Hacker News Reader

Comment by oefrha | Hacker News Reader

The main takeaway for me is the following. Everything you post online will end up in a public archive. That includes everything you post to supposedly private or semi-private venues, like Telegram channels. Everything you posted when you were a dumb kid will be there too, however long ago that was. So, if you’re gonna be a cybercrminal, make absolutely sure that you start with a clean slate. No one can know the connections to your past, because even if you’re careful, other idiots can let slip (like using your old moniker to address you) at any time. And don’t post fucking photos, ever.

View on HN

Hilarious case in point

https://www.cbsnews.com/news/carl-stewart-drug-dealer-identi...

I don't buy that they got his fingerprints and palm prints from that photo.

Why not? Seems like a pretty clear shot of three of his fingers and a good partial print of his thumb. I assume the original was higher resolution than the version in the article.

The CCC made a point a couple years ago by publishing finger prints of high ranking German government officials extracted from photos

I think they went even further and 3d printed their thumbprint and unlocked their phone with it, if I remember correctly.

Just change your thumbprint after a leak, no problem.

A dedicated criminal wouldn’t have fingerprints.

Fingerprint tech is ridiculously advanced. I saw a documentary where they lifted a print off a pillow case decades later.

I did fingerprints from a digital photo in 2012 maybe earlier. Old mate was holding up drugs to be photographed. Bit of contrast, blew it up, sent it to fingerprint bureau and what would you know, we had those prints on file. Not the crime of the century and not absolute proof, but a damn good start for a case from a simple post on socials. More useful than most intel/hearsay that ends up in crimestoppers or similar channels.

No longer a friend?

"Old mate" is an Australian/NZ colloquial term for someone who you either don't know or don't want to name.

The ads under that article are about as funny as the article itself. Lots of hilariously bad AI generated images and stuff

You don't run an adblocker?

Clearly they don’t.

Maybe his comment is an opsec deflection strategy.

Remember when the NYT published a high-res, straight-on photo of the TSA luggage master key? Good times.

It's not like you can't find them on Amazon for cheap. There's also more than one master key it's a whole set. That said, when the lock picking lawyer bought a bunch of TSA locks, they all used master key #7 I think.

Eh. Wasn’t a big deal honestly.

It takes little effort to reproduce the key by disassembling the lock to get access to the plug.

I assume the original was a lot higher resolution, else that stinks of parallel reconstruction.

The article also mentioned the whole platform he was using was cracked by police. They might have been able to get the metadata but not want to explain that to others still using that platform.

The BBC made a good podcast about the busting of Enchrochat.

https://www.bbc.co.uk/programmes/m001v9ds

Possibly/probably only available to UK IP addresses.

Plays fine in France.

I think most audio-only BBC programmes are available globally, even if they sometimes have ads inserted into them which aren't present if you're in the UK.

Here's a direct podcast URL you can add via your favorite podcast app:

https://podcasts.apple.com/ca/podcast/gangster/id1562843329

This reminds me of things that I've read about intelligence agencies increasingly finding it impossible to give agents fake identities for cover; everyone now has just left too much of a trail of data behind them. And if you find or create someone with no such trail, that stands out as being suspicious.

As an aside, this is a paradox that has fascinated me for a while. Potentially any step that we take to be more private or anonymous makes us stand out more, thus easier to track and re-identify, because we end up in a smaller crowd (i.e. anonymity set).

I would imagine they just buy old accounts on black hat sites and reuse them? Or use leaked login credentials for abandoned accounts.

And don't brag about your crimes after the fact online, or anywhere else either.

Boasting is required in his line of work, that's how they build street rep, sell their products/services, and recruit people. (Contrast this to spycraft where the acceptable amount of boasting is zero.)

What did him in was boasting from a non-clean slate identity among other things. He needed strict separation between big time jobs which require an absolute clean slate because all the attention will be there, small time jobs that are likely numerous and sloppier but no one will bother to investigate, and pleasure. He didn't have that.

Remember kids, only break one law at a time. And once you're done, shut the hell up!!

I'm worried this new "level up" of communication and record keeping technology at a time when fundamental ideological differences between groups in the western world are causing problems is going to result in a repeat of 1500s europe.

That's not enough. Even the best people and teams, can make mistakes and they do so all the time.

That is exactly how the Silk Road guy was finally identified and caught.

I once read a detailed account of how he was caught. It seemed like the kind of clues that you could only connect post-hoc.

It seemed like parallel construction [1] to me. Considering that the NSA is known to give the DEA "tips" [2], and has a division specifically to start parallel construction investigations [3], and this was a high profile drug case, it would be odd that they didn't use parallel construction techniques.

[1] https://en.wikipedia.org/wiki/Parallel_construction

[2] https://arstechnica.com/tech-policy/2013/08/us-drug-agency-g...

[3] https://www.reuters.com/article/world/exclusive-u-s-directs-...

I read the book about it, and it was actually an IRS agent who found a super old forum post where the guy announced he had created the Silk Road using a username that was easily linked to his real name.

The IRS guy figured it out and nobody would act on it because they all figured the FBI would know better and they should wait for the FBI to do it right. ... but actually he nailed it.

But how are they to be tied together? If you don't use the same name, or talk about very specific or correlateable things, then it's hard for me to imagine how you're tying my old IRC chats to my facebooks groups to my Telegram conspiracies. As far as I'm aware the really useful metadata is rarely available since only the site operator had that and most likely deleted it or threw it in a drawer.

You might want to give the prior Krebs post on this guy a read - https://krebsonsecurity.com/2024/11/hacker-in-snowflake-exto...

It shows how small bits of information from several sources are used to tie this guy's aliases together.

Thanks, that's exactly what I was looking for.

Reply on news.ycombinator.com