i have read the rules

Hello guys first of all my goal is to criticising government or using bad words against people at various social media platfroms like Instagram, X but mainly Instagram.
My threats are the government (3rd world country) and potentially Instagram (they would give my IP to government)
My threat is the government because using bad words is illegal in my country.
But I dont know if the government or Instagram will give the same attention to people that use bad words with people that commit serious crimes like murder so my threat level could vary.
My current countermeasure is Tails and im open for suggestions.
You can learn my country by surfing my profile.

Threat model: Person is actively doxxing me on really weird subreddits/sites. Hello! Some time ago by accident i found, that my personal photos and information are shared on reddit subredits for perverts<i guess that's how you describe them> and on not really known porn sites. I have a guess who that is, and i found some connections in let's say methodology of writing a posts and style of this person. But i need a big proof. So i used pull push io for old archived reddit posts(this person added literally hundreds of posts about me) and i found all of this person nicks. I checked suspect mail on haveibeenpwned and found out that it's mail is leaked on cutoutpro leak but i cant really use this(I don't know how to move on darkweb). What is worth to add is that this person used kik/telegram/teleguard/files.fm so he was probably giving more info about me that could be potentially not legal. Lastly, Police in my country police doesn't handle such a situations. I have some OSINT/linux experience, so my question is for advice, what would you do? I don't want to be useless and i am ashamed and scared what this person shared about me. I know and understand that this person is close to me, but i need a proofs like photos this person used, because on pullpush io search i only found links to photos(they looked like reddit.com/gallery/something, but everytime i entered this photos were deleted). Do you know any stronger osint tools, and better search engines(better than idk sherlock, and yandex/bing)? And could you give me any adivce how to search on clear/darknet for phrase(i would search exactly the same phrase that was on reddit in engine, and see if maybe this person left some traces). I have read the rules

I just got two emails that I thought were phishing attempts, one from Scentbird and one from Starz. I never signed up for either of these things, so I deleted them. Then I received a subscription confirmation email from Scentbird. I only opened the emails in gmail, I did not click any links.

So I went to their site, and did a password reset. They sent me an email with a magic link and I logged in. Someone used my email to sign up for a perfume subscription. Shipping to a house in Cleveland, fake name, and credit card I don't recognize.

So then I go to Starz .com b/c that was the other email. Do the same process. They used a different name and signed up for a subscription with them using the same credit card.

I have already gone and changed my gmail password, and logged out of all devices. Already use LastPass and will be deep diving that to change anything thats still a duplicate. Plus I will be using googles dark web service to make sure all that information is not actionable. 2FA via passkey/email/sms/auth app is set up for most things, but i'll be double checking all that today.

Anything else I should do? I have a VPN but only use it sometimes. Any specific services ppl like for Opsec?

I have read the rules.

I have read the rules .

Hi, I need some help.

Threat model: Possibily hackers who already gained acess to many of her accounts.

She constantly gets SMS tokens for password change even though she didnt ask for anything. We have already changed all her passwords but the passwords keep getting broken. Once I checked her google account activity and I saw at least 3 other suspicious mobile phones and devices connected to her account. I instantly removed them.

Here is my train of thought: Maybe they got ahold of her phone number and they are able to change her password through SMS tokens. Considering that they have already compromised government accounts, they know her data, email and adress so all it takes is a SMS token. I will set a 2FA authenticator for her tonight. I hope this solves it.

I dont know if that helps but she uses a regular iPhone 11 and I made those password changes on a MacBook.

They eventually stole over $20k from her bank accounts a few months ago and not even the banks know how they did it. I live in Brazil and unfortunately banks are not held accountable for scams like this.

What else can I do?

1. Change passwords
2. Set up 2FA for everything
3. Change phone number

The thing that worries me is that this has been going for MONTHS. This person or group is very much dedicated to inflict as much damage as possible. She already went to the police but they said they cant do anything.

So I've got this Android smart TV with real debrid and stremio in my dorm, and I've been using it a lot. The problem is, I'm worried that the network manager is gonna catch on and blacklist my TV from the network because of all the data I'm using. Do you know any way to spoof my TV's MAC address? I was thinking of getting a Raspberry Pi to connect to the network and then spoof the mac adress at a regular interval. Let me know if you have any ideas.

I have read the rules

Hello all!

TLDR; I want to to ensure my account was not accessed by a bad actor and prevent future opsec failures. I have read the rules, so tried to keep this very on point.

I received a death threat from someone months ago and in the threat they said "I know you see these messages, your phone hack got unhacked"

They did not share any data with me that was solid proof of their access to my account. Vague talks about my reengagement with our old businesses. Nothing confirmable.

