Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - kmfkewm

Pages: 1 ... 179 180 [181] 182 183 ... 249
2701
Shipping / Re: reasons to not use UPS
« on: June 03, 2012, 07:05 am »
Every major shipping company has roughly the same success rate of nearly zero interceptions for domestic and a bit more for international

2702
Oh and members here's the link where you can view this shit...tell me I'm wrong. - http://dkn255hz262ypmii.onion/index.php?action=profile;area=showposts;u=22270

Nope, you're right. The dude can't even keep his story straight.

I'm thinking local or maybe regional LE that hasn't a clue. Definitely not the Alphabet Mafia, just isn't smart enough.

Alphabet Mafia... Love it! 

With respect to the OP, you have to wonder what he thinks he's going to learn?

Now, speaking of the alphabet mafia, as far as the FBI goes, according to sources (Bamford?) the vast majority of FBI agents aren't comfortable with computers. It would appear that they're far more comfortable with a lined yellow pad and a pen than they are with a computer. I find myself wondering if it was pressure from the computer-phobic brass that led to the Mixmaster remailer seizures about a month ago now. Even the EFF commented that the FBI should have known better than to do this. The EFF also stated (correctly) that Mixmaster has been around for almost 20 years -- long enough that the Bureau should have learned in that time that such seizures were (and are) futile, as they would learn nothing.

Most of the FBI's records are still on paper; attempts to computerize their record keeping systems  have flopped spectacularly, not to mention expensively. I seem to recall they've had at least two failed attempts so far.

Now, this may all change in future, as the older agents retire, and younger, more computer savvy personnel are recruited, but this remains to be seen. The culture there is anything but geek-friendly.

Guru

If you look at the FBI as being as skilled at computers as their average cybercrime agent, you can quickly see that they are on average not skilled. I always make comparisons to their CP operations just because there are soooo many to choose from and it shows them fighting one of their number one cyber enemies. The average cyber specialist at the FBI carries out CP operations against P2P networks by running software that is made for them that spiders the network looking for keywords that indicate CP, and then download and fuzzy hash the file and compare it to a database of known CP fingerprints. All the agent does is run this software, then they confirm the hit (which with fuzzy hashing is nearly 100% accurate anyway) and file paperwork to get the physical address of the person who owns the IP address, then they file paperwork to get a warrant to raid it (or they forward it on to the appropriate jurisdiction, and file the paperwork for the hits that are forwarded on to them, to get the warrant to raid someone in their jurisdiction). That is the average computer skill of an FBI cyber specialist. At the higher levels they are actually making the spidering software, which is more impressive, but they are often not even making exceptionally sophisticated spidering software (for example they only very recently started using fuzzy hashing, prior to this they were almost always using regular hashing which is much easier to circumvent as a single changed pixel changes the entire hash).

At the higher skill levels we can see that they can make proxy bypass attacks such as CIPAV. I have not seen any proof of them using zero days though, so they are exploiting known vulnerabilities to root targets and circumvent their anonymizers. This shows that they have coders but doesn't show that they know how to find zero days only how to implement attacks that have already had proof of concept published. The fact that we only see them using known exploits may be because that is all they need to use and they don't want to leak the full extent of their capability.

I used to have a copy of an FBI cyber specialist career path map that showed the titles of the courses they take at Quantico over a nine year or so period, but unfortunately I no longer have this. I will actually try to find it again and share the link here. I don't recall it verbatim, but I remember that around year nine is when they *started* learning about traffic analysis as well as how to configure custom linux and BSD kernels. It also showed an expectation of a year nine agent as leading an operation against a major cyber crime group, from identification of the group all the way to deanonymizing the members gathering evidence etc. So the FBI does have some people who understand at least the basics of traffic analysis and operating systems, probably more. If you take a year 10 agent they would have about one year study of traffic analysis and they would also be expected to be currently investigating or having already busted a major online cybercrime group. Then again they are probably the ones making the P2P spidering software, as it is traffic analysis. But it is very primitive traffic analysis, and it has been relatively unpolished until fairly recently.

