>> All right.  Thanks a lot.  Yes, so I didn't know that disobedience was going to be the theme when I submitted this talk so I guess I didn't fuck it up.   Because this...
      

	>> Hazing.  This is not my first talk you know.  Oh, I thought you were going to make me drink or something.  Are you going to get anything for that?  

	In the Penn and Teller, yeah.  Sure if it gets me some booze.

	All right.  Disobedience is what makes hackers who we are.  Using things in ways that were never intended or allowed.  Sometimes to show there's a better way to do things you need to break some rules and a big way is violating unjust laws.  Civil disobedience.  

	And I was partly inspired to give this talk because some of the biggest practitioners of criminal disobedience in this country today are the secret police, unrepentant career criminals like Michael Hayden who presided over the Bush warrantless wire tapping and James Clapper who lied to congress repeatedly -- they disregard and weasel around the law when it's convenient for them to do so.  They are telling us, that the end justifies the means, so we can play that game too.  

	We have a duty for civil disobedience where the law is plainly wrong and turning the United States into a surveillance state in the name of fighting terrorism, which as a public health problem rivals the Bubonic plague in this country.   It is worse than criminal, it's stupid.  So we can't let the surveillance state stop us from doing what's correct.  

	Remember back to the crypt o wars, DCSS, to protect big media from hackers playing their legally purchased DVDs on their Linux laptops, DVD encryption code was illegal.  That's a perfect example of a law that's worse than criminal, it's stupid because it only hurts people legitimately using media.  Of course, hackers have a duty to put a stick up the ass of the people responsible for these laws.  Making illegal T-shirts, making illegal ties, illegal games of mine sweeper.  [Laughter.]  

	Now, of course there are more or less trivial injustices to be disobedient to.  On the low end, breaking some bullshit eula, to using technology to resist truly tyrannical and oppressive regimes out there, which people are out on the ground doing right now.  Mortaring the man, there is an app for that.    

	The point is using technology to push boundaries is what people who come to this conference are supposed to do.  And on the other side of this which I will return to in a little bit is that actually you have no idea whether what you are doing is legal or illegal in many cases.  

	None other than the congressional research service has stated they don't know the precise number of federal laws in effect in a region at a given time.  So not even a good lawyer knows off the top of her head whether or not her client is doing something illegal.  Then take into account that laws in this country and others are interpreted by historical precedence.  

	Now, it also matters when you are accused of doing something.  Forget deliberate disobedience -- people break the law all the time without knowing it so you have got to be careful.  

	Here is one of my favorite DEFCON examples.  This slide is only just an illustration, an example of being disobedient but good.  DEF CON is full of them.  I think we can mostly agree, breaking into people's bank accounts that are not your own is illegal.  One of my favorite DEF CON moments was meeting the guy who hacked into the Nigerian scammers back-end database, got their bank account info and got a little old lady's money back from them.  I think this photo by the way should say Goatsee lovers.  Missed opportunity.  

	Leaking things is also another disobedient act currently en vogue and, I think, helpful to society.  A lot of what's been leaked lately comes down to control of the internet.  People with a lot more money and power, than those of us are who are in this room are trying to lock it down.  Disobedience is a part of that resistance to power and control.  

	Locked down internet, one without the freedom to share information regardless of one's wealth of power or regardless of what that information is, is a fucked up internet.  And so, we should refuse to be obedient to that.  

	If you are going to deliberately disobey of course there's just one rule and anyone who has been Hacker Jeopardy knows what it is so I want a shout out on the count of three.  One, two, three.  Thank you.  

	The other reason I was inspired to give this talk, is because I have been obsessively reading every Snowden leak that has come out this past year.  And okay, that's fine for me, I can feel smug.  But I wanted to contribute some of my insights on that and give back to the community, and start this -- be involved in the discussion here on that.    

	So, this talk is for everyone who hasn't had the free time to go through all of those leaks and really pore over all of this stuff.  If everyone in this room knows everything that I'm going to say I will be really happy but that's probably not the case.  Especially . . . People don't seem to be thinking about this stuff because people who should know better keep fucking it up.  

	Remember this, the good old days back when the internet hadn't yet transitioned to cat based humor.  Nowadays everyone on the internet knows you like ascii goatsee.  [Laughter.]  Google even suggests it.  I'm sorry it's not a DEF CON talk without a goatsee.  

	But seriously the good old days were not even that good.  I'm not even really old school.  We were package sniffing in the 90s.  It's been a quarter century of realizing that the trust assumptions that underlied the early internet were completely wrong and that attitude change, as slow as it's been has been a good thing.  You shouldn't listen to anyone who is like back in the day it was better.  It wasn't that good, but it's definitely worse now because now the business model of the entire internet is stockpiling, monitoring and tracking your shit.  

	And the real game changer is the storage.  This is the Bluffdale, Utah NSA data center, your shit out there is not just vulnerable temporarily when it's being transmitted but it's stored to be mined later.  

	Keith Alexander when he came here to DEF CON 20, he pissed me the fuck off, because he came here and said "oh you guys are so smart right?  Come and work for me" but he thinks that we're so smart that putting on jeans and a T-shirt is enough to convince us that yeah you are a good guy even though your agency is preventing people like us from becoming who we are, preventing the next generation of hackers.  