I then made a list of my points of control over my iPhone.

iCloud: 2FA by design, newly changed password, no signs of weird use. No physical access to my devices at any time. Checekd iPhone settings and had no VPN set up, no unusual use of my data or power. No find my weird device or set up.

Google: Unfortunately no 2FA, password was old used on a couple other sites but not widely, never leaked password.

So for Google, I got paranoid and decided to further my diligent review.

1- I checked my log in notices one by one from my google gmail inbox VS my recovery email, nothing fishy.

2-I went back to each log in date and double checked for my own activity, (they all checeked out.)

3-I looked at the devices log on my account security, (ONE COUNT OF LOG IN FROM AN AREA I DIDNT RECOGNIZE. However, this was from four months prior to receiving the threat the location was unusual, i checked the log in date, and then checked my activities they all matched up. I had made a restaurant reservation on that date that used google log in. the log in email and reservation email were 3 minutes apart. Other than that, nothing.)

4- Checked my google critical security alerts, found none.

5-Checked my inbox, my IMAP was on but I had no emails added in forwarding.

6-No emails in trash or spam.

7-In the past, I had received critical security alerts but it was years ago and a confirmation that my google would have sent me security alerts.

8-My google drive log didnt show any recent uses that I didnt recognize.

Im a relative beginner to practicing good opsec. My main goal is to achieve a level of privacy online that denies information tracking and data harvesting to large companies like apple and google or any other potential adversaries. Ive been using a total of three gmail accounts for anything and everything I did online for most all of my life. All of my accounts and activity are probably linked to these gmail accounts. I have just recently made a Protonmail account and begun switching important services that I use over to my new proton mail account. I am planning on switching my phone to a samsung s24 ultra from using my iphone all my life and am excited for the seemingly fresh slate I will be starting with as far as my mobile opsec goes. I want to purge all my old unused accounts and services moving forward with the new phone. I use a macbook at home with firefox + ublocker as my browser. Going forward, how can I fully asses my threat level and understand my opsec priorities, purge my old bad opsec (gmails + associated accounts), implement optimal opsec on my new phone, and re situate my personal macbook to match my new phones opsec standards. I have read the rules and thank you kind folk in advance for your help.

Well. I am already not invisible to anybody. A government, my ISP, but still... How do I make myself invisible? It's a tough political situation on where I live, and I want to spread my thoughts without a fear of getting caught and imprisoned after. Any advice on how to make it possible?

Should I stop using Windows, routers that do not support OpenWRT and all that stuff? Thank you.

i have read the rules

It has been a total of three times that I have got email to confirm purchase or order. I had email regarding OYO hotel bookings by an Indian person in the past month, and three days before today, a McAfee product invoice and another McAfee product invoice the day later. I constantly check the access and have two step verifications on. It worries me everytime such email pops up. Does anyone have any idea about this phenomenon?

I contacted the OYO mail and got no satisfactory response.

I have read the rules thoroughly.

Recently we've been seeing many cases of deanonymization that are raising concern. Is it mishaps in user OpSec? or are they new vulnerabilities exploited by LE agencies?

Lets begin with

TOR De-anonymization

Let us begin with a refresher, when connecting to TOR, your information and data packets are routed through 3 random servers otherwise called "Relays". Each of these relays encrypts traffic with its own keys, which theoretically makes deanonymizing a user extremely difficult.

Tor connections are made in the 3 Relay order mentioned above. which can also be detailed as:
Entry Relay (Guard)
Mid Relay
Exit Relay

The way tor relays are usually exploited by scammers is via exit relays, although a very complex and sophisticated process, theoretically an attacker can poison the exit relays and manipulate certain data packets, such as XMR addresses and other sensitive financial entries. Again, possible but very complex and sophisticated. According to tor metrics 28% of tor Relays are based in the USA and Germany, and with 10% being in germany it makes sense with the recent deanonymization that occured.

The way we can identify state actors is usually by looking at a single entity running a high volume of entry relays on tor, which would virtually allow them to expose user information.
So we see German LE de-anonymizing users, and we also see heavy relay hosting in germany. to me it only makes sense to assume that German LE is taking that route.

The safest route to take for users in that said region is to host their own relays and not rely on a random connection. as there's a possibility for the german user to be laying in LE's lap 1 out of 10 times.

Monero De-anonymization

Chainanalysis is running large amount of poisoned Monero nodes through their world-wide operation and their own admins. Running these said nodes like the defunct node.moneroworld.com allows them to collect sensitive metadata like IP addresses, Transaction volumes, fees and much more. They then forward the said information to LE and Crypto exchanges to fight privacy enthusiasts using the network. The only feasible way to avoid such a threat at the moment is to run your own node instead of using a remote node and while using your own node, utilizing Dandelion++.

