
And, and communication methods.

306
00:22:31,720 --> 00:22:32,240
Questions?

307
00:22:33,140 --> 00:22:33,660
Comments?

308
00:22:36,300 --> 00:22:36,980
Can you?

309
00:22:45,780 --> 00:22:46,420
Good day.

310
00:22:46,780 --> 00:22:47,660
That last,

311
00:22:47,680 --> 00:22:48,640
last case with the

312
00:22:48,640 --> 00:22:49,420
Yeah.

313
00:22:50,380 --> 00:22:51,680
Now, you mentioned he got elevated

314
00:22:51,680 --> 00:22:53,100
to the highest level of trust

315
00:22:53,100 --> 00:22:54,600
whenever he created a new account.

316
00:22:54,940 --> 00:22:56,240
Any idea on how that was done?

317
00:22:56,940 --> 00:22:57,460
The,

318
00:22:57,460 --> 00:23:00,280
the assumption is that he knew people on,

319
00:23:00,360 --> 00:23:02,640
when he would set up a new identity on a card or forum,

320
00:23:02,780 --> 00:23:04,760
he already knew people on those forums.

321
00:23:04,840 --> 00:23:05,760
Again, we're kind of,

322
00:23:05,800 --> 00:23:08,620
no, they did have established trust relationships.

323
00:23:09,300 --> 00:23:09,700
So,

324
00:23:09,700 --> 00:23:12,660
typically how it works on a card or forum is,

325
00:23:12,780 --> 00:23:16,340
is you register with a relatively low privilege account,

326
00:23:16,560 --> 00:23:17,960
and until you can provide,

327
00:23:18,000 --> 00:23:18,380
you know,

328
00:23:18,400 --> 00:23:21,580
X number of stolen credit cards or something like that,

329
00:23:21,660 --> 00:23:23,140
they're worried you might be a Fed,

330
00:23:23,300 --> 00:23:26,360
so they're not going to give you access to everything.

331
00:23:27,000 --> 00:23:28,380
So, anytime,

332
00:23:28,840 --> 00:23:29,280
you know,

333
00:23:29,280 --> 00:23:29,580
I,

334
00:23:29,700 --> 00:23:32,640
my assumption is that he communicated with,

335
00:23:32,720 --> 00:23:32,980
you know,

336
00:23:33,000 --> 00:23:34,220
administrators of the forum,

337
00:23:34,260 --> 00:23:34,400
said,

338
00:23:34,500 --> 00:23:34,680
hey,

339
00:23:34,740 --> 00:23:36,140
this is actually NCOX.

340
00:23:36,380 --> 00:23:37,040
And they said,

341
00:23:37,140 --> 00:23:37,360
okay,

342
00:23:37,420 --> 00:23:38,100
can you prove it?

343
00:23:38,180 --> 00:23:39,900
And he did whatever to prove it.

344
00:23:39,940 --> 00:23:40,280
And then they said,

345
00:23:40,320 --> 00:23:40,480
okay,

346
00:23:40,580 --> 00:23:41,580
we'll bump you up to the top.

347
00:23:41,900 --> 00:23:42,260
Cool.

348
00:23:42,360 --> 00:23:42,720
Thanks.

349
00:23:43,060 --> 00:23:43,300
Yep.

350
00:23:58,000 --> 00:24:02,540
In the case where he was shipping from one DHL station?

351
00:24:02,800 --> 00:24:02,940
Yeah.

352
00:24:03,380 --> 00:24:03,900
So,

353
00:24:04,000 --> 00:24:05,440
would the recommendation just be to,

354
00:24:05,480 --> 00:24:05,660
like,

355
00:24:05,660 --> 00:24:06,620
drive out,

356
00:24:06,640 --> 00:24:08,160
use a different station?