	Think about if someone walked around in our community with a tape recorder shoving it in your face all the time recording everything you said, you would find it hard to accept that person as part of the community.  You would probably stop talking to that person entirely but that's what's happening.  We have to remember that's what's happening even though we can't see it in our faces.  Collect it all, exploit it all. etcetera.   

	We have always assumed and expected they were doing some of this but thanks to our friend Snowden we now know they were doing what we long expected and more.  You've got to remember the government double speak here, eh?  When they say, we don't do this, that means, we get our foreign partners to do this and then they give it to us.  When they say we don't collect that under this program it means yes, we collect it under a different program.  So it's not just one particular TLA.  

	So now there's a million ways to fuck it up, right.  Not just in the moment but going back in time.  So if anything you do makes you a person of interest they can go back and find other interesting stuff to pin on you.  Whether it's a parallel construction so they don't have to admit how they know this stuff, or other reasons.  

	Most of this is not the fault of technology.  Think about problems with technology, it has problems.  We find bugs all the time but the number of bugs is dwarfed by the number of errors  that exist between the chair and the keyboard.  

	So people say they say they've got nothing to hide.  You've heard this a million times before.  Everyone's got plenty to hide, right?  They are the source of many of those problems.   Everyone has always had something to hide even now or in the past.  If people had nothing to hide a lot more people would post status messages to facialbook that say just jerking off.  For all the people in the audience, if you are feeling smug because you already do that -- [laughter.]  

	You are morally consistent but I would say you are lacking in long-term planning skills.  So people who are trained to do sketchy shit and not fuck it up, including organized crime and the feds, two groups to which there is not an insignificant overlap, you will hear terms like trade craft and upset.  

	Trade craft means techniques and methods and I'm going to throw up a few things to our friends the CIA.  I will make fun of them later, but they spend a lot of time thinking about ways they cannot fuck it up.  

	The best way to go when looking at CIA analysis by the way is operations.  Operations is where they fuck it up.  Analysis is where they spend a lot of time thinking about this stuff.  One thing, if you go to the CIA trade craft manual, where this is from, you can download and read it.  There's a big thing about evaluating biases and analysis.  This stuff is also really useful for operations.  

	I will just go through a couple of these.  Perceptual biases.  Seeing what we want to see only.  I think you can think of some CIA examples about that.  Biases in terms of evaluating evidence.  If a consistency, small samples are more consistent, they contain less information.  Only relying on available models when estimating probability, and problems with causality -- for example, attributing events to the fixed background context.  Sunni good Shiites bad for example, something like that.  

	All of these things transfer over to when we analyze our own operations when we're doing something bad.  There are also a number of activities that you can do to counteract biases.  This is where the interesting stuff happens, this is just a quick selection that has a good crossover from analysis to operations.  

	Checking key assumptions.  At the beginning of the project or when a project changes.  Checking the quality of information.  Doing contrarion techniques like devil's advocacy.  High impact, low probability and what if, how that happened.  

	And then of course things we're familiar with, from pen testing.  Red team analysis, opposing force and adversary analysis.  Doing these on your operations and looking at where they're applicable.  

	The other side of that is OPSEC.  People say that a lot in this community, it stands for operational security.  It basically means preventing leakage of information which could lead to discovery or advantage by the other side.  This World War II image sums it up.  Incidentally, on the topic of being old school, I showed this picture to someone under the age of 25 and they said why is Gandhi the enemy?  [Laughter.]  

	I can't wait until all education comes from Wikipedia or IMDB.  The government uses your tax dollars to produce literature to help you with OPSEC so you need to check this stuff out.  You need to understand what information is relevant.  Likely threats and vulnerabilities.  Risk assessment and applying counter measures and the point of this poster is, it's tough to see the text but you can look at it on the DEF CON DVD that OPSEC doesn't end with the operation  itself.  It covers all of your initial explanation and exploration and everything afterwards.  

	What you really want to get into your mindset is, you don't even know you are going to do it and then you forget about it afterwards.  OPSEC is a 24/7 job.  

	So here, my variant of the seven deadly sins.  The seven deadly fuckups.  What makes you a candidate for getting busted?  Over confidence, thinking they'll never find me.  I am using an automization tool.  So depending on a single tool is a point of failure.  

	Excessive trust.  In surveillance states, for example in East Germany, 1 out of 66 individuals was a government informant.  What do you think that ratio is like in the hacking community?  Emmanuel Goldstein estimates one in five.  Probably that's the high bound, but talk to Chelsea Manning for example.  I bet she's regretting the trust model in the community.  

	Conviction that your guilt is minor and no one is going to care.  Oh no one's going to care what I'm doing, I'm just defacing a website for example.  It's all going in your permanent record.  

	Guilt by association.  Visiting the wrong chat room, coming to the wrong conference, being associated with the wrong people.  Like the real estate people say location, location, location.  Exposing where you are coming from is always likely to fuck you up.  It can expose you to many things besides just reverse exploitation which the government has been doing.  

	Of course sending anything in the clear not just personal identifying information but browser fingerprints, unique device IDs, locations you are or might be at in the future.  

	Keeping too much documentations about what's going on.  People who are like really fighting the state and doing serious business know about this.  This is a quote from a Ukrainian separatist.  Home computers and personal cell phones should never be used for operational purposes.  Identifying documents should never be carried.  Details of military operations should never be discussed on phones or in front of family members.  You may even need to do things that you don't like to do like abstaining from alcohol.  