An example of the combined deanonymization attack against the Monero users – who is Joe:

Joe sits at home and connects to Tor from his home router. He believes this is not an issue, because in his country the Tor is not illegal. He opens up his Monero wallet and connects to the Monero remote node, waits for the sync from the remote node and once ready, he sends the transaction to his business partner as usually. It is April 1st 2024, 12:00:01AM. The transaction is 120kB in size. The remote node he connects to is run by the Chanalysis and it is poisoned but he is not aware of it. The financial flows of his whole operation is closely monitored and it is largely transparent. He makes 5 such transactions per day with different time stamps and transaction sizes.

While he uses remote nodes, there is a high chance that many of his transactions are not as anonymous as he thought it to be. His RingCT in those poisoned transactions is not 16:1 as by default in Monero now, but 1:1 now as he was served the poisoned, spent decoys by the poisoned remote node and his transactions are, for the adversary, completely transparent now. He is not suspicious and he continues his business as usual.

Chanalysis is monitoring his transactions closely and can identify and track down high percentage of his transactions and link them together. They can see the exit IP of his transactions is the Tor exit node, because by using the Monero remote node he cannot utilize the Dandelion++ feature and sends the transaction directly to the poisoned remote node and the node knows this is the real exit IP address.

Chanalysis contracted the US and German ISPs and they send them their required data from April 1st 2024, 12:00AM and they focus on Tor users, which is nicely visible. By contracting the US and Germany, Chanalysis gets the data flows from about 50% of the existing Tor nodes. They check the first transaction from the April 1st, if any of the Tor users was online at that time, sent a packets close to the Monero transaction. There are 20 people with the similarity. They check the 2nd Joe’s transaction from the day that took place at 12:20:01AM. Now only 2 people are return similarities. They get the 2rd transaction from 12:40:27AM and after few transactions and days they are quite confident that the origin of the poisoned transactions is the IP address that is registered on Joe Naive, exposed Street 1, App 1Z, Soonlot.

So as users with the evolution of our threat model, we should improve our OpSec, we should start running our own nodes, relays and continuously evaluate our own flaws. if we continue to evolve, we will only make things harder for them, they have the state level funding, they have the time, but we should have the will to stand against them!

I have read the rules

I have read the rules-if this isn't the best place to ask then feel free to let me know.

Ok folks, gonna try to keep this as to the point as I can but it will be a bit to read so please bear with me and point/direct me to other better pages if this isn't the right place. Basically, I've got a person who's got access to all of our family info and is constantly messing with stuff, sending harassing texts gloating about how they own us, they listen to our convos and comment on what we talk about etc. Full on stalking.

They have bragged saying, "I have access to everything bud and if you think you've got me, you dont. Everything goes back to (spouse). You cant find me."

Now, I'm not gonna say I'm a pro at OPSEC, but I run a pretty tight ship. I'm going to post in bullet points what I do for my personal security and then go further into whats going on.

1. I am fully compartmentalized. I use at least 10 different emails and half a dozen different email providers including proton and tutanota that separate my personal, gaming, social, business, finance etc.
2. For any of my sensitive accounts like finances, I use long passphrases that I DONT ever save to clipboard, I use face recognition and 2 factor via my secure emails.
3. I dont stay connected to internet unless Im actively using it. Otherwise its disconnected and/or shut down. Laptop is BIOS passlocked as well as fingerprint locked.

All my account info is only kept 2 places, handwritten and with me in my bookbag at all times, and Dashlane which is locked behind a massive passphrase, 2 factor, and tutanota email, and is only locally on my pc. Its not shared with any devices and nobody has had physical access to my laptop as I work 24hr shifts and it goes with me, when I'm home its by the nightstand. I don't home without it either so no breakins would even get to it.

4. Phone...ugh. I use IOS due to the alleged better security(YES i know its not private I want security). Apple ID is secured using long passphrase that I change every couple months, its 2 factored to my Tutanota email which has NEVER been broken into.

I run my phone/ipad under strict security as best I can, no info or analytics are shared, locations turned off, nothing is shared. No passphrases are saved to them.

5. I also use KeyScambler on my laptop which keeps any possible keylogging from getting what I type but I also copy paste my account info a lot from dashlane so rarely ever type it out.

