1995 server profile broken trust models
not not just for ssl anymore
where we'll be examining the methods of
identification used by social media and
internet companies and how by abusing
two points they can be used to create
untrustable or anonymous profiles and
just keep understanding the quotes
because the different methodology could
be tracked by the right government
agency or company first introduction to
from a small-time boutique company to
the corporate world legal disclaimers at
its core this talk is just talking about
the system that is there are no exploits
of vulnerabilities being disclosed the
company's mentions are not doing
anything wrong or insecurely to give you
a background on how I started getting
involved in creating anonymous profiles
and untraceable accounts is by work by
working with people that have been
abused abuse women people that word had
orders protections people that needed to
hide I work with different groups and
providing suggestions on how they could
get these covert or secondary channels
of communication with their families
during these times and that's how I
first got involved with doing this type
of stuff yeah I know it's kind of
shocking that you can actually get asked
to do something in IT security other
than break into a girlfriend's computer
an email account when things go south
all right Who am I up here not really
that important but contact details what
I really want to be is a part-time
farmer but just no money in it okay with
this talk we can take over the world not
really but we will be able to remove a
little excuse me build members here all
right we will be able to remove a little
arbitrate air I apologize not usually
standing in the room we're breaking in
but what we're looking to do is remove a
little out of station between ourselves
and the targets mostly when the
statesman's goes south or if an
engagement calls for
engaging in the blue team of the red
team how can we remove these secondary
associations between ourselves and these
customers this is actually a 25-minute
version of a 45-minute talk I did so I
had to cut out some of the social media
stuff to focus on the more interesting
things all right so let's just do start
out with a basic understanding of how
things are currently done in the
advanced engagements you have domain
fronting purchase of expired domains
maybe dynamic DNS services proxy in C to
traffic redirection you know fake
identities of onus all of this stuff is
good stuff
of course there's things like domain
privacy which is a really a short time
delay for certain targets a victim of a
cyber attack can contact a domain
provider and get that privacy pierced
sorry but there's one thing that's
missing in all of this in short the
industry currently focuses on hiding the
interactive c2 infrastructure but not
that's not the how the services are
bought and who owns that infrastructure
that we pay for them in this talk look
so you address that so why are all the
trouble of creating a physical profiles
since we all start with different points
of knowledge and understanding I'm just
going to cover a few basic things first
as security companies we currently look
to remove as station from our accounts
with onus and the targets normally we
don't need to worry about the secondary
associations our metadata or having our
infrastructure accounts privacy pierced
but what if the target is law
enforcement what if it's a government
agency what are what if you are a dark
web hunter or you know you work hunting
down criminal organizations and again
what if your purpose is to protect the
abused and frankly you need for
untraceable profiles is because you
never know when you're going to show up
on the Internet okay again continue
metadata refer to that that is just a
data that provides information about
other data some of us in the room have
used maybe data that compromised a
target we look for the user names
Durrell host names operating system
software versions etc to further attacks
but how often do you think about in your
engagements metadata threat hunters have
several models to correlate metadata
such as the diamond in the sticks and as
attackers we need to know about these
information models they have about our
metadata and the fact remains every
threat under vendor has profiles on
major pentest companies besides the
threat actives our go-to plays the phone
numbers the service providers the CG
certain first initial vectors are all
traceable trackable metadata so and
because it serve economies I had to
throw this one in there you know because
you actually don't own the
infrastructure when you buy these
services all right creating untrustable
and trackable identities so for myself
thinking about the metadata of
engagements with certain higher end
targets I was thinking of looking at
ways to mimic threat actors that use
compromised third party host you know
the host the malware or non-interactive
see to a lot of rc2 is all interactive
so we don't worry about this but I
always kind of thinking you know it
would be nice to stick long term malware
on a client beacon out three months that
type of stuff I was thinking about how
ethical it is to redirect to a similar
form looking company you know what is
