@MechMK1 now serious... ask your favorite search engine about hackers caught... you will find a lot of people, and articles about how they messed up and you will know what not to do... and the first on "not to do list" is to not break the law.
Okay, let's say I am a citizen of Exampleland, and I have some insider knowledge on corrupt dealings of our government. I consider it my moral duty to bring this knowledge to the outside world. However, I want to do this without getting caught.
How do I as that person inform myself on what to do without raising suspicion?
Imagine we have a dev team
developers
team lead
scrum master
...
When a new feature is planned to be implemented, should it be sent to the security team by the dev team lead (to evaluate whether it needs to be tested) or the someone from the security team should seek for them by himself by att...
@MechMK1 I think that's hard to answer because it depends on where the government lands on the scale of "competency". Corrupt governments are often also incompetent, which makes the risk of "capture" lower. However that's balanced by the fact that most people don't have the necessary OpSec to both accomplish such things, or even learn how to accomplish such things anonymously
@MechMK1 That's a hard bootstrapping question. Presumably in such a country trying to learn how to communicate anonymously is in-and-of-itself suspicious and difficult. In China for instance (IIRC) there is no such thing as anonymous phones. Every phone has to be registered, with the government, to a particular person, and they can and will track your usage of it - both the phone aspect of it and potentially internet usage.
How do you learn how to evade such things when you don't already know how to evade such things? It's quite possible that you can't
Those ones are much easier to evade simply because you can "publish" information in channels they don't control . Even then though a lot depends on the competency level of the organization you are trying to report. Are you publishing internal communications? Is it possible they have hidden identifiers in all their publications to identify whistle blowers? Are you aware that is even possible?
Of course that brings us right back to your question: how do you learn to think about these things?
If your adversary is not the government then you don't have to worry about being caught learning these things because you can do it on your own time and with your own devices (if you know enough to think of that even)
But if that first level of privacy doesn't occur to you, you will quickly run into trouble when you start searching "How to report company corruption" on your work computer.
Doesn't the same argument apply to every other branch of security? How do you know how to protect against XSS if you have never heard about XSS? You need to ask yourself questions like: how are web applications usually hacked? Then you fill find XSS mentioned somewhere for sure, and you can learn about it.
OPSEC is probably the same. The first time I heard this term was in a chat on IRC I guess. I looked it up, and wow, what a cool new concept to know. Then knowing the term OPSEC you can find other related stuff to learn, and so on.
so I guess you can't really be good at OPSEC without some background research, learning, and intelligence (slowly gathering info about your targets, enemies, threats, possible mistakes, alternative plans, etc.)
@MechMK1, nope, I don't have any resources
one day I would like to check if a some good books exist on the history of INFOSEC, stories about criminals and what they did and how they were caught, etc.
Of course, learning how to learn is always the tricky part, but the scenario under discussion is learning about how to practice (in essence) OpSec when OpSec is itself a potential crime, and so you need some OpSec in order to start safely learning OpSec. There aren't any realistic use-cases where learning about XSS is likely going to get you jailed. However there are many situations where trying to learn how to hide yourself may get you in a lot of trouble
I once had a fax machine that when you swapped the paper, it printed a diagnostic page, with useful info on that: "if you cannot read this page, try this and that to troubleshoot..."
if I cannot read the page, how I can read the troubleshooting tips?
and on a very tangential subject, I once saw an engineer complaining that he had to develop a product with a led indicating that the battery is dead. so he had to put a second battery to this led, and an indicator to the indicator battery, and it had to be backed up by another battery...
If your enemy has enough control over you already (like a totalitarian regime, etc.) then OPSEC might lose much of its meaning and become very hard or impossible. I have a personal theory that basically says we should beware of "points of no return". It's like at some point, surveillance might become so ubiquitous and powerful that it might become impossible to even start to think about circumventing it
I actually wanted to ask you guys what other communities you frequent, what chats, you know, Stack Exchange is cool but its policy against "opinion-based" questions is a PITA. However asking you this info right in the middle of an OPSEC argument might not be the best moment to ask, LOL
I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier this year using an official image from ZTE.
A severe case of butterfingers affected me yesterday ...
Imagine we have a dev team
developers
team lead
scrum master
...
When a new feature is planned to be implemented, should it be sent to the security team by the dev team lead (to evaluate whether it needs to be tested) or the someone from the security team should seek for them by himself by att...
