Hacker News Reader

Comment by sebmellen | Hacker News Reader

It always surprises me how hard it seems for people to take OpSec seriously (whether for terrorist plots or darknet markets). There are really a few basic ground rules that always seem to be violated, even by those with seemingly sufficient experience, like Ross Ulbricht.

On the note of OpSec, there's an awesome project called USBKill, which probably would've saved Ross Ulbricht from prison.

> USBKill is anti-forensic software distributed via GitHub, written in Python for the BSD, Linux and OS X operating systems. It is designed to serve as a kill switch if the computer on which it is installed should fall under the control of individuals or entities the owner or operator does not wish it to. It is free software, available under the GNU General Public License. [1]

[0]: https://github.com/hephaest0s/usbkill

[1]: https://en.m.wikipedia.org/wiki/USBKill

View on HN

The refusal to wear masks, which is a trivial form of "opsec" against infection, shows what happens.

It's boring, uncomfortable, unsexy, protects you against an outcome you think is low probability, and you don't find out if you're doing it right - only if you've done it wrong, by which time it's too late.

Besides, since these terrorists had no concrete grievance, only internet radicalization, they ended up doing more cosplay than effectiveness.

A funny side note with that... there was a recent theft of $3000 worth of Crest Whitestrips in my city that got some news attention. It was 3x 40-50 year old white folks that did the theft; the woman distracted the clerk while the two men loaded up. All caught on camera. AND THEY DIDN’T WEAR MASKS.

They had every opportunity to cover up their faces in a completely socially acceptable way and didn’t. C’mon.

I guess the only people who need to whiten their teeth right now are anti-maskers.

I've also thought about this, why most terrorists are so dumb.

I think it's because if they were smart, they would realize how hard it is to get away with it. This is literally one of the few criminal acts where no expenses will be spared in catching the perps.

Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism.

Regarding Ross, once they figured out his name, it was over for him, USBKill or not.

>I've also thought about this, why most terrorists are so dumb.

My theory is that when a terrorist does a stupid thing there are millions of dollars available, and thousands of people trained and ready, to take advantage of that stupidity.

When we do something stupid a couple people might point at us and say slightly mean things.

Everyone is stupid at least a few times a day.

Public perception about the average intelligence of any type of criminal is likely influenced by survivorship bias: https://en.wikipedia.org/wiki/Survivorship_bias

On the bright side, an attested (N=1) method for de-radicalising former terrorists has been simply hooking them up. They may be dumb, but they're not stupid: https://www.theatlantic.com/magazine/archive/2001/12/all-you...

So we must sacrifice one person to save many?

What makes you think it's a sacrifice rather than a reverse proselytization (or de-radicalization as some call it)?

For the flagger: quoting the opening line of Pride and Prejudice is simply a more verbose way to say /s.

(I have double checked, and all three of google, weibo, and yandex pull Austen up as the top hit for the key phrase.)

Also note that criminals are the ones who failed. We don't get to see how the successful ones are. Same with terrorists.

Unlike most other crimes, a terrorist act that goes unnoticed is almost by definition unsuccessful.

Well, there's a conspicuously unoccupied middle ground between the two, but if the terrorist's goal is only to inflict harm, without necessarily revealing the reason or taking credit, they would presumably prefer their actions to look like a natural disaster, riot, (industrial/medical/etc) accident, forest fire, or other non-deliberate and/or non-planned event.

That is not terrorism though. The point of terrorism is to achieve political goals by spreading fear.

That's true by definition, sure, but that's not how governments actually use the word.

How would causing a riot not achieve political goals by spreading fear?

I dunno. I believe it's actually pretty easy to get away with lots of crime. It's just that the smart ones don't get caught.

> Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism.

that probably plays a role. And they are perhaps more likely to consider the ethical dimension.

"Also, smart people tend to do something with their life,"

Dunno. The Unabomber had probably a higher IQ than most people on hackernews.