357
00:24:08,420 --> 00:24:08,920
Well,

358
00:24:09,040 --> 00:24:09,580
I,

359
00:24:09,640 --> 00:24:11,740
I think the recommendation is actually not only,

360
00:24:11,800 --> 00:24:14,300
not just drive out to a remote location,

361
00:24:14,560 --> 00:24:16,480
but a number of remote locations.

362
00:24:16,900 --> 00:24:17,560
You know,

363
00:24:17,580 --> 00:24:18,860
using the whistleblower example,

364
00:24:19,160 --> 00:24:19,780
because,

365
00:24:19,960 --> 00:24:20,480
I mean,

366
00:24:21,220 --> 00:24:22,680
you're all free to do what you want to do,

367
00:24:22,720 --> 00:24:25,640
but I'm kind of focusing this on non-criminal enterprises.

368
00:24:25,640 --> 00:24:27,640
Using the whistleblower example,

369
00:24:28,060 --> 00:24:28,480
you know,

370
00:24:28,500 --> 00:24:32,660
you have 10 reams of paper that you need to get to a reporter.

371
00:24:33,180 --> 00:24:33,660
Maybe,

372
00:24:33,800 --> 00:24:34,620
and I'm just picking,

373
00:24:34,760 --> 00:24:35,260
you know,

374
00:24:35,260 --> 00:24:35,960
a number at random,

375
00:24:35,980 --> 00:24:38,080
maybe split that into 10 separate shipments.

376
00:24:38,620 --> 00:24:40,020
Not necessarily drive to,

377
00:24:40,060 --> 00:24:40,360
you know,

378
00:24:40,360 --> 00:24:42,300
10 cities each 100 miles from you,

379
00:24:42,400 --> 00:24:42,820
but,

380
00:24:42,840 --> 00:24:43,760
you know,

381
00:24:43,760 --> 00:24:45,480
a couple of different towns,

382
00:24:45,600 --> 00:24:47,340
maybe one a bit remote,

383
00:24:47,480 --> 00:24:48,180
that sort of thing.

384
00:24:56,380 --> 00:24:58,640
I know for a number of these cases,

385
00:25:00,500 --> 00:25:01,460
correlation of,

386
00:25:01,560 --> 00:25:01,740
like,

387
00:25:01,740 --> 00:25:02,500
the timing of,

388
00:25:02,560 --> 00:25:02,720
like,

389
00:25:02,720 --> 00:25:05,500
when these users were active was one of the,

390
00:25:05,600 --> 00:25:05,960
like,

391
00:25:06,800 --> 00:25:10,920
factors that led to them being taken away and captured.

392
00:25:11,140 --> 00:25:11,340
So,

393
00:25:11,400 --> 00:25:13,260
what would you recommend for,

394
00:25:13,300 --> 00:25:13,480
like,

395
00:25:13,480 --> 00:25:14,920
defending against correlation attacks?

396
00:25:15,160 --> 00:25:15,280
And,

397
00:25:15,300 --> 00:25:15,460
like,

398
00:25:15,520 --> 00:25:16,280
I know that,

399
00:25:16,340 --> 00:25:16,540
like,

400
00:25:17,380 --> 00:25:17,860
using,

401
00:25:17,980 --> 00:25:18,260
like,

402
00:25:18,260 --> 00:25:21,440
encrypted traffic in a public place is often suggested,

403
00:25:21,720 --> 00:25:21,900
but,

404
00:25:21,940 --> 00:25:22,100
like,

405
00:25:22,620 --> 00:25:23,280
that can still be,

406
00:25:23,360 --> 00:25:23,480
like,

407
00:25:25,640 --> 00:25:25,940
can be,

408
00:25:26,000 --> 00:25:26,420
and,

409
00:25:26,560 --> 00:25:26,880
you know,

410
00:25:26,920 --> 00:25:31,920
this kind of touches on the whole parallel construction thing that I referenced earlier.

