Agorist. Counter-economist. Privacy maximalist. Student of OPSEC. Anti-authoritarian. Free speech absolutist. Logician. Ex-Darknet Vendor. Youtuber.
United States
Joined May 2021
- Tweets11.1K
- Following447
- Followers20.8K
- Likes82.1K
#OPSEC365 219/365
Vulnerability analysis in OPSEC doctrine ranks vulnerabilities on two axes: operational importance and susceptibility to collection. The highest-priority items are both important AND easy for your adversary to collect.
Low-importance data that's hard to collect isn't worth protecting. High-importance data that's trivially exposed is your immediate priority.
A list of vulnerabilities without ranking gives you no place to start. #OPSEC365
Local password managers don't collect, store,
or sell anything.
There's no business model that needs your data.
When your vault lives on your device there's no honeypot for warrants
or national security letters to point at.
youtu.be/uMDHPK-xyAA
#OPSEC365 218/365
Shared links to cloud files often don't require authentication.
That Google Drive link you shared to collaborate on a document might be accessible to anyone with the URL. Some cloud storage defaults to link access that doesn't check who's clicking. URLs can be guessed, leaked, or discovered through browser history.
Check the sharing settings on cloud files before sending links and restrict access to specific accounts.
#OPSEC365
They mine your browsing like ore.
Every click and every query packaged
and monetized by companies you never agreed to.
Do it long enough and the tracking goes invisible.
You stop noticing the cage.
That doesn't make the cage acceptable.
youtu.be/V5ad6y5sixU
If this was turned into a book I would read it.
My favorite line:
"Speaking of, if anyone shows up here, my 2FA becomes my 2A.
I didn't spend 550 on a Glock to get into a fist fight. ".
The only surprising part for me was that it wasn't printed but bought.
None of you are entitled to an exploit which allows you to touch any target you want.
I release code because it's fun.
You blue team motherfuckers crying for now three days because exploits drop fail to see the point, without people dropping exploits, you have no job. There is no defensive without offense. Stop fucking crying, and do the job you're paid to do. I do not give a fuck about your weekend and I quite enjoy your crying. Also; just so you're aware, I've been up front. I never claimed this thing touched nginx. The fucking demo used lab env (look at the demo) + LAN addresses, FPM on 9xxx
What part of that do you not understand?
A proof of concept is just that: something that proves a concept. Most people submitting a bug for review would stop at a crash dump. If you read the readme, before I nuked the github, you'd know. proof an exploit in lab conditions is possible, and exploiting it in the wild are two different things. I read everything that comes out. Github is full of PoC's on this issue. Multiple reports PHP (patched) is still vulnerable. having fpm behind your httpd isn't a patch. There's still a double free in the code base, still a UAF that has a block to actual exploitation. Multiple serialization bugs. Swoole is also an issue. You people can eat a dick.
Show me on the doll where the PHP2SHELL CVE's show up in our code?
is php2shell php2shell2shell?
If you want a villain who's also an asshole you've got him now.
Dragging my fucking name, threatening my Life, my family, and now, telling me and people I follow you wanna wear our skin like a suit and rape our mothers while you make us watch? Now trying to reach out and touch me?
Thanks 2FA. ;)
Speaking of, if anyone shows up here, my 2FA becomes my 2A. I didn't spend 550 on a Glock to get into a fist fight.
I've been a pretty nice guy until today. You're gonna see a side of me, none of you are going to like.
You're gonna need to call LE and your boss, you fuckers are in for a long weekend.
#OPSEC365 217/365
Customer support is a backdoor for social engineers.
Attackers call support lines pretending to be you, using info gathered from social media and data breaches to pass security questions. They request password resets, account changes, or info that helps compromise your accounts.
Add extra security to accounts that allow it and expect that attackers will target support channels.
#OPSEC365
Most Tor Docker images can't prove what's inside them.
HiddenForge 2.1.0 (my creation):
byte-for-byte reproducible builds,
zero known CVEs,
no DNS leaves the container,
seccomp + Tor's own sandbox,
self-heals with the same .onion.
Built for a state-level adversary threat model.
sambent.dev/sam/HiddenForge/…
People imagine breaking Tor takes a supercomputer.
It takes an ISP and a lie about which routes you own.
Every state already runs one.
So do the companies and the criminals.
That is the whole cost of admission.
youtu.be/XDsLDhKG8Cs
#OPSEC365 216/365
Temporary email services aren't as anonymous as they seem.
10minutemail, Guerrilla Mail, and similar services let you create throwaway addresses, but the services themselves log IP addresses and usage. Anyone with access to the service's logs can correlate your temporary address with your real identity through connection data.
For truly anonymous email, temporary services require additional layers of protection like Tor.
#OPSEC365
Chainalysis head of investigations admitted under oath she knew of zero scientific evidence for their forensic tool.
How do they check accuracy?
Customer feedback.
youtu.be/oFioqVeNGGg
#OPSEC365 215/365
Counter-surveillance starts with awareness of who might be watching.
Professional surveillance involves multiple people, vehicle switches, and careful tradecraft. But most surveillance you'll encounter is amateur. A car that appears too often, someone who shows up at multiple places you go, or patterns that feel off deserve attention.
Practice being aware of your surroundings without being paranoid.
#OPSEC365
They told you seizing assets protects the public.
Then they hired a clown with the proceeds.
When the people who get to keep what they steal also decide who to steal from,
the outcome writes itself.
youtu.be/-HGCGivMSUs
#OPSEC365 214/365
Granting contact access doesn't expose your data. It exposes everyone else's.
Your address book is a social graph belonging to people who never consented. WhatsApp, LinkedIn, and TikTok have all used contact uploads to build graphs of non-users.
Cronk's aggregation problem: the app now knows your network position without you ever posting publicly.
A photo editor, a game, or a flashlight has no functional need for your contacts. Audit the permissions and revoke them. #OPSEC365