	Like sins you are going to commit one of these, you are going to fuck one of these up.  Use your trade craft analysis to figure out how you can recover from making mistakes.  One of the things you can use to stop fucking things up is tools.  But tools can also help you fuck it up.  A computer is a tool that helps you fuck things up a billion times faster than you could do by yourself.   

	They increase confidence.  The sin of overconfidence.  That is the likelihood of fucking it up.  Using a tool badly or stupidly can be worse than not using it at all.  This is one of my favorite tool injury pictures, or tool hazard pictures because this is from the water jet cutter.  It puts out a stream of compressed water at 15,000PSI -- it breaks the sound barrier, it cuts through steel, and everyone who walks in the room is like what would happen if I stuck my hand in that thing?  

	So here's the first tool.  VPNs.  You're going to use an insecure network.  Two questions when it comes to tools, should I use it and how should I use it?  What do you get from VPN?  You get some traffic encryption but only between you and the VPN itself but not necessarily from the VPN to the remote location.  

	You may get some location obfuscation to the remote server.  They may not know exactly where you are.  Maybe you get some request concealment to the ISP, between you and the VPN, not afterwards.  So it really depends on where the listener is located.  It's a single hot proxy.  So anyone who is watching both ends, like a state agency, can do traffic correlation very, very easily.  

	It also shifts the trust model over to the VPN provider, a provider you probably have a financial relationship with.  That could be traceable, depending on how you are paying for it.  

	So think about those things.  VPN providers really vary on what they promise.  Many of them say they don't keep logs.  You should know their logging policy, but that doesn't tell you the whole story, especially if they're not located in the United States because they can start logging any time they want to -- for example when they receive a national security ladder which they have to refuse to tell you, by law, that they have received.  So just because they don't log now doesn't mean they won't in the future if you become interesting.  

	VPN clients vary on how well they hook you up.  They can leak informations depending on the client.  I've seen this myself.  If you plan on hiding behind a VPN then you better see what the client left you exposed.  Connect to the VPN.  Run wire shock or a package sniffer on another computer and see what's coming out of the computer you're going to use for operations.  Is everything going through the VPN or not?  

	If this small amount of thing is too much effort for you then internet scoff law is probably not the job for you.  You should work for the government instead.  Here is a simple test for the lazy.  Open up an SSH connection and fire up your VPN and see if it drops.  If it stays open, then stuff is still being leaked.  Existing connections are allowed to go through and all kinds of things could be falling out with your real IP.    

	A lot of VPN clients are also shitty for mobile use.  Every time you put your computer to sleep or move around, the tunnel goes down and you have to reconnect.  When that happens every freaking app on your computer phones home and tries to immediately reconnect before the VPN reconnects, and exposes your IP.  

	Mail clients.  Browsers with open tabs just like to reload them.  Browsers that are doing all kinds of Java script in the background, that are communicating.  All your shit is exposed.  If this applies you to make sure all this stuff is shut down before you close the VPN.  Even if it's as simple as doing a kill all minus stop, I know that's impossible to read but that's what it says, think about everything that could possibly phone home and stopping it before you close the VPN, is a good habit to get into.  

	Of course, habits are fragile, you will eventually fuck it up so try to automate that process.  

	Another thing on that subject, randomize your Mac address.  It's already been exposed that the Canadian government was probably illegally tracking people using airport WiFi from their Mac addresses so they could see where people were moving around in various airports.  So I like to randomize my Mac address as often as not too inconvenient.  

	So, should you use a VPN?  What kind of a list does it get you on?  VPNs have their uses and flaws so if you are going up against the big guys and they are on both sides of the VPN, traffic correlation is trivial.  Simply using a VPN makes you look interesting.  This is the from the Exchesco manual in 2008.  Got to also remember with Exchesco, this is not a real time traffic processor.  This is a database miner.  It is a set of filters for stored data.  

	People often say to me you should be on a list.  Well I use a VPN when I travel especially so I'm definitely on some sort of list.  This is from Pacific Sig-Dev in March 2011 also mentions ingesting and storing VPN data, and once again identifying VPN use and finding out ways to get into those networks.  

	It mentions a program called Birdwatch, we know nothing more about this.  But clearly some sort of data mining program that could perhaps be put to use collecting VPN key exchanges for later encrypt analysis.  

	By the way this is also from Pacific Sig-Dev.  I am really pleased to see in this presentation we got a category of our own, right next to terrorists, criminal groups and foreign intelligence agencies, so we're in the big time.  

	Here's another NSA slide, black pearl, a survey database from the taps on the undersea fiberoptic cables, presumably providing high level communication of things such as communications having a foreign end point because technically they're only allowed to look at things with a foreign endpoint.  They can collect everything, but it only counts as domestic data collection if they look at it.  This is that legal weaseling.  

	So once again, using VPNS is something that can attract attention.  This was reported as a tool for specifically targeting private networks but that doesn't seem to be the case.  So if using a VPN puts you on a radar -- Is that a reason not to use it?  I don't think so.  Because you might as well make things more difficult for them but perhaps in certain cases you should be aware of it when you do your trade craft analysis.  

	Here's another about intercepting and decrypting VPN traffic, this is the Hammerstein slide, referring to doing a man in the middle attack on VPN traffic via compromised network route with implants inserted.  So these refer to selected decrypted content.  

