Phineas Fisher's account of how he took down HackingTeam

steckerbrett wrote: post #3

> Obviously you have pay anonymously, with bitcoin, for exaple (if youuse it carefully) Bitcoin is anonymous? Time to go to jail.

Could you expand on your comment? My understanding is that if a party can't tie a wallet to an identity then it is anonymous. So if you can acquire bitcoins (eg. mining) and purchase something (eg. VPS) without giving up your identity then you are solid.

Re: Phineas Fisher's account of how he took down HackingTeam

#5

Post by Karunamon » Sun, Apr 17, 2016, 4:21 AM UTC

TACIXAT wrote: post #4

steckerbrett wrote: post #3

> Obviously you have pay anonymously, with bitcoin, for exaple (if youuse it carefully) Bitcoin is anonymous? Time to go to jail.

Could you expand on your comment? My understanding is that if a party can't tie a wallet to an identity then it is anonymous. So if you can acquire bitcoins (eg. mining) and purchase something (eg. VPS) without giving up your identity then you are solid.

I've heard conflicting information as far as this goes.

Thinking this through- an adversary who's watching the block chain probably knows some inputs and some outputs. As in, these addresses belong to an exchange, these addresses belong to a hosting company.

Okay, fine. Now remember than any user can literally create wallets out of thin air, and in fact doing so is considered basic security hygiene. Let's say Joe User transfers one coin from one wallet to another wallet under their control. Let's say they do this 20 times, sometimes with the full amount, sometimes less.

How does the adversary attach an identity to those transactions?

Re: Phineas Fisher's account of how he took down HackingTeam

#6

Post by MatthiasP » Sun, Apr 17, 2016, 4:27 AM UTC

Original text in spanish: http://pastebin.com/raw/GPSHF04A

Re: Phineas Fisher's account of how he took down HackingTeam

#7

Post by zamalek » Sun, Apr 17, 2016, 4:45 AM UTC

steckerbrett wrote: post #3

> Obviously you have pay anonymously, with bitcoin, for exaple (if youuse it carefully) Bitcoin is anonymous? Time to go to jail.

Bitcoin can be used in a way that defeats anonymity - as per the parentheses in the quote.

Re: Phineas Fisher's account of how he took down HackingTeam

#8

Post by PakG1 » Sun, Apr 17, 2016, 4:59 AM UTC

zamalek wrote: post #7

steckerbrett wrote: post #3

> Obviously you have pay anonymously, with bitcoin, for exaple (if youuse it carefully) Bitcoin is anonymous? Time to go to jail.

Bitcoin can be used in a way that defeats anonymity - as per the parentheses in the quote.

Being pedantic, but I think you mean helps ensure anonymity?

Re: Phineas Fisher's account of how he took down HackingTeam

#9

Post by mmaunder » Sun, Apr 17, 2016, 5:01 AM UTC

steckerbrett wrote: post #3

> Obviously you have pay anonymously, with bitcoin, for exaple (if youuse it carefully) Bitcoin is anonymous? Time to go to jail.

Not if you understand how it works.

Re: Phineas Fisher's account of how he took down HackingTeam

#10

Post by mmaunder » Sun, Apr 17, 2016, 5:06 AM UTC

For anyone who doesn't follow infosec: This guy is responsible for two of the most impressive hacks recently and still hasn't been doxed or arrested. And so the linked doc is awesome if only for the opsec tips it provides. And it provides much more than that. It really gives you some perspective on how much work an attacker will put into breaking into your network and the kind of structured approach they're taking. Plus it's very hands on and is educational and current whether you're black or white hat. If you read nothing else in infosec this month, read this.