The Grugq

To add to this, in case of any remaining confusion. You can implement your own execve in userspace. [0] But the kernel's execve is a piece of machinery that invokes the loader so obviously it follows that you're free to make any changes you'd like to the overall process. Bonus points if you add compression or encryption and manage to trip a virus scanner or three. [1] [0] https://grugq.github.io/docs/ul_exec.txt [1] https://blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-0…

he has a tumblr which he updates frequently, but it's mostly just links to things he finds interesting: https://grugq.tumblr.com/

Read this back to back with grugq's post today, although standing on its own the level of vitriol Farr describes over the LT would give me pause: http://grugq.tumblr.com/post/145440005263 "Why Misogynists Make Great Informants: How Gender Violence on the Left Enables State Violence in Radical Movements" Never met Farr, but it's always sad to hear stories where positive contributors are ground down by this sort of unacceptable behavior.

Many of these points can be summarised in one word: compartmentalisation Your personas are isolated and segregated. They share no information, hobbies, interests and at a tech level they don't share connections, machines, browsers, apps. Your anonymous personas use Tor in an isolating proxy configuration, where traffic is explicitly allowed and proxied rather than routing all by default (NAT) with explicit blocks (like a firewalls block all then allow vs allow all then block) If you look at Opsec failures (read thegrugq[1]) you'll find that a very large number are the result of a lack of compartmentalisation and were found by establishing link(s) between known and unknown personas [1] http://grugq.tumblr.com

slide 36. but the whole presentation is excellent: https://grugq.github.io/presentations/COMSEC%20beyond%20encryption.pdf

All of the grugq's writings/links are helpful in this respect: http://grugq.tumblr.com/ He posts interesting things on twitter, too.

The follow up posts on this particular piece are: http://grugq.tumblr.com/post/68391880015/defcon-21-de-anonymizing-alt-… And: http://grugq.tumblr.com/post/68392646777/castleman-affidavit

And basically his whole blog: http://grugq.github.io/

Not really. These things are hard to get right and stick to for prolonged periods of time. This requires practice and discipline. Ordinary people (and even trained professionals [1]), get sloppy and make mistakes. Thus, this line from the presentation is golden: "Amateurs practice until they get it right, professionals practice until they can't get it wrong. [1]: Another excellent essay by the same person - grugq (of +HCU and Fravia+ fame) on the major OPSEC fuck-up by CIA in Lebanon and the factors that likely have lead to the full compromise of a big informant network, and possibly the deaths of a number of people [2]: http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/ [2]: http://www.wired.com/dangerroom/2011/11/pizza-cia/ added: even small things like complaining about freezing your ass off due to the cold weather, accidentally linking two nicknames, emerging at regular times (synced with a specific timezone) could be used to uncover your identitiy. As evidenced, slip-ups like could get you in jail. You can check the discussion from a few weeks back about the hassles of creating a truly anonymous page on Internet: https://news.ycombinator.com/item?id=5638988

People also tend to have very poor OPSEC which undermines their efforts in spite of the tools they used. https://grugq.github.io/blog/2013/11/06/required-reading/ Unlinking one's identity from one's activity is only getting harder as surveillance gets more and more pervasive. Effective OPSEC essentially turns one's life into a living hell and it's only getting hotter with time.

https://grugq.github.io/presentations/COMSEC%20beyond%20encryption.pdf Everyone has an opinion. This presenter claimed Windows is the most secure (for his particular use case: "COMSEC").

No, dont run Tor over VPN. Its VPN over Tor. Tor provides anonymity, VPN provides privacy. You want anonymity between you and the VPN, and privacy between you and internet hosts. From the OpSec for xyz series: https://grugq.github.io/presentations/Keynote_The_Grugq_-_OPSEC_for_Ru… • TOR connection to a VPN => OK • VPN connection to TOR => GOTO JAIL

There is a presentation[1] by grugq on how to communicate securely. Using gpg with email is hard. Anecdotally, people reply in cleartext quoting the encrypted message. If you can train and test your co-conspirators before sending them incriminating evidence about yourself, maybe it can be done. But mistakes happen so often, people who have secrets that can get them killed or jailed for a long time just switched to Signal. That's what tptacek means. 1 - https://grugq.github.io/presentations/COMSEC%20beyond%20encryption.pdf

Some CP producers / distributors unfortunately have shown to be very sophisticated: http://grugq.github.io/blog/2013/12/01/yardbirds-effective-usenet-trad… Here is another case of literal pay-per-view on the deep web: https://en.wikipedia.org/wiki/Peter_Scully

The Grugq has some awesome write ups on OpSec. He is the authoritative source on it. Google around for his tumblr, medium posts, and grugq's github [1]. [1]: http://grugq.github.io/blog/archives/

God I wish grugq still wrote currently. https://grugq.github.io/blog/2013/12/21/in-search-of-opsec-magic-sauce… I discovered he moved to Github pages after years only to realize he has not published much since I first heard of him.

grugq made a nice list of alternatives to Truecrypt [1]. I also personally use Tomb [2] containers and dmcrypt/luks [3] for full-disk encryption on both Linux and Android. [1] http://grugq.tumblr.com/post/60464139008/alternative-truecrypt-impleme… [2] https://www.dyne.org/software/tomb/ [3] Setting up Archlinux with dmcrypt/luks only takes a few extra minutes during install: https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_sys… and Android uses dmcrypt when encryption is enabled.