Alright, now we return to my dilemma, this person isn't just goofing off and trying to act badass. They have actively gotten into my bank account and turned my alerts off, they've managed to link my account to other cards causing overdrafting etc. They read texts between me and my spouse, they listen in like I said. Its a person with NO LIFE at all if you consider that this has been going on for a couple of years and law enforcement is useless. I do not know how they're getting into any of my accounts as I don't ever get alerts to un authorized or unrecognized access.

Problem here is I think and have to assume they're taking advantage of my spouses vulnerabilities. Spouse has been sick for awhile recovering from serious illness, lotta stress and sleep apnea on top of it so brain fog and just lack of mental sharpness are expected. I dont know if this person is somehow monitoring our web traffic and just swiping info like that, or if they're actively inside one of our apple ID accounts just getting any info like that. My spouse has literally changed account info and had their stuff broke back into within a short time.

So to conclude, is this a matter of shutting everything off, disconnecting it all, and resetting our stuff or will that even matter if our network is compromised? I'm not savvy as to how to look at our network traffic and even see if there's unauthorized usage.

Would it be possible to lock it all down if i boot everyone off the network, and then only allow certain MAC addresses? Just not sure how to do this especially with a family that has the attitude of "we're not doing anything wrong so who cares". Which is insanely frustrating considering our finances are being fucked with but they prefer convenience over security. Now dont get me wrong, the spouse is pretty damn secure minded too, buuut I think with the whole being out of it and the more relaxed view of security is leaving us open.

So can anyone tell me a good newbie way to monitor web traffic to possibly pin point unauthorized usage or devices and any other good suggestions? Thank you all for reading this.

i have read the rules. I want to get a better opsec online how do I go around doing that?

i have read the rules. Im super into cyber security i already use bitcoin for purchases, im playing around with virtual machines, i use hardened firefox to browse ect ect ive gotten super into OSINT and i guess OPSEC is the natural opposite but also something completely knew to me ive searched around and most of the info i find is aimed at large corporations rather than personal security, does anyone have an useful resources that they used to start there OPSEC journey wikis,books,videos anything that gets straight to the point, preferably something that for exmaple has different stages/levels of security from the average internet user up to Anonymous level and maybe a step by step of how to develop a threat model. Thanks for the help!

What are the biggest challenges with OpSec today?

I have read the rules

In this post, I'll be using few fake names to refer to real people.

Alice (not their real name) is involved in underground activism, and was forcibly by state agents. Bob (not their real name) is one of Alice's loved ones, and Bob will get help from local and international human rights groups to pressure the state into surfacing Alice. This move, we're expecting, will likely increase surveillance and/or harassment by the state agents toward us. Now, Bob is my (OP) partner, and I have met Alice in person multiple times.

We're planning to install CCTV camera/s pointing to the street to check for and have a record of suspicious people surveiling our residence. By suspicious people, I mean person/s who are surely not from our neighborhood and is/are looking at our home from the street for an uncomfortable amount of time. With regards to the CCTV, is it better to store the footage in the cloud (some cctv products offer this) or on premises (i.e., in a micro-SD/HDD in our house)? What better way to secure the CCTV cameras and/or the footages?

With the likelihood of state surveillance, how should Bob and I behave when in public? I realize that this is a vague ask, but I haven't been targeted by the state at all. Top of my head, we would avoid talking to state agents and would direct them to our lawyers.

Should we start worrying about being listened to from afar, like via long-range mic? Or is this unnecessary paranoia?

We're also making our social media accounts accessible only to people with trust. We have been using Signal before all this happened, so instant messaging is covered.

Anything else I should look into?

Both Bob and I are personally not involved in any underground activism. My interest in opsec comes from my participating in privacy rights.

I have read the rules.

Threat model: I'm a private investigator in Seaport, NY, and have sensitive work-related data I want to protect against a disgruntled ex-client or investigation subject confronting me at my office and physically taking my computer. The lock screen pin (quickly hitting control-alt-delete) seems like flimsy protection, because I will usually be logged into my browser password manager, with external hard drives 'unlocked' (e.g. bitlocker or veracrypt password having been entered), and email accounts logged into, etc.

Is there a way to create a keyboard shortcut (say, pressing and holding an unusual key combination for 3 seconds) that can wipe cookies from multiple browsers simultaneously (including "forgetting" the accounts, so they require MFA to re-login), re-lock the encrypted external drive(s), and engage the lock screen (or turn off the computer if that's better)?

I have read the rules.

Say hypothetically I'm an activist in an environment with increasingly concerning levels of surveillance. Threat model adversaries include the authoritarian employer, and we have good reason to believe local and federal law enforcement also have eyes on some of our members due to certain political actions gaining far more visibility than expected (some of our organizers have been suspended from their schools or arrested during protests or have done interviews on international news networks to raise awareness about the political suppression).