I wonder how many year 9+ FBI cyber specialists there are. It would be nice to find how many years they have had a cyber specialist program for. I also absolutely must find and share that PDF here because I believe you will find it to be very valuable intelligence. Fuck, I wish I saved it.

2703
Jesus christ you guys are paranoid as hell what is wrong with asking if anyone has been caught ordering off of SR or not? Seems like a question I would love to know the answer to if I was new to SR and wanted to know how risky it was.

2704
Shipping / Re: Customs Seizure Refund Advice
« on: June 02, 2012, 12:10 pm »
This is why you use fake ID boxes. Usually reship on interception is left to the discretion of vendors, sometimes they offer interception / lost package insurance for an added cost, sometimes it is included in the cost and they let you know before hand, other times they have a policy of 50-50, other times they tell you to get fucked. At least that is how it has always been on private forums. I certainly don't think you are entitled to anything more than the vendor agreed to prior to making the deal though. Also care to give a general idea of the tracking notice? I don't want you to post the full tracking notice if you don't want to, but if it specifically says something about being intercepted or if you are just speculating due to it taking a long time to update would be nice to know, they used to straight up say when a package was intercepted but I figured they got smarter since I had heard of interceptions that didn't explicitly say it on tracking (but still gave it away) later on.

2705
Security / Re: Natural language scrambler
« on: June 02, 2012, 05:36 am »
https://www.cs.drexel.edu/~pv42/thebiz/
anonymouth

writeprint can indeed screw you

2706
Off topic / Re: help with setting up rosetta stone
« on: June 02, 2012, 05:27 am »
Why did you buy Rosetta stone from here you can download it from any torrent site for free

It takes a special kind of unscrupulous vendor to download shit for free with Bittorrent and then turn around and sell it for money

2707
2c-h being banned sucks since it is the precursor for pretty much all of the other 2c- drugs. Time for people to stock up on as many kilos of that as possible.

2708
I believe the common Mac GUIs for GPG only let you select keys by E-mail instead of username, so if a vendor doesn't have an E-mail attached to their key it will not display. Stupid design. Can you see usernames as well or only E-mail addresses?

2709
I dont know bout other countries, but here in Aus the police are just interested in the dealers. Why would they need to target SR itself ? its not like the dealers are actually in the internet lol, they are still real-life people who need to source their drugs from SOMEwhere, and I know alot of dealers on here deal a bit IRL too, so honestly, why the fuck would they target SR ? There are far more deals going on right under their nose IRL anyway. So IMO a dealer is a dealer, they are still a dude in a house with drugs.

lol like why would LE target dealers using telephones? It isn't like there are actually dealers in the telephone lines! there are so many dealers out there right now IRL why the fuck would they target dealers on telephones?

LE does not make the same distinction between IRL and online that you do. IRL is just a (rather poor) way of saying "normal methodology of drug dealing", but when it comes down to it online is just a secure communications channel for IRL dealers to use.

2710
in a perfect world, you would be right.  but in the u.s., it is easier to convict drug user/sellers than it is rapists.  it's sad, but it's true.  and with that other site getting hit, the farmer's market or whatever, it is very possible le could be looking here too.  if it happens or not, only time will tell.

In a world where the DEA combats CP he might be right, but in the real world there are all kinds of law enforcement agencies and some of them are tasked with bringing down sites like SR and have absolutely no reason to target CP sites because it falls way out of their job description.

2711
GPG and Tor are the bare requirements. Truecrypt FDE is also nice, but it is less important, if they can never pinpoint you they can not physically steal your non-encrypted drive. Truecrypt GPG Tor and bitcoin mixing is pretty solid (you should certainly be taking SOME measure to anonymize your bitcoins, be it mixing or obtaining them anonymously, preferably both). If you want to step your game up use isolation of some sort to make it harder for hackers to get your IP address. If you want to step it up a bit more get a security oriented OS and make sure your hardware supports all of its security functionality.