the potential impact on their brand and
obviously retribution their prepetition
service providers now search out that
stuff all right so this got me thinking
why not use real companies and not
interest
definitely thinking why not use a real
company but an untraceable company to
avoid the negative associations with a
valid company instead of domain fronting
you know an untraceable company would
make it possible to use horrible
software to host not an interactive
malware I mean how would it look if you
use multiple domains all using the same
piece of software from valid looking
companies to the right blue team
or better yet you're using code base
that looks like it is from 2000 again
for the right blue team would that be
enough to throw them off if an
engagement goes south alright so again
what is required for a cyber identity
some of the big services for Onis in
human intelligence Facebook LinkedIn
Twitter business services that
respectability and Trust Office 365 G
suite drop box cetera virtual private
servers to launch attacks from host
domains engagement proxy engagements
through but how can all this be got
anonymously so before we start to attack
utilize or abuse a system for hunting
purposes we need to understand that
system just basic hacking one on one so
what is the main ways that these cyber
business is used to validate an identity
on their platforms so I've looked at
multiple different service providers and
at the core I've come up terms that I've
determined that the trust model used is
really an email address or a mobile
phone if you can gain one of those two
things anonymously you can actually
start abusing Internet service providers
and Dean of rather bizarre circle of
trust
through SSO to gain other services
anonymity so
my solution to this and this is to wear
the part you go oh yeah of course that's
the arrow next to the gas in the car
bomb my easiest solution to create under
untraceable identities and companies is
just really two parts and then no it's
not Bitcoin because Bitcoin at its core
is traceable trackable we can talk
offline and have at that kind of
religious debate later having first for
first having an honest mobile number aka
burner phone is required this is a
trivial thing to get loose mobile
tracfone straight-talking TT are all
available from large box stores they
only require activation that's it they
do not require any sort of
identification to gain this so these
service providers give you numbers
without verifying contact details to
recharge you need just the phone number
and a pin on the account into an active
recharge card from the store smart
phones are brilliant because they give
you two or three usage by changing out
the SIM providers you gain a Google
account or Apple account by using the
right smart phone you gain the means of
two FA either through the text or
Authenticator app where the warning is
some providers do expire the recharge
cards so it's just a way of getting the
liability off their write off sheets so
you want to make sure that when you buy
these service cards it's a 30-day
service you use it you don't use it
that's it just careful with what you're
purchased so you don't waste money for
long term companies I prefer you prefer
using VoIP or sip providers or a simple
flip phone just because it's more
economical you better have I did use
Google numbers um and they're okay for
engagements the reverse lookup of the
number shows Google with but you know
that's fine if you're using G suite as
your business platform and we're going
to go into that
so how do you get the untraceable and
untrackable thing very simply our man
Johnny that's right cash since the
vendors don't require anything other
than the Simms to provide a phone number
attached purchase at a random large box
store the Simms or the Simms phone
combination and a recharge card is all
you're going to need to get the phone
obviously there's tracking of the cell
towers etc but and as a side note if you
are working with abuse people or victims
of abuse having a smart mobile phone
done this way is a must for
communication for them and keeping the
channel over from the abuser moving on
so solution to the untrackable companies
this is the second part in this is
probably the part that you all came to
hear about ok it is actually prepaid and
gift cards again we use the cash to go
ahead and buy it
prepaid debit gift cards do not require
any form of validation with create them
several vendors all that requires is any
physical address a name and up
self-created pen there are bad ones that
will burn eeeh those are the
rechargeable ones the rechargeable debit
cards are what you want to look for is
if it says verify ID
because of the terror intelligence
reform and terrorism terrorism
Prevention Act of 2004 those requiring
SS number of green card or bank count to
validate them off-camera
can give you recommendations on which
cards to actually use and stuff like
that I just don't want to burn the ones
I use but I will give you that
information before spending any
morning's if you look at the back of the
card it will tell you the registration
activation site just take go look at it
and it will be pretty clear if they
require any form of identification now