	So the good news is, going to all this trouble probably means it's not all vulnerable.  But at least some of it, no doubt, refers to crypto-attacks on PPTP VPNs.  None compromised since about 2012.  Moxy, Milon Spike and David Holdon DEF CON 20 presentation -- And release of cloud cracker for PPTP.  

	So a VPN is probably still worthwhile but you have got to make sure it's up to date.  Don't just rely on that one thing.  One thing you can do if you are truly paranoid is hop VPNs every few minutes.  Some providers offer this service within a single provider.  Again, you are depending on one provider.  

	Now you are generating really interesting traffic for the NSA but against some listeners you have decorrelation noise in there.  Good for research, like searches and port scans.  Just don't fuck it up believing this one hop proxy is going to be a magical all-in-one solution.  And remember it leaves a financial trail and that can connect to your real identity unless you are paying anonymously.

	So let's go multi-hop.  Don't fuck it up when you use TOR.  Hopefully everyone here knows what TOR is and the main way you fuck it up when you use TOR, which is thinking that TOR encrypts your traffic by default.  It doesn't.  TOR is for anonymization, not for encryption.  The layers of encryption adjust to protect the routing within the onion.  It's not protect your base traffic.  You need to encrypt as well.  

	TOR is very, very important.  There's been talk recently about is TOR broken or is TOR a honey pot developed by spooks because they have federal funding?  I don't think either of those are true but we're going to talk about some of that now because I think it's really important that we do.  

	TOR is the main way dissidents get out and communicate out of oppressive regimes.  It's how researchers can look up suspicious information about themselves without being targeted.  It's the way ordinary people can search and communicate without being tracked and monitored.  And it's how all of you do a search after DEF CON for catastrophic liver damage without raising your insurance premiums.    

	So it pisses me off with people say that TOR is only for illegal acts.  Don't fuck it up TOR by only using it when you are doing sketchy shit.  Pump a whole lot of your normal traffic through it.  Even if you completely squeaky clean and you are not doing anything wrong still use TOR because that helps out everyone else.

	Also the nature of TOR is for anonymity, it's tough to tell people that you are using TOR for good.  If you can, if you have a use you can talk about get it out there.  Hash tag, tweet something like TOR for good.  The TOR devs will appreciate it.  

	Let's talk about people who should know better who have fucked it up using TOR.  We all remember this.  Saboo.  Lolsec and antisec.  4chan and nons, trolling the web, for SQL injection vulnerabilities, DDOSing websites, dumping user account databases and taking down high profile things that will really get them in trouble, like the CIA's website.  They were coordinating IFC channels accessed by TOR.  

	The feds discovered that, monitored the channels, waited for someone to fuck it up.  Saboo committed the sin of packet origin, logs in just once without using TOR.  Gets owned immediately, immediately a few seconds later gets turned into a snitch, because what's he going to do, right?  He's facing decades of federal imprisonment.  

	So even though he's been doxed months prior at that point it's confirmed he goes snitch.  So that's not the interesting part.  The interesting part is what happened to Jeremy Hammond.  He gets identified from information in recorded chat logs with Saboo, the feds log that packet meta data from his wi-fi access point, they get a chat register, a regular pin register track and trace order.  Standard wire tapping, right?  They match his Mac address, of his computer, to packets going to a TOR entry node, correlate the times of TOR access, his TOR access on his wi-fi access point to his presence, his ID in the IFC channel.  

	So traffic correlation attack but not of the normal kind we think of when we talk about TOR.  So there's no compromise necessary of TOR to acquire the circumstantial evidence that eventually put Jeremy Hammond away.  

	The moral of that story, is, don't fail unsafe with TOR.  That is the Saboo moral.  Practice hygiene.  If it's going to matter that you are doing this, then don't have two browsers open even, right, if you accidently type something in that's not in TOR browser.  Make sure everything, even your DNS goes through TOR.  

	Use a separate machine, that's proven to only connect through TOR, it's a very good idea.   Or if you want to firewall it, use a firewall like PF sense to make sure that all the traffic through your network goes through TOR then check what you are exposing, go to something like IPcheck.info and make sure that things are not being exposed.  

	And of course don't only use the TOR for operations.  Don't provide the correlation of TOR usage with doing bad things.  And of course OPSEC is 24/7.  This is a chat on Reddit with Saboo after he was a snitch saying keep your OPSEC up 24/7.  Friends will try and take you down you know if they have to.  Never a truer word spoken by a fed snitch at that time.

	Another one we've all heard about.  Harvard student.  A bomb threat gets called in to Harvard during exams.  Takes a matter of hours before the perp is uncovered as a student freaking out about exams.  Use TOR to connect to guerilla mail which adds an originating IP header.  So, a lot of OPSEC fails in this case.  Mainly the folly of only using privacy tools when you are up to no good.  Privacy should be had for breakfast, lunch and dinner.  Privacy is like bacon.  It makes everything better.
	
	So here's how he fucked it up.  Harvard's network requires you to register your Mac address.  Another reason why MIT is better than Harvard, because we don't do that.  But Harvard requires registration tied to Mac address, and they log the outgoing traffic.  

	These things provided multiple potential vectors for this guy to fuck it up.  Again no compromise of TOR necessary, and this is kind of a microcosm.  At one university of pervasive surveillance and pervasive correlation because there's lots of ways that those two things put together could fuck it up for him.  For example, investigators could look at who went and downloaded the TOR browser bundle right before the bomb threat got called in.  Or look at everyone who connected to a known TOR entry node at that time or who accessed the TOR directory servers.  

