Killing with Keyboards – How Your Digital Footprint Can Be Weaponized

Transcript

[Music] Is that the queue? I can go. Okay, let's go. Um, so yeah, killing with keyboards. A little bit about me. I'm a security retor software architect. Um, I've done many things. Uh, one of the things I'm more proud of is Womov and I got to give a shout out to Barto Barikovski who's not here with us, I think. Uh, and it's like a really cool Rust coverage tool. Uh, and yes, I code in Rust if you cannot tell. Um, other than that, I'm a parent and I like public transport and such.

Anyway, this was inspired by my experience after leaving Hacken where I work more with independent founders, nontechnical founders, CEOs, etc. And I found myself deeply traumatized by this experience because you know when people are nontechnical they don't really care about privacy certain things happen. So this is like a little security briefing to bring the fear of dog into their you know minds and to get them on the right path at least when it comes to you know operational security. So let's get started with a little story time.

This is Sashko. Uh, oh yeah, and by the way, anyone who approaches me with uh with any Easter eggs placed in this presentation after gets a firm handshake and a happy smile. That's the budget right now. Uh, so yeah, this is Sashko. He's a security engineer working at like a hardware devices company. Um, think like maybe a wallet or something like that. Um, and he's a pretty normal guy. He does normal stuff and sometimes from time to time he will log into maybe like a telegram or a Zulip channel or discord you know and uh he'll talk about the news in the field um uh like anything from u

anything that's going on you know the latest hacks whatever but he always stays anonymous under under a secret username and he's well respected in this channel he provides a lot of useful information. When you talk to him, you can really tell that the guy knows his stuff. Um, and yeah, everybody sort of likes him. Everybody likes chatting with him and just getting info from him. Uh, anyway, this is a story. So, there has to be a girl and there is Kim. So, uh, an ocean away and a continent and a little bit more pretty much the other side of the earth, there's a teenager.

Her name is Kim and she's a citizen of the Democratic People's Republic of Korea and she's what we would call a Googler or maybe a searcher um more modernly Google dorks used to be a really big thing. Now, now we use a lot more generic tools. Um and she searched for words, patterns, keywords that her government provides in order to create files on certain topics. and she doesn't know it yet. But today is her lucky day because see today Kim found Sashko.

She doesn't know anything about him. She was just making a little file on like the STM32 keyword in a certain channel. But uh yeah, she doesn't know anything, not even that he's a he, but soon we'll find out more. Back to Sashko. Back to Sash code. So the next morning at the office um there's a big bonus for everyone because like a project milestone was reached and also there was like a whole half day spent um in a security briefing which everyone found sort of boring. So, you know, one hand positive Bogdan, the guy on the right, he's one step closer to retiring on a farm somewhere, but also everyone's sort of pissed because, you know, you're

wasting time on meetings about security instead of just coding. Like, come on, what are devs supposed to do? So, after that, they're a bit frustrated. Then they go to um a place that's opened up on the tech park recently uh that serves quas. And in the line they're chatting um about you know how the security guys don't know what they're talking about like nobody does dumpster diving anymore or anything such it it doesn't make sense the whole briefing uh and it's like a really nice place on the park. Um it's um it provides a discount for employees. You just show your little badge at the counter. It has free Wi-Fi and even has cool meeting rooms um where

you can take like a quiet call when you need to. It's It's pretty cool. Back to Kim. So Kim's group leader is a very good mentor. I've had a few like that. Uh and Kim, she's young. She's like 16 and she's learning patience. And he always tells her, you know, that searching it's a random process. You you just need the time and the patience and eventually you will yield results. Every petal helps you identify the flower it came from. And Kim's been writing down stuff about Sashko. And you know eventually by searching you find in this case it was Sashko's own

security and privacy review that he had like maybe two years ago where um where he was thinking oh no I have my my real name on some of these book review websites and I want to change that so how about I changing to a pseudonym. Unfortunately, you cannot delete anything off the internet, especially the stuff that you actually want to delete. And uh using some like cache or maybe archive.org or something like that and some advanced search tools that they have, uh she was able to find a matching review and figure out his real name from the old profile info, right?