what can you do with these prepaid debit
cards well just lessons I've learned
when you're setting up the business
services and the addresses on these
activations are the to activate the
debit cards you want to make sure your
addresses match also the burner phones
the numbers should match the
geographical area code of the address to
umber phone providers do not restrict
the geographical area code that you will
request when you're setting up the phone
I found good business addresses for
businesses to use I look for a shared
office space buildings or multiple
tenant buildings that do not disclose
the tenant information at the start of
an engagement I usually pick up a couple
of twenty or sorry sixty or a hundred
dollar gift cards they play they provide
the most flexibility to gain several
months of service without having to
waste any monies you'll see though any
money's left over on these gift cards
can actually be placed on to a prepaid
provider of EPs service or VoIP vigor so
it's a great way of recouping that money
the use use the name on the gift card I
find some vendors don't question that
says gift card recipient just type that
in his name other ones will accept the
fake name that you put in when you
activated the card having a card with
the exact morning is more likely to get
rejected because company's validating
cards by placing a penny or dollar
transaction so you want to make sure
that you have a few dollars extra on the
carbs cards can expire when you purchase
these gift cards some vendors charge a
monthly fee onto the first purchase
again this is to get the liability off
their balance sheets pay for one years
of service even if the engagement is not
that long by buying one year's worth of
service it avoids the some of the
rejections you could receive with a
subscription because these prepaid debit
cards are not designed for that and I
find sometimes they are pin caught when
you're signing up what
oh yeah okay so the other addition again
service providers you're looking for the
ones that are credit balance model
providers these are your voids a server
point a few other ones you just have to
duct up though fighters that accept
prepaid Visa MasterCard debit cards what
did you think I was going to say Google
and an anonymous talk I also found out
that PayPal will accept a prepaid debit
gift card as the accounts credit card
this opens up the whole view of other
services that are not cash based
providers and we'll go went out it get
that stuff in a second
fifteen minutes good okay so now that we
know the house in the what so we're
gonna look at how to create so why not
just use tor well social media companies
and other companies tend to be
untrusting of IP addresses as the end
tor point as we probably all know but
what I do find out works really well as
using a hidden tor service such as Open
VPN on anonymously purchased VPS host
then using the VPS host for my
activities I have yet to have an account
completely closed when a malicious
activities are detected this way to the
traditional vp8 fighters there are
others but these are ones I use movin
cash is king when you sign up for just
account number one you don't need any
other information when you're paying
with cash you just mailed a cash with
the account number off and it's good
again a year's worth of service I like
it it does accept also put the prepaid
debit cards private Internet access
again they take gift cards and prepaid
debit cards you just need to sign up
with an anonymous email on both of these
services can be signed up coming from a
tour endpoint so again you want to keep
your communication base covered let's
see there are others is these are just
ones that I know about that I use and I
know they work this is just basic 101
arm
but if you're not gonna keep your
traffic untraceable at the beginning
there's no sense of going to the rest of
the trouble all right so the companies
whatever is required you need a domain
name hosting service email service and
social media profiles so these are some
of the companies I use again they're not
doing anything wrong it's just that I
know they work with the stuff
methodology so prepaid services
Namecheap great all on one service it
gives you DNS VPN hosting email SSL they
have their own SSL it takes a little
manipulation to get let's encrypt to
work but it is possible to get let's you
to work just takes a little
configuration there are others as I said
GoDaddy blue hosting lots and lots of
once again if you're looking for the
credit based model providers they just
always seem to work and again PayPal can
be used to hide monthly service fees
from these prepaid debit cards okay
we're looking to create businesses well
what's any what's better than creating
using G suite business services or
office 365 both to create the company or
run their campaigns both these services
can be part directly or as part of the
VPS domain name providing offer G suite
um it can set up the domain company for
you or as I said it can be used part of
the VPS provider the only thing that's
required is a prepaid debit card the
ability to modify a DNS record if you're
not buying directly from Google or if
you're buying directly from Google then
