Killing with Keyboards: How Your Digital Footprint Can Be Weaponized

Transcript

Now, please welcome our next presenter, Mr. Noah Jalich. The floor is yours. Hello. Hello, everyone. Uh, let me just make sure that uh it's full screen. Okay, there we go. So, I hope you're ready because I'm going to dump my uh corporate trauma on you all for about uh 20 minutes now. Uh so, I'm deeply deeply emotionally scarred. The reason for that is that I was exposed to non-technical

founders and the way they manage security. You see, in general, we're talking about how you should be fearless in your approach to business, how you should just move forward and stuff like that. And that's all fun and dandy and good until your non-technical co-founder sort of guy loses the access keys, the entirety of the three physical hardware wallets that control the multi-IG that controls the entire platform two weeks before launch. And some you have to redeploy an entire system.

uh with no time, right? So with that in mind, this year I had the thought that maybe I could put some fear of dog into all of you people and tell you a little bit about operational security. But first a little bit about me. So I'm a security researcher and software architect currently engaged with Oasis uh as a core dev and with cyber capital as an external researcher. I've done many many security audits uh somehow with no production bugs. Uh I'm a parent and I very much like public transport, bikes and trains. So I'm enjoying those aspects of Japan very very much. Um anyway, let's get into it. This is like

a little story time I prepared. Um so let's start because people like stories. So this is Sashko. Sashko is a he's a normal kind of guy. He's a chill guy, right? Uh he's a Ukrainian engineer working at Kovchek Systems and that's like a hardware secure devices company. Uh he has a happy little family that doesn't do anything particularly unusual except that from time to time he will chat with other security professionals and you know follow up on what's new in the field. Um, of course, anonymously uhay and blink and you'll miss him, but

he is there. He shares useful insights, his knowledge, and uh he's well respected and considered helpful, you know, in various Zulip or Telegram or whatever chats where he may engage. And now this is this is a story about humans. So there of course has to be a girl. And there is a girl. This is Kim. She's a she's a teenager from the Democratic People's Republic of Korea. And she is what we would call, let's say, a searcher or uh a Googler. Every day she fulfills her role. She collects information uh and creates files on various topics that her government assigns her for others to use. And

today, today it's her lucky day. She doesn't know it yet, of course, because today she found Sashko, or at least her pseudonym. She doesn't know much about him yet. She doesn't even know that he's a he. But soon she'll find out more. Anyway, uh back to Sashko. So, today the team hit another major program milestone, which means uh that everyone gets a nice little bonus, which is great. It means bogdan. That guy is one one step closer to his retirement farm that he's been awaiting for a long long time. Um on the other hand, the other half of the day was spent on like a security briefing which

everyone hated because you know what a waste of time security. Uh and uh they said they would talk to senior management about maybe reducing those. Um after after the briefing, after the work day ended, they walked over to to a new class place that opened. Uh it caters to the companies in the tech park where Kovchek Systems is located. Uh, and it offers free Wi-Fi, six free small uh, private quiet rooms to make phone calls and a 15% discount to tech employees.

Uh, you just need to show your badge. And while in line, Sashko, of course, complained, you know, do you really think a person with security clearance need to be reminded of this stuff? Like, nobody does dumpster diving anymore, etc. Security guys have no clue, right? Um anyway, yeah, back to Kim. So, Kim's group leader often said that searchers need to be very very patient when doing their work. You know, it it really is a random search. You need to go through a lot of information just to find the one thing that may be useful.

It's it's a review process. And you know each Each petal in a way helps you identify the flower it came from. So you just need to keep searching and you never know. You never know what's going to be the right thing. In this case, Kim followed uh Sashkos trail and it was actually a security privacy review that he conducted that got him because at some point in time he was like, "Oh, no, no, no. I don't want to use my real name on this." uh on this site. So, let me just change the username. So, he did.