	So when I think about this, I think about what we've already got in this country for a model of pervasive surveillance that everyone's familiar with, and that's the credit agencies, right?  And we do a kind of OPSEC with the credit agencies.  We get credit before we expect to need it, to build up a rep, right.  Use privacy before you need it.  We don't cancel credit cards even when we don't need them anymore because they just sit there keeping on building up our reputation so don't stop using the privacy tools when you finish doing something bad.  

	So just like when the credit agency TOR usage can put you on a list.  But, you've got a good reason for being on that list.  So, there's a lot of ways this guy could have not fucked it up.  For start, He should have done, as we said in our trade craft, key assumptions and high impact, low probability analysis, being prepared for that inevitable interview with the cops as a TOR user.  Or he could have used a bridge relay to connect to TOR.  More on this later, we know the NSA has been tracking bridge relays too.  

	He could have been prepared for traffic analysis on his entry point so if he had gone off campus and used a Starbucks or a burner cell phone with a data plan then he probably wouldn't have got busted.  People do swattings and bomb threats all the time and there aren't really resources to track it down.  You just have to make it hard.  And of course he could have used a mail service that didn't IP identify and expose his TOR exit node.  

	What do we know about how vulnerable ordinary TOR users are to state surveillance?  What we do know is TOR was troublesome enough for NSA GSHQ that they had at least two anti-TOR symposia, remation one and two, most recently remation 2 in 2012.  So probably there isn't a straightforward backdoor.  That's good news that they had to have a conference on it.  

	We do know that using TOR is obvious.  TOR is designed to make TOR users look alike, not TOR users look like non-TOR users.  So fingerprinting is already done for you.  We know that attacking TOR seems to have been challenging enough in 2012 that they went for a browser instead delivering a native exploit to the version of Firefox used in the TOR browser bundle.  I think that's a good sign too.  

	This is from the famous TOR Stinks presentation which I am sure you have also seen, so this is going to be quick.  We have an admission that de-anonymizing old TOR users all the time is not able to be done, so de-anonymizing is possible but trivial.  So you have to practice your comsec inside of your TOR sessions.  

	Of course they're doing traffic correlation attacks, it doesn't seem to be on a big scale though.  And staining of TOR users, either by storing cookies or by using quantum man on the side attacks to force the browser to give up identifying like Yahoo and Google cookies, this is one reason why using the TOR browser is good, because it doesn't store those cookies.   And also quantum methods to deliver exploits to the computer, like the Firefox asset program.  You can look that up.  I won't talk about it.  

	So some of that certainly should give you pause about how safe TOR is as a single solution.  Don't ever use single solutions.  The good news for regular TOR usage is that it makes things harder.  This is the third document released at the same time.  The system as far as low latency and anonymity goes is still the king.

	Similarly a lot of counter TOR efforts going to client side exploitation so tails gets a positive review from the secret police.  Adds severe computer exploitation misery to the equation.  

	So what does all of this tell me?  TOR does put you on the radar and it entails making these people's lives harder.  That is a risk trade-off you need to think about.  So how I think about it is using it puts you on a list, a big list and if your disobedient acts would put you on a much smaller list, the list of people warranting serious attention, then it's probably worth being on that big list as well.  The more people who are on that big list the better it is.  

	Also security of your whole system is still more important in the big picture than any one single element.  To put it another way, there doesn't seem to be a critical flaw in TOR that makes all of these other attacks necessary.  But if your life, or your freedom, depends on it, don't ever trust one single element.  This include TOR and lots of other tools in your communications chain.  

	Do your trade craft.  One example I like to use, I like how it says on crypto-cat's website you should never trust your life or your freedom to software.  I think that's slightly over stating the problem, right?  We trust our lives to software pretty much every day, every time we get in a car or an airplane.  But, when you get in the car you also put on your seat belt.  It's like the old Islamic proverb:  Trust in Allah, but tie up your camel.  

	Here's more good news.  The big list and the small list, this is the recently leaked filter rules.  I know this is totally unreadable but basically these ones show the security agencies are hell bent on making that big list as big as possible.  Anyone who connects to the TOR directory service, or the TOR website, gets put on that big list.  

	In terms of the state admission, they're the secret police.  This is great.  This is akin to looking for a needle in a hey stack by piling on more hey.  Great work.  This is really good.  t's upsetting that they're targeting everyone that uses TOR, especially in the less than criminal, it's stupid way but no more so than the blanket surveillance we're talking about.  It's just reinforcing that we need more people using these services.  

	This part is worse.  I mentioned collecting the addresses of bridge relays by mining them out of E-mails people send when they get a bridge relay.  I think this is a really scummy thing to do and it's worth being aware that they're doing it.  So the Harvard student may not have been caught using a bridge relay.  Maybe, maybe not.  We don't know why.  We don't know, because we don't know how much information gets shared between these three letter agencies but be careful out there.  

	Finally in terms of really loading up on the hey, tails and TOR are advocated by extremists on extremist forums.  That is a comment from the Eschecor rules.  So congratulations.  We're all extreme.  Have a Red Bull.

	Silk roaders and Dread Pirate Roberts.  We all know the story.  Silk Road operates as a TOR hidden service.  Over two years before someone gets busted.  Not a bad effort, in spite of some metrics.  We know that the feds made hundreds of drug purchases through Silk Road, slowly carefully doing the case they let it operate probably for longer than they had to make sure they could get a bust.  This is like standard organized crime stuff.  

