Author Topic: The OPSEC Reading List (Read 1742 times)

Trevor · « **on:** October 15, 2013, 06:26:16 am »

I think it'd be a valuable resource if we create and maintain a detailed reading list - compiled for the benefit of all. I realized that we, as a community, lack this kind of resource.

Please provide constructive criticism, and try not to be a dick.

You are more than welcome to post an item, and provide a critique (probably the best method IMHO) - this way, you've read it and thought about the contents. Alternatively (for those already well-read in the area) you can just compile lists of your own.

I'll start:
INFOSEC PRO GUIDE: CRYPTOGRAPHY, by Sean-Philip Oriyano

'Information Security: The Complete Reference', by Mark Rhodes-Ousley

OperationsSecurity(OPSEC) · « **Reply #1 on:** October 15, 2013, 07:07:55 am »

All the resources in my sig http://grugq.github.io/resources/
The Ruckus Society keeps some good guides: http://www.ruckus.org/
The Grugq's video on OPSEC http://youtu.be/9XaYdCdwiWU
Ohrodr's quick talk on OPSEC from Toorcon http://youtu.be/Pw5MiZcsiQM
The IRA green book if you can find it online (part 1 and 2)
The original OVDB productions guide "Art of Smuggling" had some good Tradecraft

Follow all those and you will learn how to avoid indicators (patterns), learn not to talk too much if you're running a major illegal operation like anti gov resistance or narco dealing, learn counter-surveillance to avoid police tails or rival G's looking to jack you like how to employ SDR (surveillance detection routes) on the way to a stash house, and to sweep your vehicle for GPS tags. Too many people have gone down dropping off drugs in mailboxes while their car is GPS tagged and feds are following them watching.

Trevor · « **Reply #2 on:** October 15, 2013, 12:46:40 pm »

What is OVDB productions guide "Art of Smuggling" and where could I find it?

Serendipity · « **Reply #3 on:** October 15, 2013, 05:59:13 pm »

Thanks for your great contributions OPSEC. This is my new favorite subject. Hopefully one I can study for a long time.

orange · « **Reply #4 on:** October 15, 2013, 06:03:51 pm »

Quote from: Trevor on October 15, 2013, 12:46:40 pm

What is OVDB productions guide "Art of Smuggling" and where could I find it?

It's on pastebin:
(CLEARNET) http://pastebin.com/DDJShs9f

OperationsSecurity(OPSEC) · « **Reply #5 on:** October 16, 2013, 01:39:45 am »

OPSEC - Unmasking Miscreants (DerbyCon Oct 2013)
http://youtu.be/2NjBvFda4NI

If you run a hidden service, would want to look at this. They tell you how they break through cloudflare and other ddos protection to identify servers, same tactics would work on a hidden service if you set it up incorrectly. Also great lolz on the many fools selling booters that have zero opsec skills.

Jeks · « **Reply #6 on:** October 16, 2013, 02:56:56 am »

sub, good topic

oracle · « **Reply #7 on:** October 16, 2013, 07:13:45 am »

dieAntwoord has posted some useful OPSEC information as well as links. He was kind enough to PM a few useful links a few days back.

Here (clearnet):

http://grugq.github.io/blog/2013/10/09/it-was-dpr/ is the orig post
http://grugq.github.io/resources/ has good info too

Well written and thought out.

kittenfluff · « **Reply #8 on:** October 16, 2013, 11:11:03 am »

subbing for a proper perusal later. Great topic, would +1 if I could...

cyanspore · « **Reply #9 on:** October 16, 2013, 01:39:22 pm »

I did start a thread very similar to this already and posted a bunch of articles, but if you want this thread it's fine with me

http://silkroad5v7dywlc/index.php?topic=394.0

Joe · « **Reply #10 on:** October 20, 2013, 08:18:02 am »

anontoker · « **Reply #11 on:** October 20, 2013, 01:43:08 pm »

Good reading. Thanks for posting. Subbed.

Kaiho · « **Reply #12 on:** October 21, 2013, 06:02:38 pm »

http://shadowlife.cc/
or
http://shadow7jnzxjkvpz.onion/

Tradecraft, privacy, anonymity, amazing awesome site overall.

weather420 · « **Reply #13 on:** October 21, 2013, 10:02:52 pm »

Sticky this thread.

