How a Hacker Proved Cops Used a Stingray to Find Him • Hacker News Board

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#101

Post by Normal_gaussian » Mon, Jul 02, 2018, 6:35 AM UTC

thomastjeffery wrote: post #88

xyzzyz wrote: post #19

Earlier quoted context omitted.

If the source IP is encrypted, the recipient needs to decrypt it first in order to be able to send a response. To decrypt it, it needs to either have some shared secret with the sender, or the sender needs to use the recipient's private key. The parties cannot obtain the shared secret the usual way, the Diffie-Helman exchange. It cannot be performed, because it requires back-and-forth communication, which we are tryi…

> but it leads to all kinds of practical problems, figuring out which is probably best left as an exercise for the reader. Any examples? I honestly don't see any problems here.

That is a Huuuge number of IP's, at a very high request rate, required for every new connection. It is orders of magnitude greater than DNS, and would be expected to have much lower latency.

Throw onto that the trust issue - such IP certificate repositories are very quickly able to determine who is communicating with each other, and at what time. Whilst this is currently possible anyway, current methods are less centralised, more expensive, and more visible.

You'd have to go full onion

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#102

Post by sulam » Mon, Jul 02, 2018, 7:04 AM UTC

johnnymonster wrote: post #67

cantrevealname wrote: post #66

The hacker was exposed because of poor OPSEC (due to tracking of his IP address). > Rigmaiden had received boxes and boxes of criminal discovery that would help him understand how the government planned to prosecute its case. In the penultimate box, he saw the word “stingray” in a set of notes. The authorities were exposed because of poor OPSEC as well. They weren't supposed to ever mention “stingray”.

The story didn't mention how they were able to get his IP address in the first place. That level of detail is important for this community!

He was filing fake tax returns. That probably exposed his IP in logs on government servers.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#103

Post by sulam » Mon, Jul 02, 2018, 7:07 AM UTC

yborg wrote: post #83

johnnymonster wrote: post #71

This guy wasn't really a hacker, just someone who knew a little bit about tech and figured out a flawed system. I think that sums him up as a scammer instead of a hacker.

This. He filed false tax returns with stolen identities, I fail to see any activities one would associate with a technical hack. I also have a hard time understanding why someone who is engaging in criminal acts has a reasonable expectation to privacy related to the commission of said crimes.

You can't know that a priori, though. The cops should not get to say "I want to track this cell phone, it's being used for a crime" without filing a warrant. That is pretty much exactly what warrants are for in other contexts, cell phones should not be treated differently.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#104

Post by mirimir » Mon, Jul 02, 2018, 7:34 AM UTC

sulam wrote: post #102

johnnymonster wrote: post #67

Earlier quoted context omitted.

The story didn't mention how they were able to get his IP address in the first place. That level of detail is important for this community!

He was filing fake tax returns. That probably exposed his IP in logs on government servers.

The safe bet is that every site that you access logs your IP address. At the very least.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#105

Post by nindalf » Mon, Jul 02, 2018, 7:48 AM UTC

sulam wrote: post #102

johnnymonster wrote: post #67

Earlier quoted context omitted.

The story didn't mention how they were able to get his IP address in the first place. That level of detail is important for this community!

He was filing fake tax returns. That probably exposed his IP in logs on government servers.

What on earth? Isn't using a VPN the bare minimum when you're doing something potentially illegal?

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#106

Post by mirimir » Mon, Jul 02, 2018, 7:56 AM UTC

rattray wrote: post #79

cantrevealname wrote: post #66

The hacker was exposed because of poor OPSEC (due to tracking of his IP address). > Rigmaiden had received boxes and boxes of criminal discovery that would help him understand how the government planned to prosecute its case. In the penultimate box, he saw the word “stingray” in a set of notes. The authorities were exposed because of poor OPSEC as well. They weren't supposed to ever mention “stingray”.

If I had to guess, I might say poor OPSEC is somewhat common... EDIT: while we're here, do you have a single "start here" article/site for the basics of less-poor OPSEC?

Some good sources:

https://blog.cyberwar.nl/2016/02/some-elements-of-intelligen...

https://www.opsecprofessionals.org/official/081103_DOD_OPSEC...

http://www.opsecprofessionals.org/training/OPSEC_Training.pd...

https://www.slideshare.net/grugq/OPSEC-for-hackers

https://grugq.github.io/blog/2013/06/13/ignorance-is-strengt...

https://theintercept.com/2015/11/12/edward-snowden-explains-...

http://thefifthcolumnnews.com/2017/03/tradecraft-introductio...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#107

Post by hueving » Mon, Jul 02, 2018, 8:02 AM UTC

ggm wrote: post #18

panarky wrote: post #6

The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

Putting the return IP encrypted in the payload breaks NAT (see FTP helpers).

You do understand that the IP that the return traffic is destined for has to initially be addressed to the IP of the NAT device, not what the client thinks its IP is, right?

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#108

Post by jlebrech » Mon, Jul 02, 2018, 8:03 AM UTC

yborg wrote: post #83

johnnymonster wrote: post #71

This guy wasn't really a hacker, just someone who knew a little bit about tech and figured out a flawed system. I think that sums him up as a scammer instead of a hacker.

This. He filed false tax returns with stolen identities, I fail to see any activities one would associate with a technical hack. I also have a hard time understanding why someone who is engaging in criminal acts has a reasonable expectation to privacy related to the commission of said crimes.

the cops have to abide by the law, that's their weakness.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#109

Post by hueving » Mon, Jul 02, 2018, 8:04 AM UTC

ggm wrote: post #72

droopybuns wrote: post #61

Earlier quoted context omitted.

Or how would you troubleshoot which hop was the source of a routing problem without including a source IP to send a message back to. These kinds of discussions seem utterly divorced from the reality of networking to me.

Oh. we talked about that. You could include the origin-AS and each AS along the path would change it in flight, was one idea. Which also didn't fly for obvious reasons. src,dst pair as part of a tuple was just simpler.

AS != hop, especially when BGP isn't even present (e.g. Large private networks).

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#110

Post by User23 » Mon, Jul 02, 2018, 8:13 AM UTC

therein wrote: post #86

xyzzyz wrote: post #52

Earlier quoted context omitted.

That's literally the second option I describe. What is your point?

What you guys are describing is starting to sound more and more like onion routing.

Point is online security is a bad joke. You wrote it, you own it.

The real interesting question is what happens when you get owned by what you didn't write?