The added surveillance (a ton of new cameras indoors and outdoors, microphones indoors, and employer has also been caught using indoor cams to spy on employees he finds suspicious) makes activist organizing difficult to do securely.

Thus far, we've found a room without mics and cams (other than a few desktop computers which we unplugged). We've asked that members do not bring electronics to meetings, but provide faraday bags if they bring electronics anyway. I'm thinking we should put the faraday bags in a separate room in case anyone's phone has malware installed so it can't record audio of our meetings. I also check the room for hidden mics before the meeting starts. Notes are taken on paper, then transfered to cryptpad after the meeting to share to the signal thread (a group of 5 or so trusted organizers).

What are some main holes in this procedure? (I know the faraday bags are one, and shouldn't be in the same room as the meeting, but it's like pulling teeth trying to get ppl to separate from their phones for an hour). What should be improved upon? I know there's always the chance we get caught and fired (or possibly arrested bc of the anti-activism laws where we live), and we all knowingly consent to this risk, but i would love to do everything in my power to try to avoid these negative outcomes.

I have read the rules.

So, last week I made a detailed post that listed the clues to what I suspected a potential remote security breach on my mobile device. Here's a link to that post if you are keen on taking a deeper look into the situation. However, I have summarized that post concisely (below the link) with the help of chatGPT for the readers' convenience.

https://www.reddit.com/r/opsec/s/S91GHoYVWM

Summary of the Reddit Post:

• Issue: User experienced a data breach with fraudulent transactions on their savings account.
• Initial Incidents: Unauthorized Interac e-transfers of $499 and $963; suspicious draft email and browser tabs noticed on their Samsung Galaxy S24.
• Actions Taken: Reset passwords, reported to banks, followed bank instructions to reset the phone.
• Further Incidents: 10 days later, further attempts to access banking accounts and Remitly app; transactions declined by the bank and the app.
• Bank's Investigation: Determined the incident occurred from the user's phone and IP address.
• Uncertainty: User seeks help in understanding whether their banking credentials are compromised or if their phone is hacked despite resetting everything.

Now, I have had experienced further developments which essentially makes the cause crystal clear. Turns out, it was my roommate all along. I moved into this residence just this month. As days passed living with him, I noticed that he takes some kinds of drugs too. Owing to my innocent nature and absence of an encounter with any malevolent individual in my 23 years of life, I foolishly told him my phone and laptop passwords when he asked for them on separate occasions. I have learned the lesson the hard way now by losing out 1500$. Besides, I would like you to not diverge on educating me on my lack of sense of security (already recieved alot), and focus on the more important part written ahead that I would appreciate your feedback on.

So, as explained in the summary, I had changed my passwords and reset the mobile phone and increased my security as much as I could (2FA, strong random generated passwords not saved anywhere, removed biometrics etc.) As a result, the following two-three attempts after the initial attempt were unsuccessful by him.

Now, last night he again tried to access my phone while I was sleeping. By god's grace i got up from sleep at around 3:30 pm when he was in probably in the middle of his process as he was doing something on his iPhone. As soon as I woke up, he went to sleep and told me that my phone was making a sound (he panickedly just said this to divert my attention).

Nevertheless, the new revealing thing that I noticed is that since my phone was locked, the only thing that I, and he probably, could see on notification screen was some notifications. It was just text SMS messages from an unknown number. The content of each of the 5-6 messages was just a plain dot (period). I checked notifications history log for the messages app from settings and found that those messages were sent minutes apart between 2:20 AM and 2:56 AM. The logs also contained something titled 'custom app notification' and the content was 'Messages is doing work in the background'.

Now this is essentially the crux of my post and curiosity that what kind of technique is this? And what's the depth of breach he could do in this way? Relieving news is I have made the homeowners aware of the incidents and have told him to evict the place before this month ends. I have numerous subtle and concrete proofs too, which can be used to get him punished. But I am refraining to file a police report for now in consideration of his future as an international student here in Canada.

[I have read the rules]

Hey guys, hope you can help me out here, and apologies if this isn't the right place for this. I used to run an android box years ago and recently just bought a cheap box from China for use on our bedroom TV. The box is a Transpeed 8K, Rockchip RK3528 supposedly running Android 13. Now, i know fine well that security wise these things aren't great, but had intentions to run burner accounts with no other uses by myself (hence no personal information). What i didn't realise until just today was the huge Malware concern with these boxes (i have been away from the boxes for years). And so, reading about potential access to all devices on my local network has left me wondering what i could do to try and 'lock it down' and best prevent any unwanted access to my network besides the apps i willinstall personally. My intentions were to run a VPN, private DNS (blocking any extra traffic i don't recognise)/Firewall and if possible, source some alternative firmware if there are any available. So really my question is, would the VPN and firewall be enough to counter these malware claims if i don't use any apps that are preinstalled on this box? Or is there anything further i can do to prevent the box from seeing other devices on my network?