Something like this? http://grugq.github.io/resources/some_elements_of_intelligence_work-du…

> Wouldn't any process running as root on the computer be able to re-flash the router? No, because router's management interface is only available out-of-band. This is a conscious design decision to mitigate against this threat: "In order to protect the PORTAL from tampering from malware (or malicious users), it also requires a third administration interface. This can be either a serial console, or physical connection."[0] --- [0] http://grugq.github.io/blog/2013/10/05/thru-a-portal-darkly/

Agreed. Your comments reminded me of the points in "Evil Exit Nodes Unmasked me, and all I got was this lousy jail term" by the grugq. http://grugq.github.io/blog/2013/06/14/you-cant-get-there-from-here/

The Grugq wrote a post [1] discussing TrueCrypt alternatives back in October of last year. It also mentions tc-play and cryptsetup, but additionally mentions tomb [2], which looks very interesting to me. But while I once wrote for my mom a document with step-by-step instructions on how to create and use a TrueCrypt volume to keep some work documents secured, I don't see any alternative in either post that is going to be as accessible to normal folks (like her) as TrueCrypt. [1] http://grugq.tumblr.com/post/60464139008/alternative-truecrypt-impleme… [2] http://www.dyne.org/software/tomb/

Take this as a start: http://grugq.github.io/presentations/Keynote_The_Grugq_-_OPSEC_for_Rus…

If your aim is not to be identified, I can understand keeping your mouth shut about matters of opinion, especially if you hold distinctive opinions you have given out in public before. One of Ulbricht's reported failings [1] was talking about Mises and the Austrian School as both Ulbricht and DPR. Keeping your anonymous persona's mouth shut about history, politics, economics, sociology, art theory and human nature is good 'opsec'. [1] http://grugq.github.io/blog/2013/10/09/it-was-dpr/

The mentions of his security concerns reminded me of this: http://grugq.github.io/blog/2013/06/14/you-cant-get-there-from-here/ "As a thought experiment, imagine that Osama bin Laden was still alive and that he used the Tor network to do a Reddit AMA once a month. How long do you imagine it would take for the US to find and neutralize him? I posted this question on Twitter and, while responses varied, ex-NSA Global Network Exploitation Analyst Charlie Miller guessed one to two months. I would be very surprised if it took more than three."

Quitting social networks and using Tor and PGP isn't going to protect you from a nation-state intelligence agency. To suggest so is laughable and naive. We're not even at amateur hour yet. You're better off reading Grugq's post[1] on developing good OPSEC, and even then you're far and away from it. [1] http://grugq.github.io/blog/2013/06/14/you-cant-get-there-from-here/

Here is the article I read about this issue: http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/ "Hiding anomalous activity is hard, but vitally important. The problem with many security systems based purely on secrecy is that their usage is itself anomalous. It singles out and attracts attention to the users. If the adversary doesn’t know who those users are initially, they can cross correlate real world data with the suspicious activity and narrow their focus to real people."

From http://grugq.github.io/blog/2013/06/10/good-luck-with-that/ The publicly available tools for making yourself anonymous and free from surveillance are woefully ineffective when faced with a nationstate adversary. We don’t even know how flawed our mental model is, let alone what our counter-surveillance actions actually achieve. As an example, the Tor network has only 3000 nodes, of which 1000 are exit nodes. Over a 24hr time period a connection will use approximately 10% of those exit nodes (under the default settings). If I were a gambling man, I’d wager money that there are at least 100 malicious Tor exit nodes doing passive monitoring. A nation state could double the number of Tor exit nodes for less than the cost of a smart bomb. A nation state can compromise enough ISPs to have monitoring capability over the majority of Tor entrance and exit nodes. Other solutions are just as fragile, if not more so. Basically, all I am trying to say is that the surveillance capability of the adversary (if you pick a nationstate for an adversary) exceeds the evasion capability of the existing public tools. And we don’t even know what we should be doing to evade their surveillance.

Some good sources: https://blog.cyberwar.nl/2016/02/some-elements-of-intelligence-work-73… https://www.opsecprofessionals.org/official/081103_DOD_OPSEC_Manual.pd… http://www.opsecprofessionals.org/training/OPSEC_Training.pdf https://www.slideshare.net/grugq/OPSEC-for-hackers https://grugq.github.io/blog/2013/06/13/ignorance-is-strength/ https://theintercept.com/2015/11/12/edward-snowden-explains-how-to-rec… http://thefifthcolumnnews.com/2017/03/tradecraft-introduction-to-opsec… You might also enjoy my guides: https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-par… https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-c…