Unfortunately, there's such a thing as, you know, archive.org or various other cache websites and uh by using some maybe a little bit more advanced search ruling. Um Kim was able to make a correlation between his old and his new username uh and thus get his real name. Once she had his real name, everything was really easy. Um, you know, he she could get all of the other info on him, his wife, his son, his various accounts, all the old social media that may be undded or cashed somewhere. And as she kept going, it was more and more and more information. She

was digging deeper into his life. You know, being a teenager, she may even have a little crush on him. She just spent 200 hours reviewing the guy. Come on. uh she was finding out stuff about him that maybe not even his family knew about. You know, his old black hat days or something like that until one day Kim's work on Sashka was over. Kim's leader rewarded her for her 200 completed file and uh soon of course her family got upgraded in accommodation etc. student. She would even have the honor of recommending her little 13-year-old sister to join the searcher

team. They are very very intelligent in the family, right? Um, and this information about Sashka was available to use freely by the rest of the team. Anyway, forget about all of that. It's been a year or maybe even two years and you know, who can remember what happened back then, right? We're at a conference and uh Kim's government became aware that there's a certain vulnerability in uh in a certain version of a security chip and uh they're hoping to use it and Kofche system is a big hardware

provider. So um they are hoping to maybe find out if coach system uses that vulnerable version. And Sashko is at an out of town engineering conference similar to this. You have a lot of little boots and you have reviews for who can come in. You may even require company sponsorships to get to certain places like speaker rooms or VIP rooms etc. But it's also in a way in a public space. So, you know, you can walk around, there will be some shared spaces. Um, and everyone has little badges, right?

And it's been a few days and Sashko is sort of tired. So, Sashko is heading down to the restaurant, to the bar, right? Uh, in the in the venue and uh he notices a guy wearing a Dina Mov hat. Huh, what a coincidence. He loves Dinamokv and he had seen him several times around, you know, he had seen him outside the venue in the elevators walking around like guy seems to have something to do here, right? Maybe at the conference and he walks over, right?

Dina here, you know, and uh, of course, they strike it off instantly. The guy is a big fan of Dino Makv. They get along well, right? Uh, and they're chatting. They're chatting about life a little bit. They're chatting about women, about whatever is going on, children, blah blah blah blah blah blah. The guy's name is Jack. And some time passes and they're getting a bit peckish. So, uh, so Jack suggests maybe could grab some dinner on the company budget.

You know, good idea. Yeah. Yeah, let's do it. Uh, and and they start drinking a little bit with the meal. And, you know, it's been a few hours. you really you really miss something like this in such a long conversation. But at some point, Jack is like, "Oh yeah, my company uh is going to be using this like STM32 chip. We're going to be using uh this version." So I was wondering what do you think about the documentation for this particular, you know, release and like was it easy to use? Were there any issues that you found? Uh is Sashko a bit tipsy and very very helpful as a guy? uh it's like, "Oh yeah, of course we used it in these and those devices

within this series and it was great. We had no big issues or we had major issues, blah blah blah. Share some information, right? Um it's like uh it's just a passing note, you know, when they keep talking about life." Uh and then at some point Jack is like, "Oh yeah, I got to catch a flight, you know, um I I got an early flight, so I'll be leaving." And Jack is really really happy. You see, Jack managed to get the information he needed. Uh now they know that this version of the chip does have the uh that this uh these devices do use the faulty version of the chip that has the USB uh host exploit.

And also he has Sashko now as a friend, as a contact, as someone he can get more information out of in case he needs to, right? And he was able to do all of that, all of that without having to do anything at all unkind. He's very happy with how this went, you know. So yeah, a few weeks pass, another wreck news case or you know a hardware wallet produced by COC systems blah blah blah blah blah blah or maybe alternatively you know it

was a UB key or something like that that was used to sign secure messages or emails or blah blah blah between like an activist group which is now leaked. I mean you do not have a terrible amount of let's say anarchist style activism here but maybe in a more uh oppressive regime and uh yeah some members are executed or killed due to the breach of confidentiality. And I I I really hope this had an effect on you because I would really like to avoid uh uncomfortable situations in my future and I would like for others to avoid them as well. So a little bit of

being careful can help. But then the other question is what is careful? What should you do? What can you do? And the first thing you need to know is that OBSC is not a magic list of rules that you just follow. You know, there's there's many ways to to get uh to an end result. And I don't want you to fall for marketing because you don't just throw on a VPN and call it a day. Heck, you don't just do tour and call it a day. You need to build your defenses based on who's after you and what what do they want and what happens if they succeed.

