OPSEC fail thread

Khannie

Bring all your OPSEC fails here, past or present.

I came across one today over on the darknet forums on reddit - Canadian drug dealer posts up pictures of his lab including stock that might help track him down.

https://www.reddit.com/r/DarkNetMarkets/comments/51o8qh/my_lab/

Muppet.

syklops

http://nypost.com/2016/06/10/thief-takes-selfie-with-stolen-phone/

Dude swipes womans phone, later takes a selfie with it. It instantly uploads it to her iCloud. She sees it and gives his picture to Police. :rolleyes:

Khannie

AH! You just reminded me of this:

http://arstechnica.com/security/2016/02/opsec-fail-baltimore-teen-car-thieves-paired-phones-with-jeep-uconnect/

Kid steals car, pairs his phone with the bluetooth, his phone is the same as his instagram nickname, nailed.

infodox

OPSEC fails eh? I'll list some from years ago below, for your entertainment.

• Discussing online criminal activity via Facebook Messenger, and other insecure/identifying platforms, out of convenience.
• Engaging in online criminal activity from a University wireless network, logged into said network under ones own account.
• Engaging in online criminal activity from wireless networks associated with oneself.
• Engaging in online criminal activity from home.

The next two are related to one another. They were both caused by the exact same bug in code one wrote, and basically meant that one connected to *everything* from my own IP address instead of a Tor/VPN IP address.

• Badly written init script that was supposed to automatically launch Tor with transparent proxying, but due to a really stupid bug, failed to do so.
• Badly written init script that was supposed to automatically launch a VPN, but due to a really stupid bug, failed to do so.

The bug in question was really, embarrassingly simple. They were trying to automatically launch the VPN or Tor before network interfaces were up and connected to anything. The scripts would silently fail, leading one to assume they were working fine. Complacency lead to not verifying that they functioned as assumed.

These last few are fairly simple issues as well.

• Failing to properly and consistently use disc encryption across devices. Some devices would be encrypted, others would not be encrypted. Backup media was not encrypted.
• Leaving devices powered on and logged in overnight. This makes all your crypto protections utterly useless when the devices are seized live.

It is really easy to **** up and get caught. Over time, a strange and nonsensical mixture of complacency and misdirected paranoia will set in, if you are up to "no good". You will forget to check your protections properly, will forget to implement them, and will instead be off chasing ghosts conjured up by your own paranoia.

syklops

A guy looking for help with his work VPN connection on a public IRC channel. Pastes his VPN.conf file into the channel, including the shared secret.

3500 VPN configs had to be changed because of that derp moment.