If you want to take it to the extreme, use a three computer setup, one that runs Tor and connects to the internet, one that runs Firefox, and one that stores GPG private keys and carries out encryption and decryption operations and never connects to the internet or anything that ever will. Copy ciphertexts and public keys from the Firefox machine to the GPG machine via *single use and then destroy* media (such as a burned CD), and your outgoing ciphertexts and public keys from the GPG machine to the Firefox machine by hand. Configure the firefox machine to route its traffic to Tor on the Tor machine and assign it an internal IP address only. Put Tor in a virtual machine on the Tor machine behind NAT and use firewall rules on the host to block connections to any IP address other than your entry guards. Additionally isolate the virtual machine with mandatory access controls. Make sure to use a wired connection from the Firefox machine to the tor machine so if firefox is pwnt you can not be geopositioned with WPS from a wireless network adapter. Use a security oriented OS and make sure your hardware supports all of the OS features fully, for example you will need a 64 bit processor to get a security benefit from ASLR, you will need NX bit flag on the CPU etc. Make sure to harden everything blah blah. Nobody actually does all of this because even though it is secure as a motherfucker the feds are like fifty steps behind it and NSA doesn't give a fuck

I also suggest using an in state fake ID to obtain a PMB that is not tied to you. Everyone who deals with significant weight does this. It might be less of a benefit and an additional charge for someone dealing with very small orders. I know for a fact it has saved the day many times before though. Not just from feds but also from scammers leaking peoples addresses publicly. If we ever have interception detection chips it will give us the opportunity to be nearly fully protected from all attacks other than downward (from vendor to customer) human intelligence, but so far not much progress has been made on getting those realized unfortunately.

2712
Off topic / Re: Need moral guidance
« on: May 31, 2012, 08:15 pm »
Registered? Serial number in tact? I had both rifles and pistols throughout my childhood, and have no problems if his parents know/approve and it goes through a licensed dealer for a small fee. Otherwise if you're trying to sell it illegally, it's not like selling a bag of weed to the kid, where if he was caught his parents would throw it away and he'd be grounded for the Bieber concert. If that kids caught with an unregistered glock there will be serious questions from the parents and LE, and if it came back on you that would be some bad news.

Exactly. Also what happens if the kid is a numb nuts and shoots someone? Fuck that.

I don't understand. I had a gun when I was 15 and I didn't shoot no one ?

Then you were using it wrong

He either shot 0 people or between 2 to several billion humans, you prefer to shoot exactly one human? Actually I misinterpreted it, he didn't shoot no one, the double negative from the didn't / no cancels out the n't and the no so we are left with he did shoot one. So depending on how you interpret his sentence he could have shot zero to an arbitrary number of people, seems strange that this could imply improper use of a firearm since it holds true for everybody.

2713
Security / Re: Simple way to make and remember secure passwords
« on: May 31, 2012, 08:11 pm »
If I know that your password contains ewiofiofj32iofiu42hf4u2ihr3ht1sk3r41it3r4ytthruthr4ugh43yhuy I don't care much if you add .gz after it

You add .gz (.yournick or aaa43 or fu@f, ...) to the text that is in the file so your password is isn't ewiofiofj32iofiu42hf4u2ihr3ht1sk3r41it3r4ytthruthr4ugh43yhuy but
ewiofiofj32iofiu42hf4u2ihr3ht1sk3r41it3r4ytthruthr4ugh43yhuy.gz and since .gz isn't there ... Addition of a few characters that are not in the file makes frequency useless.

Testing every combination from an average sized system txt file would take quite a bit of time wouldn't it ? File with 1000 lines, part (you add something that is not in the file) of the password being your 42th line. It seems pretty safe to me ?

At that point you are pretty much just remembering your password anyway so why bother to store part of it in a text file with <=== THIS!!!! written next to it if you need to remember enough to keep it secure if someone finds the text file.

2714
I know of one IRC drug scene as well, it has no real connections to the group of forums I think of when I think of the online drug community. I only know one person who was a member of it though, he sort of converted over to the forum scene. I wonder if it was the same IRC group that you are talking about.

2715
People use all shipping services with few reports of interception, USPS is by far the most popular and widely thought to be the most secure option though.

Pages: 1 ... 179 180 [181] 182 183 ... 249