And once she had his name, everything else was easy. Soon she had his old social media accounts, phone number, email. She even knew about his family and all of their information was of course unprotected, right? And she kept digging deeper and deeper, you know, as she learned more about him. You know, she's a teenager. She even maybe had a little bit of a crush on him or something. And just digging deeper into the lives of others, you know, it was even fun for her at times.

until one day. Oh, no wait, actually there's more. Digging deeper into stuff that was even so private that not even the close closest to him knew about, you know, uh maybe like uh black hat past in his younger days, right? Until one day, Kim's work on Sashko was over. She had created a file that could be used as desired by others in her organization and uh it contained all the crucial information about Sashko and yeah now she would be rewarded. It was her 200th file. she would be allowed to recommend her sister who is 13 to be taken out of

school and put into the special program as a talented individual at searching and also her family probably got a little bonus in the living standard. So yeah, pretty nice. Anyway, forget about all of that. It's been a year, maybe two, and Kim's government has found out that there is um a protocol that may be hackable. uh using a certain exploit in the STM32 secure chip maybe the version 3.5.1 which has a USB exploit uh and um

yeah arbitrary execution and they just need to confirm if chips sold at a certain time a certain year included that version or not. Um, so there's a conference just like this one, actually a bit more secure. Let's say it's a more of an invite only event. Let's say that uh you need company sponsorship to get in and it's pretty filtered. Um, and it's held in a hotel conference center, you know, um, and it's been a few days of talks and everybody's sort of tired, not not like this early beginning, right? Uh, and Sashko is also pretty tired. So, he

goes down to the hotel bar and there he sees a guy wearing a Dina Makiv hat. Now, he sort of recognized the face. He's seen him around. He's seen him in the elevators and the lobby, you know, in the in the restaurant. Um, and Dina Mckv, of course, he approaches him and he's like, "What? That cat here? like how come? And of course, I mean, he's a fan. Everyone's a fan, right? They have this great conversation. They just strike it off straight. You know, they have so much in common and they're talking for a bit and you know, they're getting a little bit peckish maybe after an hour. So, so the

guy, let's call him Jack, he's like, "Oh, let's go grab some lunch." and they go for lunch uh on company dime, right? Uh and they're talking they're talking about life, they're talking about uh you know, family, about sports, whatever. Guys talk about cars, I don't know. Uh and then, you know, and they're avoiding talking about work, you know, they all been briefed, right? Um but Sashka is a nice guy and at some point you knew you'd miss this. you'd miss this in a 2-hour conversation, especially after a few drinks. Uh, at some point, Jack is like, "So, yeah, we're we're going to start using, you know, we're going to work on this new secure device product

and we're thinking of using like um the STDM32 chip for that. So, like I was wondering if you have any tips like we're specifically going to work with the version 3.5.1 like do you have any experience with that? How's the documentation?" You know, this is like a zero day. Nobody really knows about it yet yet. Uh and and Sashku, he's a useful guy, so he lets his guard down and he's like, "Oh yeah, of course we used it in such and such product like 3 years ago. It was really well documented. You don't have to worry." And you know, he just suits him a little bit and they continue talking about other stuff for a little bit more. And then then Jack is like, "Uh, oh yeah, I have an early flight to catch, so I'll

have to go, you know." And they sort of say their goodbyes, exchange contacts, and it's really nice. And Jack is really happy. Jack is really happy because he got the information he needed and best of all, he also has Sashko as a contact in case he needs any other useful information for future work, right? And he was able to get all of that without having to do anything at all. unkind.

So, yeah, it's a pretty good day for Jack. And of course, he doesn't have to explain why he's not at any of the talks or any of the, you know, closed off spaces that are not literally the hotel lobby. A few weeks pass the usual kill chain and you know another recre news case or maybe in an alternative universe you know in a more fascist state universe. this secure chip was instead being used by an activist group to secure their communications, you know, and uh their coms are cracked and they're all taken and shut off.