99herps · « **Reply #14 on:** October 22, 2013, 02:26:33 am »

Quote from: Kaiho on October 21, 2013, 06:02:38 pm

http://shadowlife.cc/
or
http://shadow7jnzxjkvpz.onion/

Tradecraft, privacy, anonymity, amazing awesome site overall.

Not impressed. No meat.

jacob1234 · « **Reply #15 on:** October 22, 2013, 06:09:42 am »

OPSEC nice stuff. Subbed to this bad boy. Gonna take time tomorrow to watch those videos and get those books.

ManInTheMirror · « **Reply #16 on:** October 22, 2013, 08:35:02 am »

This, the real shit, subbed.

jacob1234 · « **Reply #17 on:** October 22, 2013, 05:58:03 pm »

Not sure if this is exactly OPSEC, but it's good info:
Don't Talk to Police: http://youtu.be/6wXkI4t7nuc
How to Cop Proof Your Phone: http://youtu.be/vVCROjpgCB0

wholepyo · « **Reply #18 on:** October 23, 2013, 04:52:50 am »

Alright yall dont laugh too hard but whats OPSEC?

jacob1234 · « **Reply #19 on:** October 23, 2013, 07:55:10 am »

Quote from: wholepyo on October 23, 2013, 04:52:50 am

Alright yall dont laugh too hard but whats OPSEC?

Operational Security ***CLEARNET***http://en.wikipedia.org/wiki/Operations_security***CLEARNET***

notpersonallyidentifiable · « **Reply #20 on:** October 23, 2013, 05:51:20 pm »

Parts 1 and 2 of this are excellent

****CLEARNET****
https://lilithlela.cyberguerrilla.org/?p=3060 (Encryption For Beginners In an Era of Total Surveillance )
https://odinn.cyberguerrilla.org/index.php/2013/08/12/darknet-for-beginners/ (Darknet for Beginners: Nightweb, I2P, Tor over Meshnet)
****CLEARNET****

I'd probably start with the grugq's video though.

Steve Jobs · « **Reply #21 on:** October 23, 2013, 07:07:47 pm »

Agree: Sticky this topic... could save your life.

astonmarteen · « **Reply #22 on:** October 26, 2013, 10:35:11 pm »

subbed

hopelessanarchist · « **Reply #23 on:** October 26, 2013, 11:33:05 pm »

also agree this topic shoud be sticky

stabpen · « **Reply #24 on:** October 27, 2013, 12:10:12 am »

Good stuff. Thanks!

Trevor · « **Reply #25 on:** November 02, 2013, 02:25:44 pm »

Finished reading 'INFOSEC PRO GUIDE: CRYPTOGRAPHY, by Sean-Philip Oriyano' a couple days ago, was not impressed. It's entry level to say the least, and contained very little substantial information. This is a huge drawback in fields as diverse and fast moving as 'infosec' and cryptography. Basically it'll be useful for someone who has no notion of what cryptography even is. If you know the basics of that,then don't even bother with this book. It also included all these childish exercises.

It may be an ok background read, but it is not specific enough for our perposes.

Also, can anyone post some in depth analysis of secure OS setups for anonymity. I recall a really good thread from the old forums started by Astor that basically had a top 10 of configurations (tails was listed at number 7). OPSEC what are your thoughts on using Tails? Astor said they aren't as anonymous as everyone claims.

TheOGroader · « **Reply #26 on:** November 02, 2013, 02:37:25 pm »

Quote from: Trevor on November 02, 2013, 02:25:44 pm

Finished reading 'INFOSEC PRO GUIDE: CRYPTOGRAPHY, by Sean-Philip Oriyano' a couple days ago, was not impressed. It's entry level to say the least, and contained very little substantial information. This is a huge drawback in fields as diverse and fast moving as 'infosec' and cryptography. Basically it'll be useful for someone who has no notion of what cryptography even is. If you know the basics of that,then don't even bother with this book. It also included all these childish exercises.

It may be an ok background read, but it is not specific enough for our perposes.

Also, can anyone post some in depth analysis of secure OS setups for anonymity. I recall a really good thread from the old forums started by Astor that basically had a top 10 of configurations (tails was listed at number 7). OPSEC what are your thoughts on using Tails? Astor said they aren't as anonymous as everyone claims.