	They busted the Dread Pirate Roberts at the same time they image and seized the Silk Road server.  So what fucked it up?  We know there were numerous OPSEC fails by the Dread Pirate Roberts, stack exchange posts, forum posts from the same account including his real E-mail.  Ordering fake IDs with his face on them, lots of things that were likely to fuck it up for him.  

	But we don't know how the server was de-anonymized.  That is the 180,000 Bitcoin question.  How did that happen?  We don't know the answer.  But here are some options.  The Dread Pirate Roberts was already identified and monitored.  Somehow, he pulls a Saboo.  He logged in without TOR one time to fix a server for example.  Not out of the realm of possibility.  

	The hosting company could have been identified by commercial means like the pay tracing and imaged all the servers on that hosting company like what happened with freedom hosting.  They could have served an exploit to the Silk Road server, owned it and had it de-anonymize itself.    That's what they did to the freedom hosting customers or they could have performed a large scale time intensive hidden service de-anonymization attack.  

	We don't know the answers but let's talk about the only one that involves an attack on TOR directly.  Hidden services, what you need to know about them is that they are at a huge disadvantage in terms of correlation attacks because the attacker can prompt them to generate traffic.  

	They are basically two TOR circuits connected around a point.  Anyone that connects to TOR long-term, to the same thing, is vulnerable to these kinds of things, especially the hostile relays, because the network's not that big so sooner or later you are going to go through a malicious node.  Not such a problem for a typical user but if you are maintaining a long-term repeat business like a world wide drug supply company then its dangerous.  

	I don't have time to go into details but this is a paper released recently by Burikov et all about de-anonymizing hidden services.  They were able to have a hidden service and map the popularity of a number of hidden services, including Silk Road in two days, so this is mapping onion addresses and the usage of them.  Two days, and less than a hundred dollars, and they see two instances.  

	Also able to confirm that a particular TOR node acted as a guard node for the hidden service for the deanonymization of that hidden service, with 90% probability in 8 months for 11,000 U.S. dollars.  Well within the realm of possibility for state actors.  This relied on a bug that has since been fixed.  A black hawk talk this week that was cancelled relied on a different bug, also since fixed.  They were able to stain TOR traffic for hidden services.  

	This was very irresponsible of them because that stain is now preserved in all of the traffic that's being collected by state surveillance agencies.  So if TOR's crypto is broken at a later date those people could potentially be de-anonymized.  

	The good news about it is this stuff leaves traces.  This shows a spike in the number of guard nodes when Burikov and others were doing this so it can be noticed.  So that's the good news that you know we can find these bugs and fix them but be aware that yes there are potential attacks on TOR but not against everyone all the time, we think.  

	About hidden services the state actors don't have much to say that's not in that paper.  It's the same kind of thing.  Harvesting hidden service addresses to see what's out there, and then using cloud instances of TOR relays.  Presumably keeping up with what's being done in the open source community, but no reports of noticing these attacks on a continuous basis.  

	And let's remember from the J-trick wiki, conveniently released I think the day or day before DEF CON flags were due so they could put them in here.  Spooks use TOR too quite a lot.  So these were either the British GCH people, using TOR for all kinds of things.  So even though they almost certainly commit the sin of over confidence, among others, they have a sense of surety that their activity is not going to be de-anonymized all the time.  For what that is worth.  

	Also on the subject of whatever that's worth, personally even though trust isn't transitive and it doesn't help anyone in this room, I know the TOR developers personally, some of them, and I trust them not to run a government honey pot and not to make back doors for the spooks for whatever that's worth.  

	So the key element to this whole thing is not the de-anonymization of the service.  The Silk Road service, which is possible, the key element is being tied to identity of the operation of that service.  It's theoretically possible for the server to be completely identified and imaged because it's a bi-directional TOR circuit without Dread Pirate Roberts being busted.  So if he practiced COMSEC properly he might not have been caught so the moral of the story is don't run a massive online drug sales place if you don't have a plan for when that thing gets infiltrated.   

	There is a meta-lesson to all that too.  Maintaining anonymity with a large organization over a long period of time is really, really hard.  You have got to do everything perfectly and not everyone starts out intending to be an international cyber criminal master mind so they don't take precautions ahead of time.  So decide in advance where things might go.  Do that trade craft analysis.

	Let's move to phones.  What does that little Benedict Arnold in your pocket do to give you away?  Well, so much freaking stuff.  The meta data of all your calls and location information to all federal agencies being given to them straight by the phone companies.  Also locations from the data and photos you take.  They leak your contact lists, offer lists to the wi-fi networks you've accessed to anyone who is listening in that area.  

	Unique identifiers such as IMEIs, UEIDs and so on.  Preference cookies from browsers and so on.  Sometimes the contents of your searches if you do them in the clear.  The older devices have weak crypto especially the ones with a mixed version base, especially Android.  

	Web browsers on these tiny little devices have little ram and cache so they're constantly reloading freaking tabs as fast as they can, so everything you've done recently when you move to a different network gets reexposed.  

	Auto connect.  The WiFi pineapple's best friend.  Hello ATT wi-fi.  Hello, Xfiniti WiFi, I remember you.