In summary, due to the appearance of malware from Chinese companies, i'm looking to avoid unnecessary data leakage if possible through locking down this device. I am also worried about other devices on my network being accessed (such as cell phones) and crucial information being stolen. I know i've started in the worst place by purchasing one of these 'cheap' boxes but i see it as a kind of project. Especially as i will only be using it very infrequently.

Thanks in advance.

I have read the rules

Edit: added more context of threat model/what i am looking to avoid.

I recently filed a SAR to Vodafone. They provided all contract data but I specifically asked for everything regarding data usage.

They replied with the following:

‘Please be advised, Vodafone does not record or store information on which sites or how data was used. Vodafone does also not record IP address due to this being on the device used’

I posted this into the GDPR sub and it was confirmed by a Vodafone network employee.

https://www.reddit.com/r/gdpr/s/tenoW7YpwM

What I’ve been wondering is that if the mobile company actually claims to keep no logs, then what’s the point using a VPN at all? And also if you was to use a VPN over the connection, would they have a record of this if data is not stored.

Found it interesting! What do you think?

I have read the rules

i have read the rules, Hi everyone needed some help from you guys

i have read the rules, yesterday i received google alert that someone is trying logging in my google account but stopped f2a and today i received an otp on my phone for mobile wallet which i never used in my life, Is someone seriously trying to scammed me or what?

About a couple of weeks ago, I found out after waking up that there have been fraudulent transactions on my savings account. I opened my emails and saw that there were two informative emails saying that the interac e-transfer requests amounting to $499 and $963 have been successfully deposited.

This is the text:

"The $499.81 (CAD) you sent to Gigadat Inc at gigadat1@orderdeposit.com has been successfully deposited."

Context: Location is Canada. Device is Samsung galaxy S24. The financial institutions involved are Royal Bank of Canada and Canadian Tire Bank. I use the former as my primary bank and the latter one for my credit card.

Other clues that I could find on my Samsung galaxy s24:

• I noticed a draft email that contained my credit card e-statement. The title was 'I am sending this to you'. I deleted this email hurriedly without being mindful to notice the receipient it was intended for.

*When I opened my chrome browser's tab view I noticed a couple of new tabs. The thumbnail was just plain white so I couldn't see what's the webpages were. But the title was something gibberish and the favicon icon was the interac e-transfer symbol. Again, I quickly deleted those tabs. I still have the browsing history though.

After I concluded that my digital security has been compromised, I reset all my Gmail passwords, banking passwords etc. I went to the bank; they started a formal investigation behind the scenes and told me to get my phone reset. I did as instructed and got my account working the next day.

Now, fast forward to about 10 days, again at around 2 am somebody tried to access both of my banking accounts and the Remitly app (Used for international money transfer). My primary bank system automatically declined them access ( the perpetrators supposedly tried to workaround since my password was changed). I went to the bank branch and got my account working again after a third time changing the password. The perpetrators also tried to log into my Credit card's online banking system but supposedly they couldn't login past the OTP part.

Now this morning, again I saw two emails in my account:

The payment from (my name) to Gigadat Inc for $999.37 on 2024-08-20 was declined - 02-6070.

I called the bank to report it and they said our investigation as of now has determined that the incident happened from your phone and your IP address.

I also noticed that my credit card was added into the Remitly international transfer app and the perpetrators tried to send $670 to some account in India but the Remitly app or my credit credit declined the transaction.

All in all, I cannot determine what exactly am I dealing with. Are my banking credentials compromised. If that's the case, how could they gain access after I reset my passwords and all. OR is my phone hacked or something? I called in Samsung's customer care and the representative basically walked me through a normal device care scan from the phone's settings and since it concluded that there isn't any vulnerability in my phone, the device is fine.

Thus, my propose for this post is that people with relevant knowledge can help me ascertain what is exactly that I am dealing with and what should I do?

[ I have read the Rules ]

Hey all! I'm an American that has been researching and learning leverage trading and spot crypto trading. I have found success within the markets! BUT I was hacked earlier this week and my secret phrase was discovered. My entire wallet was depleted. This was a BIG blow to my finances and I NEVER want this to happen again.

What can I use to keep all my custodial wallets secure? What are some ways that others have used to organize their wallets and passwords?

