#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd

What Hacker News said

Strong rec hackermatic · 2024-05 · on “DNS traffic can leak outside the VPN tunnel on Android”

Edit: Other commenters report that Android will silently re-enable cell data under various conditions, so this isn't a surefire solution, either. The Grugq created a tool for this a decade ago (sadly unmaintained): [LINK] as part of a presentation about operational security for hackers. It's a great watch if you're interested in how various (in)famous hackers thought they were secure and got busted anyway. [this video]

Recommends notaddicted · 2013-02 · on “The Best Anonymous VPNs For 2013”

Any thoughts on Mullvad? ( [LINK] ) I also like the conference talk "#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd" most of it is based on hackers that have been jailed lately and specifically what they did to end up in jail, but there is also some techinal stuff about privacy and anonymity, specifically about TOR+VPN here: [this video] EDIT: RE: Mullvad, AFAIK they don't have any presence outside SE, NL, or DE so I think your speeds will take a hit coming from outside Western Europe.

Recommends iuguy · 2013-05 · on “Poll: Do you use your real identity on HN?”

Using a pseudonym may be great, but there's always the temptation to be more abrasive, offensive or obnoxious when using one. The longer you keep an identity online in public forums the more information you tend to leak through side channels and should your identity end up compromised you risk having a lot more exposed than if you never covered at all and thought (mostly) before posting. I've chosen to use my real name here because of the level of conversation when I joined and because I've associated HN initially more with the traditional hacker world than the blackhat type. Those of you using pseudonyms could do worse than learn from the Grugq[1]. [1] - [this video]

Recommends j_s · 2013-10 · on “It Was DPR, in the Tor HS, With the BTC”

Watch the author's 'OPSEC for hackers' presentation of the slides linked in the article: [this video] slides: [LINK]

Recommends j_s · 2013-10 · on “Steps You Can Take Right Now Against Internet Surveillance”

'grugq' shares current best practice, and recently stopped by HN when his blog came up for discussion: Anonymity Is Hard [LINK] OPSEC for Hackers (video) [this video]

Recommends WestCoastJustin · 2013-11 · on “Interview: OPSEC with the grugq”

There is a really good video of OPSEC by grugq on YouTube from Hack In The Box Security Conference. Basically gives you some rules and things to think about, but also talks about where lulzsec went off the rails, and how they were caught. Really interesting talk. [this video]

Recommends epsylon · 2014-06 · on “The boy who stole Half Life 2 source code (2011)”

I must have been following the grugq[1] way too much because all I couldn't help thinking about the massive OPSEC mistakes he did. Fortunately he was apprehended by the German Police, but things would've been way different had took that plane. [1] There's a great presentation from him on video, including analysis of OPSEC failures from other hacker groups: [this video] [2] Another timeless classic: "Don't talk to [the] police", which explains why it is never in your interest to talk to the police when you are suspected of a crime (even if you are innocent): [LINK]

Recommends blauwbilgorgel · 2014-11 · on “Doxxing defense: Remove your personal info from data brokers”

Just because a data aggregation site does not show your data on the front-end, does not mean they deleted it from the back-end. So now you can charge 50$ for people to search in the "special" data pile, where people took the effort to remove it from the front-end. These data brokers crawl publicly available information. Telling them to remove your data, only slows down the doxxer, it does not stop them at all, since the data was already shared. It is not plugging the leak, it is mopping up some of the water. A false sense of security and a clear sign to the doxxer that you care about your anonymity (so more "lulz" to be had). A proper doxxing is also much more than entering a name in some se