So yeah, this is a story of how even the tiny bit of obset can go wrong and this is a very paranoia inducing story, right? So now it's sort of time to debrief you uh because I don't want to leave you completely freaked out. the way I was after writing this. Um, so yeah, let's go into like what do you do? What do you do in any of these situations? How do you actually do security? How do you avoid any of these things happening? So, first, you're not a target. You're most likely not the target. I am not the target. U most of us are not targets because we do not have anything that crucial though you very well may be a target at

this conference because you are probably working for a bigger company right so the question is can you protect yourselves what do you do you just get like a VPN the deletion service or whatever the latest YouTube privacy ads cycle is no none of those work none of those are useful and caches will will have all of your information like it's all being scraped and stored somewhere because it eventually has a use or sold on the black market. You know, that's what the raid forums earlier were. So, uh yeah, you you don't do OBSC is not just a set of steps that you follow blindly. You need to think about your actual risk profile about your threat

model. Um so the first question is who or what are you protecting? Are you protecting just your personal data for fun? Are you protecting business secrets? Are you protecting illegal activities that could end you in jail? Or something even more severe like, you know, maybe your location because you're being chased by murderous, criminals, or something like that. The second question is, who is chasing you? Is it like just a nosy ex trying to get uh a ton of info on you and just stalking you around? Is it um is it someone more mid tier with some

resources, serious resources and serious time willing to go deeper maybe to use like some basic exploits or pay someone to to try to get info from you? Or is it someone high tier so an advanced persistent threat or uh or law enforcement? Because they all have different ways they act. Some will just access open information about you. Some will actually try to get into your accounts. And some will be able to literally barge into your house, arrest you, and then potentially torture you until you provide whatever information they want. And these are very different threat models.

And finally, what happens if they win? You know, do do you just get questioned or do you lose a ton of money? Do you get a bit ashamed or do you literally get killed? Because these are the things that should actually determine how you approach operational security and whether you should go in an extreme paranoid direction or if you should just, you know, sort of accept it because the last thing is sort of what can you do? What can you do? Like I am Noah. You already see me. You already know my face. I am not anonymous since birth. There's been information on the internet about me for the last 10 years at least where my face is very

recognizable and tied to my real name. There is no way for me to anonymize myself with my face anymore. So if I wanted to say execute the next big hack, how would I do it? What sort of privacy measure should I take? And the answer to that is ephemeral identity. I cannot be Noah. I cannot be this. I have to become someone else. Uh it's been a very good experience at protests for example because a lot of people need to stay anonymous against the police.

And one very good technique there is to put on heavy makeup, carnival makeup, because in carnival makeup, nobody can recognize you, but also you don't look too inconspicuous. You know, you don't look too shady. you don't get too much attention, especially if everyone is dressed similar, right? So, that's one thing. You want to make your physical identity, physical appearance different. You know, put the rock in the shoe or whatever. There's a lot of these little tricks. The other part is stillometry. The way you write is directly related to your real identity. So, I'd make sure that I'm pro maybe processing all of my communications, external communications through an LLM or something like that to

mix up what my actual writing style would be. I write like myself. I have my own punctuation patterns, etc. I need to mask those. And lastly, so if I was really executing the hack, I would presumably know how to execute it in my head. So what I would do is I would do the whole masking my physical identity, use cash, preferably in a somewhat foreign country to acquire the physical devices for the hack. I would go and um get a little secure operating base maybe. Uh and I would set up the devices there.

Download all packages necessary over clear aka not door because it is too slow to download any Rust library. Um prepare my execution package etc. Execute over to okay set up all the mixing flows etc. get out with all the money, right? Get them all into various Monero wallets distributed or maybe other privacy networks uh as well just to just to mix up the trail a little bit. And I would exit that place, burn it down, crush it down, make sure that there is no trace of me or any activity there left and exit with a piece of paper with a list of private

keys with no digital trace left. I would never change my style of living. I would never get the Ferrari. I would never get caught on the border. Uh like the first big Sherlock Hawk hack, I think. Uh the guy got caught on the border with just a bunch of cash in his trunk. You don't get you don't do that. You keep a very low profile. You maybe launder that money through a car wash or something minor. And uh you just try to avoid any real changes in lifestyle that could indicate something happened. and over the next 20 30 lives uh years you live fairly comfortably right so that's how you do actually do it if you need to protect your privacy there are ways to do it even in extreme situations there

are many hackers who don't get caught um but yeah do not do it in a paranoid way think about your actual threat model if you'd like me to do the thinking for you can also contact me or just catch me after this talk and I can answer any and all questions Uh, so yeah, I have another 15 seconds before end. Please do not directly admit to a crime to me right now. Like it's been about 17 times now and it's I keep secrets very well, but it does weigh on my heart, you know.

So yeah, thank you very much for coming to my talk and I hope it was fun. Thank you very much. Thank you for the talk and you can know on the telegram and link it in. Okay. Uh catch me in front. I guess I'll be outside. See you everyone. [Music]