So the first question is who are you protecting? Is it business information? Is it illegal activities? Is it personal data? Or is it just like a right to privacy? You know, idealist approach? Are you a journalist, an activist, a hacker, or whatever? Because different assets require different levels of protection. The second thing is who is chasing you? Are you hiding from nosy exes or uh or random trolls or some dumbass script kitty that is targeting you? because someone like that may be deterred by simple privacy settings on whatever you know centralized platform you use. Mid-tier hackers will have a lot more tools. They will use technical exploits while a while a high tier or

nation state actor may be able to barge in may be able to put in a significant budget to get to your data. Heck, I mean law enforcement can more or less arrest you potentially torture you to extract information out of you. Right? Wrench attacks exist. And um last question is what happens if they win? Do you just get you know a little bit of cringeworthy information sharing some nudes leaked or do you do you get murdered? Do you die? Do you end up in prison? Is it something like that? Because these should also the determine how you do the thing. And my answer here is compartmentalization and anonymity.

So I don't believe in privacy. I don't believe that my identity is private. I don't believe that anything about my life can stay private. I will be relentlessly still targeted by ads for ever though I will not see most of them. Um, but in case I wanted to get away with an exploit, there is a way. And the way is ephemeral. The way is doing stuff in a way where nobody can actually see what you're doing. Um, and where nobody can connect it to you. Uh that may mean provisioning uh tees to get um

uh to get ephemeral uh code running where nobody can actually uh you know observe it where the one running the code for you doesn't know what they're doing. Uh or it could mean uh creating a whole new ephemeral entity. In short, if I want to execute a hack, one potential flow for me would be to put on some find like a nice festival that's going on, you know, get get like a nice mask or something like that that's seasonal where nobody will really notice that I'm a very special guy here for wearing a mask or heavy makeup, right? And during that festival, we'll go into one of these shops and buy buy some hardware with cash because I don't want it to be traceable, right? Um,

I will connect these to a public Wi-Fi network. Uh, hopefully in another city and uh I will download all the tooling I need. Uh, why? Uh, because tour is very very slow. If you need to download packages over to, if you need to download development tooling, if you need to install node, you will not do it over to in the next half a year more or less. Um I will understand that I cannot protect my real identity that I need to have an ephemeral identity only for this. I will make new wallets which will be funded through mixers and uh I will prepare my payload within this secure operating station that is constructed exclusively of untraceable devices in an unknown

location and I will execute everything of course through tour. Um, and what I should end up with is once the hack is executed, once all the bridges uh have done their bridging work to get me to Monero or Zcash. Zcash is also good for mixing by the way. It's it just doesn't have the reputation that Monero does, which is actually good. And uh I'll be leaving with a piece of paper with a list of 20 30 40 Monero keys that have had several hops uh that contain all of my yield. Of course, distributed over these paper keys. All of the equipment used to execute a hack

should be shredded, burnt, and completely destroyed. And at no point should I associate this with my identity. I should not change my lifestyle for a long time unless I can launder the money in a reliable way. And that's more or less how it would go. So like there is a way to get away, right? Of course, it's very hard. Uh there's a lot of tooling and I've seen many many hackers get caught. Uh so it's not so easy. Don't don't don't do crime kids. Um what you can do instead uh is you can think about what your own security and privacy is and what what are you actually doing like do you use

social media? Do you use social media where you share your info because maybe you're a target of uh a basic criminal who is trying to kidnap you or rob you to just to get your crypto. This happens a lot uh to people here and in that case you need to think about what information you're sharing. Can somebody deduct that you're here in Osaka in this building right now? And do they know what your face looks like? And do they know what your crypto wallets are? Well, somebody may be walking outside the door, right? Uh so yeah, the other thing that you can do is sort of minimize use end to end encryption

for everything because it's going to be harder to find. maybe not use telegram because it is a completely centralized service with encryption recently added but generally not used by anyone you know it's just managed to build an identity through some sort of ISIS associated marketing scheme which I barely understand how it happened you know find the real privacy tools uh to end this I I will leave you with like my contact in in case you would like to ask more. And I would also suggest we're currently working on um uh like Seal 911 uh is working out a full privacy and

obscit and privacy tools.io also exists. So I'd suggest checking those out to get a better idea how to make yourself private. Or if you have any questions, come to me after this talk. I'll be outside over there. Please just do not tell me that you committed many crimes. I mean, everyone keeps telling me that. So, just don't tell me because I don't want to be called to court. Thank you very much for listening. Thank you very much.