all you need is an anonymous email
account besides the prepaid debit card
of course you get that with your burner
Android phone office 365 I find it works
brilliantly PayPal so this does require
a burner phone office 365 is one of the
email vendors that do require you to
have a mobile
because well you can't get you know a
mobile phone anonymously let's see it
can be set up as a domain name you'll
see that throughout this talk is Fred
fishmonger com that's just the test
domain I used to create up it's actually
not linked to any of my active campaigns
or long term companies but you can go
ahead and take a look at that domain
their services are out there and stuff
of that nature
see if you can trace it back to myself
I'll be very interested if you can all
right all right let's see uh again other
services you can get VoIP uh services
again this is just another one of my
burner accounts this Yannick again just
needs a mobile phone it's a balance
sorry it's just a balance model there
are survivors that you can use with
certain configurations to modify
spoofing some of them do require a
hardware bit of hosted in your
infrastructure but what does that do
with your voice campaigns when you're
spoofing a company's a number or a
client's number
and again paid for with these prepaid
debit cards with anonymous accounts now
you'll notice that it says auto
recharging is disabled again you want to
make sure that you avoid these
subscriptions on prepaid debit cards
it's one way to get the transactions
rejected alright what else can you do
how about an app or developer account
yep alright so what you need is an Apple
ID 2fa both of those are gained by the
smartphone it's a hundred and seven for
a personal developer account so get a
card for about 110 match the addresses
between the developer account and the
business services I find that using G
suite or office 365 as the email
provider will slide right on through
Apple's authentication or identification
[Music]
you need to keep the burner phone around
for the term of the engagement because
you will need to keep putting in the
token for the two-factor the text
message based boy persists dude work
before you think you're gonna load up
malicious code to apples a store it
won't work they're very very good at
filtering out malicious code but you can
actually send a developer signed app
code to a target bypassing the App Store
an Apple Store Apple can fix this by
actually mailing your code I'll go over
something you can't do but if Apple
actually mailed the code to that fake
address
that address that you provided it this
would blow it out the window because of
the fact that unless you're being really
unethical or paid somebody else to get
someone in trouble okay so really
quickly you're running out of time so I
want to go through tracing what is
required to create these social media
accounts so LinkedIn email address or
Facebook
thus you know Facebook's one of the
gatekeepers to identity one of the
things you can do with LinkedIn you can
actually use a prepaid debit card for a
trial of the recruiter account so if you
have a target you can go ahead create
this anonymous and triple email address
sign in to LinkedIn use a prepaid debit
card when you're offered to the trial
just cancel it in 30 days and you can
just go through as a recruiter pulling
out company contacts Gmail it requires a
mobile number a lot of email providers
now require mobile numbers or email
address
actually one thing I did notice in Gmail
if you're logged in as a with a gmail
account you can go ahead and create
other gmail accounts it's no problem at
all
beautiful Twitter just email paypal
email address mobile number they will
keep sending you multiple text messages
if you do not validate your account
which you can't because you don't want
to what the prepaid debit cards work
brilliantly on these services Facebook
because well that's one of the
gatekeepers mobile number or a company
domain name if you're using like the
Gmail account or a third party company
these Facebook does require a picture
identification proof but you just use a
mobile app and you're good to go to
create the Facebook accounts
um every once in a while facebook will
ask to send a code to the phone number
but I just clicked I don't have that
number anymore to bypass the check and
they never seem to ask me to change the
phone number on the account so you can
keep them around forever
okay what about no well things you can't
get you can't get code signing server
you can't get a business or thing it
requires identification and as I said
you cannot get a Google business on
Google Maps they will send they require
a code to be mailed to you so unless you
have done some manipulation with a
business you can't get that code so
don't try okay I'm done all right so
here's my contact I do I know I do right
I did very quickly ramble at you as I
said this was a 25 minute cliff notes up
the 45 minute talk if anyone has any
questions or anything please contact me
or talk to me at the con I will gladly
fill in especially if it has to do with
the extra steps you have to do to
protect people that are with people of
abuse
well that is my time before you cut me
off thank you
but let's know sake