411
00:25:32,580 --> 00:25:33,200
You know,

412
00:25:33,200 --> 00:25:33,700
the concern,

413
00:25:33,760 --> 00:25:34,020
obviously,

414
00:25:34,160 --> 00:25:35,740
depending on who you're worried about is,

415
00:25:35,900 --> 00:25:36,140
you know,

416
00:25:36,180 --> 00:25:40,680
do you have a nation-state attacker that is going to be able to easily break whatever

417
00:25:40,680 --> 00:25:42,580
transmission encryption you're using?

418
00:25:43,400 --> 00:25:46,120
I think probably the best thing is,

419
00:25:46,340 --> 00:25:46,980
you know,

420
00:25:47,000 --> 00:25:51,220
I go back to the Ross Ulbrich case and him being arrested at the library.

421
00:25:51,360 --> 00:25:55,320
I honestly think him working from the library was probably a pretty good idea.

422
00:25:56,220 --> 00:26:01,040
Him not being aware of his surroundings was one of the things that led to his conviction.

423
00:26:02,100 --> 00:26:02,580
But,

424
00:26:03,640 --> 00:26:08,700
going somewhere where you can essentially hide in plain sight along with a lot of other

425
00:26:08,700 --> 00:26:09,280
traffic,

426
00:26:09,940 --> 00:26:10,680
coffee shop,

427
00:26:10,720 --> 00:26:11,000
library,

428
00:26:11,180 --> 00:26:12,240
that sort of thing.

429
00:26:12,560 --> 00:26:12,680
And,

430
00:26:12,800 --> 00:26:13,240
but again,

431
00:26:13,560 --> 00:26:13,800
I mean,

432
00:26:13,820 --> 00:26:17,100
this kind of comes back to the shipping issue.

433
00:26:17,360 --> 00:26:17,860
You know,

434
00:26:17,900 --> 00:26:21,640
if you always go to the same Starbucks that's two blocks from your house,

435
00:26:23,220 --> 00:26:23,700
yeah,

436
00:26:23,700 --> 00:26:27,420
you're going to be somewhat hidden in the other traffic occurring at the Starbucks,

437
00:26:27,580 --> 00:26:29,320
but it's not that difficult to go,

438
00:26:30,280 --> 00:26:30,720
okay,

439
00:26:30,800 --> 00:26:32,440
so we watch everybody at the Starbucks,

440
00:26:32,660 --> 00:26:33,980
and we think it's this guy.

441
00:26:34,080 --> 00:26:34,220
Now,

442
00:26:34,280 --> 00:26:34,680
what is,

443
00:26:34,700 --> 00:26:35,140
you know,

444
00:26:35,160 --> 00:26:35,900
what is he doing?

445
00:26:36,080 --> 00:26:36,400
Right,

446
00:26:36,420 --> 00:26:39,040
because if you're the only person on tour at that time.

447
00:26:39,120 --> 00:26:39,520
Right.

448
00:26:39,980 --> 00:26:40,420
Okay.

449
00:26:41,140 --> 00:26:41,580
So,

450
00:26:41,660 --> 00:26:43,280
locations are very important.

451
00:26:43,480 --> 00:26:43,760
Yeah.

452
00:26:44,100 --> 00:26:44,540
Yeah,

453
00:26:44,560 --> 00:26:45,960
and mixing up the locations,

454
00:26:46,020 --> 00:26:46,420
as I,

455
00:26:46,420 --> 00:26:47,400
as I referenced.

456
00:26:49,060 --> 00:26:49,500
So,

457
00:26:49,500 --> 00:26:51,500
you mentioned the segregation of activities.

458
00:26:52,000 --> 00:26:52,880
Do you recommend,

459
00:26:53,000 --> 00:26:53,540
you know,

460
00:26:53,540 --> 00:26:54,600
physical separations,

461
00:26:54,600 --> 00:26:55,020
for example?

462
00:26:55,080 --> 00:26:55,380
Always.

463
00:26:55,860 --> 00:26:56,700
Different computers?

