11–20 of 105 posts
For anyone who doesn't follow infosec: This guy is responsible for two of the most impressive hacks recently and still hasn't been doxed or arrested. And so the linked doc is awesome if only for the opsec tips it provides. And it provides much more than that. It really gives you some perspective on how much work an attacker will put into breaking into your network and the kind of structured approach they're taking. P…
For anyone who doesn't follow infosec: This guy is responsible for two of the most impressive hacks recently and still hasn't been doxed or arrested. And so the linked doc is awesome if only for the opsec tips it provides. And it provides much more than that. It really gives you some perspective on how much work an attacker will put into breaking into your network and the kind of structured approach they're taking. P…
What was the other hack?
Whoisology [1] is good for this, though they've been more aggressively pushing their paid options as of late. Also WhoisMind [2], to some extent.
> Obviously you have pay anonymously, with bitcoin, for exaple (if youuse it carefully) Bitcoin is anonymous? Time to go to jail.
Could you expand on your comment? My understanding is that if a party can't tie a wallet to an identity then it is anonymous. So if you can acquire bitcoins (eg. mining) and purchase something (eg. VPS) without giving up your identity then you are solid.
Telling the blockchain about your bitcoins and their transactions would also leak your IP.
To be anonymous you need to do all transactions from anonymous internet and get all your stuff anonymously.
Perhaps a purchased ebook downloaded from TOR.
You can wash your coins of course, I think it currently requires trust in the company doing it and if not done correctly might still leave a trace.
Of course the real world is different, would the FBI do enormous op sec to catch a small time crook. It's more about risk management.
AFAIK, they are still operating and still doing exactly the same thing.
For anyone who doesn't follow infosec: This guy is responsible for two of the most impressive hacks recently and still hasn't been doxed or arrested. And so the linked doc is awesome if only for the opsec tips it provides. And it provides much more than that. It really gives you some perspective on how much work an attacker will put into breaking into your network and the kind of structured approach they're taking. P…
I'm grateful for the information. It's incredibly interesting, but it might come at great expense to the author.
Yeah, right. Most of the tools and knowledge he used would have taken much longer than that to acquire.
How did he record these step-by-step instructions with such high detail? Is this common practice?
This stuff is gold:
> NoSQL, or rather NoAuthentication, has been a great gift to the hacker community [1]. Just when I was worrying that all MySQL's sins of omission had finally been patched [2][3][4][5], these new databases appear, lacking authentication by design. Nmap found a few in Hacking Team's internal network:
Not to mention: > As fun as it was to listen to captures and watch webcam images of Hacking Team developing its malware, it wasn't very useful. Their insecure security backups were the vulnerability that threw the doors open. According to the documentation [1], their iSCSI systems should have been on a separate network, but nmap count a few of them in their 192.168.1.200/24 subnet:
I can just hear some one saying to themselves, four years ago, "This backup stuff should be on a separate subnet, but for now this appears to be working. Make a note-to-self to secure it later." ....