	Apps of course.  Leaking all kinds of shit.  It all adds up to a unique identifier of you and a patent of your life and the agencies monitor this kind of stuff constantly, especially looking for concurrent presence and the on-off patterns of your phones.  

	I'm kind famous for not carrying a cell phone because I don't like publicly associating myself with criminal organizations by which I mean of course the phone companies.  But there is one time of year I carry a phone, it is this little seven year old Nokia feature phone and it must look great in the meta data store, because every time this phone is used, it's constantly surrounded by thousands of notorious hackers.  

	But for the secret police, smart phones are the best gift they could ever get.  It's like Christmas, Hanukkah, and Steak and Blowjob Day all rolled up into one big spy orgasm.  Their perfect scenario is just a very simple thing.  A simple photo share that happens millions of times a day, they get everything I just mentioned and more.  They know this, and yet even the spy agencies manage to fuck it up.  

	Here we go with the CIA.  February 2003 rendition of Egyptan cleric Abu Omar from Italy.  The police were able to reconstruct a minute by minute rundown of that abduction from the cell phone records.  

	25 CIA employees and one United States Air Force lieutenant colonel were named and charged by the Italian authorities for pulling this guy off of the street and illegally abducting him and spiriting him out of the country.  They did this because the phones were geo-located near the abduction at the time.  They found the numbers had called one another and even family members in the U.S.  They never removed their phone batteries.  They geo-located the phones to the hotels at night, checked the phones against registration records, many used their own names, and some made sure their hotel stays were registered to their frequent flyer numbers so they got the miles.  

	So if you are going to use a burner phone under this kind of capacity to massively correlate every phone that's in use all the time, then you need to know what to do to not to fuck it up.  In fact if you are carrying a personal tracker device, AKA a cell phone you've probably already fucked it up.  

	Here's what you have got to do to use a burner phone.  Agencies specifically look at traffic to identify burners, looking at things like length of time from activation to when they go away and are never used again.  

	Patterns of use.  Try to identify burner cycling, if they get used again.  Fingerprinting of phones.  EFF is suing the NSA about this right now.  They log signal strengths at cell towers to get your location every time the phone is turned on and used as a record and the number used to activate the phone or SIM is also recorded.  And also the purchases.  They'll go back to security video in the WalMart where you got it from.   

	So here's what you want to do if you want to use a burner phone securely.  Purchase them a long time in advance, before the operation.  Register them far away from the operation's area.  Use false information when you register them.  Go with dumb or feature phones instead of smartphones.  

	Remove the battery when you aren't using it.  Fill the phone with fake contacts.  Use each one as little as possible and switch phones when you switch locations and leave the phone at that location so you don't fuck it up.  

	Call unrelated numbers so there's a different pattern of network per phone and remember the purpose for each phone and finally destroy it when you are finished or, you can do what McAfee does, which is tape it to the bottom of a long distance 18 wheeler and let it go for a ride.  I'm not saying that's the best thing to do it because eventually someone will find it and do forensics on it but think about that.  

	Don't ever turn a phone on in a location that you can be placed at.  Allow your phone to be on at the same time or placed with another phone that you own.  Call the same non-burner phone from multiple burners.  Store any real contacts on that phone.  Matching entry and exit point.  We know specifically that they work for that so don't match the last use and first use of phones.  

	Overlap it.  Don't tie them to online services that can bridge that meta data for example Gmail accounts.  Think what you would do to red team a massive database of location, time, call destination, call link meta data.  Anonymity is hard.  If you can't go to the trouble to not fuck it up then evaluate whether the risk you are taking is worth it.

	Messaging.  After all of these years E-mail still fucking sucks.  Fighting spam aids tracking, because that's why they insert sender IPs and other information into the headers.  After all these years of the wall of sheep, let's give it up for the wall of sheep because they're awesome.  After all these years of the wall of sheep, Web mail service is still going to HTTP and not forcing HTTPS.  So the accurate more accurate sheep-related analogy is this, a sheep filled with God damn worms.

	Mail services, even if they implement SSL, they have weak service-side storage.  Remember the GCHQ slide with that infamous smiley face.  They may not encrypt on their internal networks.  E-mail is still fundamentally broken because even if you use PGP or S mine the meta data is still not encrypted and the meta data can still fuck you up.

	This is a huge one.  People keep their E-mail.  It's logged insecurely on the client side - either in browser caches and so where it can be exposed, or people just having bad retention habits and saving all their email.  Like someone famously said, "It doesn't matter that I don't use Gmail because Google has my mail because all my friends do."  

	Remember that.  Google is part of the problem.  They never delete their mail, that thing.  

	Instant Messaging is not much better.  Remember the psycho example principle.  Never say anything, never put anything in a message packet that a psycho ex could use credibly against you later.  Assume everything is being saved forever especially by the NSA, if it's encrypted.  Their retention rules allow them to keep it for forever if it's encrypted.    

	We all like to make fun of security by obscurity.  But sometimes, that's all we have.  These are the code talkers in World War II, a classy example of security by obscurity that worked.  At its best, it's fully deniable.  It's arguably the safest communication, because either no one even knows it's a communication, but if you are going to use it, security by obscurity, make sure you don't fuck it up.  

	Here's another CIA example.  General Petreus, picking on these guys going all the way to the top -- he's having an affair with his biographer.  They write messages in draft emails and don't send them, they just delete them when they're read.  Multiple people have access to the account.  In spy terminology, that's really casting email as a dead drop instead of a transit mechanism.  