And on a side note: who cares about James bond? It is always the villain who makes or breaks a James bond movie. I am actually sad that Jet Lee never played the villain.

Your comment was extremely insightful. Thank you for this. I rarely favorite (to be fair I only knew about it recently) but...your comment is in my favorites.

USBkill is useful if you want to prevent cops from seeing what you have saved in your porn folder. It wont stop them from tapping your facebook chats. Or bugging your basement prepper shelter. Or tracking your cellphone movements. In cases like this, whether the cops can pull anything from your harddrive doesnt change anything.

> There are really a few basic ground rules that always seem to be violated, even by those with seemingly sufficient experience, like Ross Ulbricht.

Well yes, for the people that get caught.

and then the DOJ always says "see! this proves you can't hide from us"

and everyone else on darknet is like "yeah here's the refined checklist implementation for how not to get caught and here's why" which should be like everyone's first purchase on any darknet market for $.99 and should be any vendor's primary first item for sale to gain reputation

I pretty much never see indictments that actually undermine the best practices.... you don't need to pay to understand the best practices, but it does save time to see what the tools are that implement those best practices, or understanding why some secret chat apps should be avoided versus others.

Getting caught is not just about OPSEC, but also visibility. The DOJ has limited time and resources, so will always go after the "big fish" and the cases that give them the best PR.

If you had two scenarios:

1. Great OPSEC, high profile

2. OK OPSEC, minimal profile

You're still at greater risk for scenario #1. When Ross Ulbricht did his Forbes interview and basically said "I dare the gov't to shut me down", he pretty much guaranteed they'd go to the ends of the earth to shut him down.

The only thing worse than committing multiple felonies is making the gov't look stupid or weak.

Right, you don’t want governments running half of the exit nodes looking for you, while posing as moderators, customers and running your whole website just to take you down in your ongoing crime.

But precise targeted activities that require investigation later are pretty ease to have sufficient OPSEC for.

Only correct you to say not about making the government look weak, it’s about the ego of the persons who are in leadership in those government organizations. Entirely about people and their careers and vanities and not so much about the government which belongs to us voters.

I mean if you see some dude with nothing for sale but "how to not get busted doing crimes really i promise.txt"...

More seriously, there's an element of performative deterrence in the way stuff like this gets handled. Giving people without the experience to know it's nonsense the idea they can't do dark web crimes and get caught probably cuts down on the rate of people dipping a toe into the exciting world of dark web crimes, where they can for example learn how to not get caught and then talk on the open web about how much they know I guess? What kind of opsec is that?

there is different OPSEC for different attack vectors

in the universe of dark web activities, most of them are not crimes and of the crimes most of those do not require stonewalling an eventual multi-jurisdictional state actor

there are just different OPSEC models, if we aren't talking about crimes its fine to talk on the open web about them, some of those OPSEC models would still accomplish thwarting the aforementioned threat model.

OpSec is HARD. It is a challenge for militaries, brilliant hackers and dumb criminals.

I once, just for the fun of the exercise, tried to set up an unused netbook and be as safe as possible.

It was incredibly difficult to not mess up, knowing what I know. In practice, I'd say it was usually convenience or rote behavior that caused me to 'compromise' the laptop.

It was a humbling experience, and while I had no aspirations to become a spy, it showed me how bad I'd probably be at it.

You never hear about the people who do take opsec seriously.

Criminals are not dumb, the ones you hear about are.

You pull the tails usb out and it does a far better job, this is shit software aimed at people with shit practices and there's simply no nice or pleasant way to say it.

Just fucking use tails if you are a terrorist intent on murdering billions of people.

If you're that ambitious of a terrorist you have faceless minions to travel to internet cafes in distant locations and access the internet for you. Using Tails wouldn't do a damn thing for such a high-profile target, though; Osama bin Laden didn't have interwebs at all in Abbottabad, and the US government still dropped in for a visit.

Reply on news.ycombinator.com