464
00:26:57,040 --> 00:26:57,320
Different,

465
00:26:57,340 --> 00:26:58,800
entirely different computers.

466
00:26:59,100 --> 00:27:00,180
Different networks,

467
00:27:00,400 --> 00:27:00,640
and?

468
00:27:01,080 --> 00:27:01,600
If,

469
00:27:01,660 --> 00:27:02,380
if possible,

470
00:27:02,600 --> 00:27:02,860
yes,

471
00:27:02,960 --> 00:27:03,220
but,

472
00:27:03,280 --> 00:27:03,660
I mean,

473
00:27:03,680 --> 00:27:04,580
at the very least,

474
00:27:04,580 --> 00:27:05,020
different,

475
00:27:05,060 --> 00:27:06,540
very different computers,

476
00:27:06,660 --> 00:27:07,720
different logins,

477
00:27:08,380 --> 00:27:09,060
you know,

478
00:27:09,060 --> 00:27:09,460
different,

479
00:27:09,480 --> 00:27:10,920
use different email addresses.

480
00:27:11,240 --> 00:27:11,880
You know,

481
00:27:11,960 --> 00:27:12,040
I,

482
00:27:12,120 --> 00:27:14,240
almost every single one of these cases,

483
00:27:14,300 --> 00:27:17,480
one of the pivotal things was the reuse of a personal email address.

484
00:27:17,900 --> 00:27:18,080
I,

485
00:27:18,120 --> 00:27:19,540
I also heard someone saying,

486
00:27:20,140 --> 00:27:20,660
we,

487
00:27:20,660 --> 00:27:23,160
we should also set up separate networks,

488
00:27:23,160 --> 00:27:23,520
you know,

489
00:27:23,520 --> 00:27:24,080
network access,

490
00:27:24,100 --> 00:27:25,980
or ISPs at home,

491
00:27:26,120 --> 00:27:27,420
even if you are using VPN.

492
00:27:27,740 --> 00:27:28,660
What would you do?

493
00:27:29,020 --> 00:27:29,540
Yeah,

494
00:27:29,660 --> 00:27:29,880
I mean,

495
00:27:29,900 --> 00:27:30,140
there's,

496
00:27:30,140 --> 00:27:32,720
there's certainly some advantage in,

497
00:27:32,800 --> 00:27:33,640
in that,

498
00:27:33,720 --> 00:27:35,440
although you do run the risk of,

499
00:27:35,660 --> 00:27:37,620
so now they see that there's,

500
00:27:37,620 --> 00:27:38,160
you know,

501
00:27:38,180 --> 00:27:39,060
at this location,

502
00:27:39,180 --> 00:27:41,340
there's basically two different traffic flows.

503
00:27:41,720 --> 00:27:45,840
They still know that one of them is whatever sensitive activity you're,

504
00:27:45,840 --> 00:27:46,640
you're performing.

505
00:27:47,260 --> 00:27:47,780
Again,

506
00:27:47,940 --> 00:27:48,160
I,

507
00:27:48,240 --> 00:27:48,980
I come back,

508
00:27:49,020 --> 00:27:49,300
kind of,

509
00:27:49,320 --> 00:27:50,480
to that hide in plain sight,

510
00:27:51,160 --> 00:27:51,680
strategy.

511
00:27:52,140 --> 00:27:52,360
So,

512
00:27:52,360 --> 00:27:52,800
so,

513
00:27:53,120 --> 00:27:54,240
In fact,

514
00:27:55,680 --> 00:27:55,960
Anyone else?

515
00:27:59,460 --> 00:28:00,020
Okay.

516
00:28:00,260 --> 00:28:01,320
Thank you very much.

517
00:28:06,320 --> 00:28:07,440
And I'll be back with some more end of the conversation.

518
00:28:07,440 --> 00:28:07,460
Thank you for listening.

519
00:28:07,600 --> 00:28:07,620
Bye.

520
00:28:07,620 --> 00:28:07,660
Thank you.