I have read the rules

I saw a video of OpSec guide by 'The Grugq'. In it he says that we should use - Tor connection to a VPN here . I am not able to understand this. I asked few people and they told me that he means - Start Tor first, keep running it in background (minimise) and then start VPN, and come back to Tor. In this way Tor will connect to the Tor network and then use VPN.

But as for my research and understanding I used to connect to VPN first and then open Tor.

Can anyone please explain his statement and which one to use first to be anonymous and safe while surfing?

His statement (you can see this from the video too) -

1. Tor connection to a VPN => OK
2. VPN connection to TOR => GOTO JAIL

TL;DR - Which one should we use first, Tor or VPN?

[I have read the rules]

Hi there! I obviously will be sparse on the details, but as stated, I'm an oppressed minority within my country, and my threat model includes the state itself (and especially the police). I won't get into the details, but things are very bad here, and I may soon be getting into increasingly risky activities which the police might arrest me for. Nothing (currently) illegal, but they will arrest you regardless.

I don't know much about cybersecurity and only enough about computers to torrent things and use the command line when others tell me what to do. Can I get any guidance on what I can do? Is there any hope to prevent the police from cracking my hardware and accessing sensitive data?

I have

• A windows 10 gaming PC,. The operating system is totally off-the-shelf and the hard drive is not encrypted to my knowledge

• An Android 11 phone with Nova Launcher and BitDefender

• The full Proton suite (including Proton Pass, which is becoming a big concern if the police seize my computer)

• A VPN with kill switch enabled

• A FOSS notes app on my PC (qOwnNotes), which is connected to Nextcloud Notes on my phone, and synced between them using a free NextCloud host w/ a small amount of storage

I'm not yet storing sensitive anti-state data on these, however, they do have Proton Pass, which only requires a PIN to access. My phone app PIN is very long and secure, but the desktop extension only allows a 6-digit PIN. I worry they could use access to my passwords to get information on me that they could use to try and imprison me or expose the people around me.

My phone also gives them access to my Signal history, which could end very badly for me. I have not said anything that is illegal yet, but the laws may soon change and even protests may be outlawed. This means normal conversations about activism may soon become very dangerous.

I want to protect myself early, so that the police cannot use my data against me or my friends and allies. What can I do to make it very hard for the state to crack my devices? I know with unlimited time they could do it no matter what, but what can I do to make it hard enough that it's not worth it? Thank you very much for your time, and I hope someone can help me with this! Please stay safe, everyone <3

I have read the rules

Since at least 2016, spyware vendors appear to have successfully deployed zero-click exploits against iPhone targets at a global scale. Several of these attempts have been reported to be through Apple’s iMessage app, which is installed by default on every iPhone, Mac, and iPad. Threat actors may have been aided in their iMessage attacks by the fact that certain components of iMessage have historically not been sandboxed in the same way as other apps on the iPhone.

For example, Reuters reported that United Arab Emirates (UAE) cybersecurity company DarkMatter, operating on behalf of the UAE Government, purchased a zero-click iMessage exploit in 2016 that they referred to as “Karma,” which worked during several periods in 2016 and 2017. The UAE reportedly used Karma to break into the phones of hundreds of targets, including the chairmen of Al Jazeera and Al Araby TV.

The IDF specifically tends to abuse APNs (push notifications) when attacking the said devices, as spyware can impersonate an application you’ve downloaded to your phone that sends push notifications via Apple’s servers. If the impersonating program sends a push notification and Apple doesn’t know that a weakness was exploited and that it’s not the app, it transmits the spyware to the device.

Tamer Almisshal an Arab journalist working for Al Jazeera suspected Pegasus has infected his device at some point so he allowed a team of investigators to set up a VPN on his device and monitor metadata associated with his Internet traffic.

Later on they discovered heavy traffic with Apple's servers from his device as follows:

p09-content.icloud.com p27-content.icloud.com p11-content.icloud.com p29-content.icloud.com p13-content.icloud.com p31-content.icloud.com p15-content.icloud.com p35-content.icloud.com p17-content.icloud.com p37-content.icloud.com ETC....

The connections to the iCloud Partitions on 19 July 2020 resulted in a net download of 2.06MB and a net upload of 1.25MB of data.

It turned out that the attackers created a reverse connection from his device to their server via Apple's own servers and managed to download the spyware onto his device and then manage it via sending command packets from their C2 server to him with the said route of Apple servers.