	Now, I would never begrudge anyone a booty call but if you are going to fuck don't fuck it up.  They used the exact technique developed by people the CIA was already monitoring.  Quote unquite, Al-Quaeda people in the Middle East somewhere.  Using multiple accesses to a single E-mail address from different locations, that's exactly what pervasive surveillance was designed to expose.  Anyone in the room if given the database and told, write me some interesting queries, one of the first things you would do is say, give me all the accesses to the E-mail accounts that are impossible journeys, that are in times you could physically not make that location transit.  

	Secondly don't rely on things getting deleted.  If Google knows about it it's no longer safe.  It's cheaper to keep things than delete these days.  So be judicious about your insecurity.  Understand your insecure channels.  It's okay to use them but manage them.  Do your quality information check and your what-if analysis.  You should understand by now in this talk that Petraeus could have covered his tracks even if it looked plain for all to see that two people were having an affair, as long as it couldn't be tied back to him.  

	This happens millions of times a day, hiding the noise.  

	So here are some common services.  Commercial web mail is all fucked.  I advise people to run their own mail server.  At least when the feds are interested you will know about it.  Meta data is still a bitch though, it gives it all away.  This is an image of the mail that Lee Harvey Oswald sent to the Kremlin.  That's what meta data is.  Hopefully darkmail will do something about this, I didn't go to that talk, I'm going to watch it later.  Hopefully it was good.  

	Skype.  Definitely compromised.  No question.  This is an enabling document referring to back door and commercial service providers.  By 2013 full access to a major internet peer to peer voice and text communication system.  What do you suppose that is?  Too speculative?  

	NSA briefing notes by the director of German intelligence on the potential land mines, a carefully passed statement saying that the official line, is that Skype is owned by tailored access at the end points, meaning compromising one or more of the communicating party's computers.  Not in transit, but a clear implication from the language that they've done a deal with Skype they didn't want to tell the Germans about, even though they are allies.  And if that doesn't convince you, JTrig's Wiki spells it out -- realtime records.  Bi-directional instant messages and contact lists.  Pwnd.  

	So fuck Skype.  I mean you can still use it if you want to but understand that people with the right capabilities, it's equivalent to unencrypted.  So figure out your threat model.  

	Lots of chat I think is broken if we're including the secret police in our threat model.  So I say, let's assume jt IFC is pretty much all collected -- if you can grab all of port 80 then why not grab 6667 for an afterthought, even.  If you are using SSL from you to the IFC chat room even one single person in the group chat unencrypted means that is all completely ownable by the massive surveillance.  

	We know that IFC is on the radar because of quantum bot, taking control of IFC bots.  Over 140,000 bots taken control of and coopted.  Lots of reasons the spooks might be interested in IFC bots.  Persistent presence all over IFC is just one of them.  Something to be aware of.  

	Remember things when Google promises off the record, all it means they don't keep it.  It's not true OTR.  Also remember Quinn Norton's great essay Everything is Broken.  Some OTR implementations don't encrypt that first message.  She has tales of people fucking it up because of the that.  Don't let your story be one of them.  

	So what can we use?  What might not be completely fucked?  Some OTR implementations, some people like Quinn have bad things to say about loop purple, but it's everywhere.  Crypto cat I think after some initial security fails really did the right thing.  They opened it up to community peer review and security auditing.  They really want to make a good product.  

	I have been using bit message a lot lately.  Every so often it goes berserk and runs my processes at 100% but it seems to be decent as long as you can connect with it regularly because it throws messages after two days because of security performance problems, so it's not good for intermittent usage.  

	I haven't played with retro share much but I like what I've seen.  I like the peer to peer structure and the key management.  It seems like a good direction to go in but it sums up that we really need more auditing.  We need more peer reviews so we can see what we can really trust, and it also suffers from the floor of standing out of as we need encrypted communications, so we need steganography.  

	I'm about to be dragged off the stage.  I have two things to say.  Number one, we say there's a lot of suspicion of glass holes, because they might be recording us.  Well guess what?  Everyone is fucking recording shit.  Everyone is keeping E-mail and their IMs for so long and not deleting them - we need ephemeral messaging that's not just in the smartphone app space.  We need more steganography.  We need, all right I'm getting there.  

	One thing.  GCHQ.  They had to take people, use special staff to view the chat video they were illegally collecting, because of all the nudity, so send plenty of nudity.  Make it the bad --  Ugh one more thing.  

	So the One thing I just had up, a friend of mine wrote this and it mixes cat pictures with things that look encrypted - things that look like security documents.  So you can swap cat pictures for porn.  One last thing I want to say to the people in the audience, to the haxors, lose the ego.  Follow those burner rules for your identities.  Keep your real in real life identity real and separate from the ones you do bad things with right?  

	People come to conferences like DEF CON to get cred but cred is your enemy.  Don't talk about the shit that you are doing.  This is where the criminal complaint against Jeremy Hammond, this is where Saboo goes to great trouble to connect all of Jeremy Hammond's identities together so they can put the criminal complaint together.  

	Finally support the EFF.  Ask for things.  Good luck.  It's better to be lucky than smart sometimes and never surrender to obedience.  Thank you.

	[Applause]

	>> All right so if anyone wants to talk to him we're going to be out here in the hallway.  If you are staying please move your stuff.  There are shit loads of people outside who all want to come in.