All I can say on Astor's behalf is whonix whonix whonix.
Did I mention whonix? Tails leaks like a motherfucker.
Of coarse this is just paraphrase from Astor's many pages on this

Trevor · « **Reply #27 on:** November 02, 2013, 03:11:32 pm »

Yes Astor discussed many whonix configurations. Starting from a base level, how does one construct a secure config? I daresay tails' proliferation lies in its ease of use.

TheOGroader · « **Reply #28 on:** November 02, 2013, 05:18:41 pm »

Quote from: Trevor on November 02, 2013, 03:11:32 pm

Yes Astor discussed many whonix configurations. Starting from a base level, how does one construct a secure config? I daresay tails' proliferation lies in its ease of use.

Tails is miles more complicated then whonix, even if your setting physical isolation boots its more simple.

Jeks · « **Reply #29 on:** November 03, 2013, 06:43:48 am »

Astor had Qubes up at 1 but see here:

http://silkroad5v7dywlc/index.php?topic=173.msg1635#msg1635

Trevor · « **Reply #30 on:** November 03, 2013, 08:04:02 am »

Quote from: TheOGroader on November 02, 2013, 05:18:41 pm

Quote from: Trevor on November 02, 2013, 03:11:32 pm
Yes Astor discussed many whonix configurations. Starting from a base level, how does one construct a secure config? I daresay tails' proliferation lies in its ease of use.
Tails is miles more complicated then whonix, even if your setting physical isolation boots its more simple.

It's complexity is one of it's major flaws, no?
Yeah, I meant ease of use to encapsulate this- everything bundled together and easily booted.

>So, whonix in a VM? What should the VM be placed in? A linux based OS? And what kind of PGP is strong, I was using GPG4Win for a long time and was only just advised against it.

Another question, how does one use "an internet link that cannot be traced to you", as advised by the gruqg in one of his articles?

Trevor · « **Reply #31 on:** November 03, 2013, 08:08:28 am »

Also, I'm putting
'Information Security: The Complete Reference', by Mark Rhodes-Ousley on the list.

It's got strong and varied reading on a range of relevent (for SR users) topics.

I havn't got all the way through, but definitely worth your time to familiarise yourself with good CI habits.

MrTerrific · « **Reply #32 on:** November 03, 2013, 09:50:29 am »

Subbed, It'd probably be a good Idea to Sticky this as well

jacob1234 · « **Reply #33 on:** November 04, 2013, 04:40:18 am »

Never Get Busted Again: http://www.youtube.com/watch?v=ZyAjLkBCWKI
Never Get Raided: http://www.youtube.com/watch?v=InJHDLNCRzc

holog1n · « **Reply #34 on:** November 05, 2013, 11:37:25 am »

brutal thread, cant sub yet, crap... thanks for sharing

Agent · « **Reply #35 on:** November 06, 2013, 03:41:12 pm »

Quote from: Trevor on November 03, 2013, 08:04:02 am

Quote from: TheOGroader on November 02, 2013, 05:18:41 pm
Quote from: Trevor on November 02, 2013, 03:11:32 pm
Yes Astor discussed many whonix configurations. Starting from a base level, how does one construct a secure config? I daresay tails' proliferation lies in its ease of use.
Tails is miles more complicated then whonix, even if your setting physical isolation boots its more simple.

It's complexity is one of it's major flaws, no?
Yeah, I meant ease of use to encapsulate this- everything bundled together and easily booted.

>So, whonix in a VM? What should the VM be placed in? A linux based OS? And what kind of PGP is strong, I was using GPG4Win for a long time and was only just advised against it.

Another question, how does one use "an internet link that cannot be traced to you", as advised by the gruqg in one of his articles?

Yes Whonix running in a VM is one of the better options out there, running it on a *nix based operating system is again the better option than running it on Windows unless you know how to really harden down a system like that.

VM's are a tricky option because you just don't know what information is being left behind on the OS that it's being run on and what security holes it may have that will leak any information of yours.

As for which PGP you should head over to the thread that talks about the difference PGP versions out there.

Also that last question I am not to sure about, did you mean a link that CAN track you throughout the internet ?

Hijinx · « **Reply #36 on:** December 12, 2013, 06:42:58 am »

tra!nsTra!nsTRA!NS · « **Reply #37 on:** December 12, 2013, 12:21:40 pm »

me likey, thanks and subbed

DanDanTheIceCreamMan · « **Reply #38 on:** December 13, 2013, 07:16:46 pm »

subbed