Almisshal’s device also shows what appears to be an unusual number of kernel panics (phone crashes) while some of the panics may be benign, they may also indicate earlier attempts to exploit vulnerabilities against his device as follows:
Timestamp (UTC) Process Type of Kernel Panic
2020-01-17 01:32:09 fileproviderd Kernel data abort
2020-01-17 05:19:35 mediaanalysisd Kernel data abort
2020-01-31 18:04:47 launchd Kernel data abort
2020-02-28 23:18:12 locationd Kernel data abort
2020-03-14 03:47:14 com.apple.WebKit Kernel data abort
2020-03-29 13:23:43 MobileMail kfree
2020-06-27 02:04:09 exchangesyncd Kernel data abort
2020-07-04 02:32:48 kernel_task Kernel data abort

After further investigating the logs of the iPhone it is revealed the launchafd process communicating with IP addresses linked to SNEAKY KESTREL, found in a staging folder used for iOS updates (/private/var/db/com.apple.xpc.roleaccountd.staging/launchafd). Additional spyware components were in a temporary folder (/private/var/tmp/) that doesn’t persist after reboots. The spyware's parent process, rs, was linked to imagent (related to iMessage and FaceTime) and was the parent to passd and natgd, all running with root privileges. The spyware accessed frameworks like Celestial.framework and MediaExperience.framework for audio and camera control, and LocationSupport.framework and CoreLocation.framework for tracking location. This attack leveraged system folders that may not survive updates, used legitimate Apple processes to mask activities, and required high-level access, posing significant privacy and security risks. The analysis was limited by the inability to retrieve binaries from flash memory due to the lack of a jailbreak for the device.

So the question that stands is, can any mobile device be trusted if the attack is sophisticated enough?

I have read the rules

Stay in the shadows...

Invictus

I want to use an online platform as anonymously as possible. Their log-in page blocks Tor exit nodes, and I have to log in to accomplish what I want to accomplish. From proxies, to VPNs, to just operating on clearnet browser over public wifi, the internet has all kinds of advice for people in similar situations. I know some of these create single point of failure risks.

Basically, my opsec knowledge is not currently good enough for me to confidently move forward in any particular direction, so I'm looking for input.

My primary threat is the platform itself, but simply using false information, throwaway phone number, Tails, and public wifi is enough to defeat them. They have no checks against anonymous users aside from flagging Tor nodes. I may as well also include law enforcement in my threat model in case the platform decides it doesn't like my activities later down the road and that leads to some kind of LE involvement for operating in what's currently a grey area. I'd like to avoid any possible LE-assisted retaliation in the future by operating very cautiously now - worst case is probably some kind of civil penalties. The potential LE threat is not immediate, nothing I'm doing is currently on LE radar or would be of immediate interest to 3 letter agencies (no trafficking, drugs, CC fraud etc.) I don't need to interact with the website in a way that ties to the financial system, so banking/crypto/etc are not issues here. This type of business is a niche within a niche, so sorry for being vague here. Hope this is descriptive enough.

My current method is basically this: Registration requires email and password. I'll use Protonmail account created over Tor and use it to get a verification code for the platform. No emails will ever be sent from the email account. I'll log into this particular platform using a new identity, using Tails, over clearnet, using public wifi in an area with as few cameras as I can find, as far outside my normal routine as possible. No phone or devices with GPS tracking will be with me. Ideally I think I'd like to be on foot. Pretty simple, but I feel like I could be doing more. I'm here looking to make my methods more airtight. I don't ever expect to be in any major danger doing what I'm doing, but I have the time and the means to become more educated and careful before starting to operate.

I also accept that doing this over clearnet will make me vulnerable to powerful state actors that can cross-reference traffic cams, ISP records, and other fingerprints that might unmask me, but I doubt they would ever be so interested in anything I'm doing to invest the resources, but I still prefer to keep this as airtight as possible if only for my own peace of mind.

Please let me know how I can improve my methods!

I have read the rules and thank you.

Short Story: How to make yourself anonymous while running a YouTube channel and how to be safe from government tracking online.

Long Story: My country is under dictatorship rule. I am from Bangladesh and the government running the country just declared itself a dictator rule by killing thousands of innocent students during a peaceful protest. They are eating our nation bit by bit silently and the worst part is our people don't know about it because all of the news media is either bought or threatened by the government.

In this situation, I want to open a YouTube news channel where I will share news and information that the government doesn't want people to know. We cannot get rid of this fascist government without nationwide bloodshed but at least for now, we can spread awareness.

So, I seek suggestions from you guys on how to make yourself anonymous while running a YouTube channel and how to be safe from government tracking online. My primary concern is I heard that the government can track you from the email address you use on YouTube which also contains your phone number. And, as far as I know, you cannot open a Gmail account without a verified phone number. So, what to do about that?

I have read the rules