Noah Jelich - Killing with Keyboards: How Your Digital Footprint Can Be Weaponized

Hello. Hello everyone. So, oh, oh my god,

that's it.

I got no [ __ ] rap. Okay. Um, so yeah. Um, I've I'm emotionally scarred. Deeply, deeply emotionally scarred.

The reason for that is I worked with nontechnical founders and a nontechnical founder managed to lose the entire access system for a platform that was being launched two weeks prior to launch prompting me to have to do a whole redeployment in like no time. And uh there's been other situations. Um and in this time I realized that these people are fearless. You know, we've been talking a lot about getting fearless fearlessly doing this or that. But these people are fearless now.

That's a problem. And um and I need to put some fear of uh fear of dog into them. Uh so uh here's a little here's a little thing that I constructed to do that. A little bit about me. Uh, I'm a security researcher.

I like bikes. I'm uh a ROS developer as you can see by the general outfit. And, uh, yeah, I like bikes and and public transport just like everyone, right? Um, and yeah, today I'm going to tell you a little story about uh about two people because people like people stories, right? So, let's get right into it.

And before before we do this, I just like to point out two things. First, there's a few Easter eggs, and I'm going to give a warm handshake and maybe a hug to anyone who can point some out after the presentation. And uh two, uh who here suffers from paranoid schizophrenia? Because other than other than the 15 people in the front row, uh because doing this presentation, preparing these materials felt a bit like a trip down a weird rabbit hole uh that can be very anxietyinducing. And I feel that privacy, especially in the modern sense, is something that's very anxietyinducing.

And that is for I'm going to say more so commercial reasons than practical ones. So let's get into an anxietyinducing story. Uh so let's start with Sashko. This is Sashko. Uh he's not going to be very consistently owning this face because I couldn't find enough pictures of one guy.

Uh but this is Sashko. He's a he's an engineer from Ukraine. uh he's a normal sort of chill guy and he works for COVID systems. It's a let's say a secure hardware devices company. Maybe they make some components for a hardware wallet, maybe like the secure chip or whatever.

Um and uh he's a fairly normal guy, lives his life, does his job and all's pretty good. And from time to time he will log into let's say a Zulip or a Telegram or a Discord or whatever chat and he will talk about cool new stuff. He will be maybe even very very uh opinionated, very very heartened in his discussions and he will share stuff. Uh but he always stays anonymous because he cares about privacy and he's had some briefings, right? Um, and you know, day after day and night after night, he's sharing useful tidbits of info.

People do notice him. He's a useful guy. He provides useful information. Uh, and he clearly knows his stuff when he's talking. You can tell that.

Um, just following following his messages, right? So, yeah, that's that's Sashko. the other side of the world, you know, one uh an ocean and a continent over more or less. There's Kim. Um she's a teenager and she's a girl.

There has to be a girl, right? Um she's a teenager in the Democratic People's Republic of Korea and she's uh what we would call a Googler or a searcher more modernly. Uh she was hired, she was picked out at an early age and she was taught to use search tools to write up files on various keywords that her government provides. And uh and you know, one day she may get significantly rewarded for that, you know, foreshadowing. And today is her lucky day.

She doesn't know it yet, but it's her lucky day because today she found Sashko. Uh, today she found Sashko. She was doing some research about the STM32 uh keyword. So like a chip and she was looking through some chats or whatever or some dump that uh she was just supposed to research and she found a message by Sashko discussing uh something about let's say supply chain attacks or whatever on on these chips. Uh so yeah good day back to Sashko.

So it was another day at the office, another half day spent in a security briefing. Also, uh some major promotions because there was a project milestone. It was, you know, a bittersweet day, let's say. So they got a little bonus and uh and you know, for bogdan over there, that means one step closer to retiring on a farm somewhere away from all computers and stuff like that. Uh but they also spent like a real half day just going through these basic uh scenarios of potential attack on their company uh like dumpster diving and whatever and uh everyone was sort of sick of those and they asked Bogdan who is by the way the manager to maybe cut those out.

Uh and he said he'll discuss it after that. They went to uh a place that near recently opened in Tech Park. It's like a little class place. It serves uh drinks and some snacks and stuff like that and it's really nice. They were waiting in line.

They were discussing about like the security guys being totally outdated and how horrible the day was because of the whole briefing and uh just chatting in line and you know they were thinking like how it's going to be some nice food and like it's it's actually a really nice place uh because for example this place has uh employee discounts uh so you just show your employee badge for the tech park uh and uh like you get a little 15% discount and it has little meeting rooms where you can take your private calls or video calls or whatever and meetings uh which is really nice. You can you can work you don't have to go back to the office instantly. Uh and yeah, it even has free Wi-Fi. Of course, everything has free Wi-Fi today, which is also useful, right? Really nice place.

Completely unimportant, right? Um back to Kim. Um so Kim was progressing slowly but steadily. She was digging up more stuff on let's call them dead pirate Roberts at this point uh finding more messages and you know searching any searching uh is in a way random like as an auditor or as an oent researcher in any case you will be digging through a lot of data and it is time and luck that yields a result and in this case you know she she's fairly patient especially for her age. And uh her group leader always says that you know searching is a very very tedious process in that way.

But you know every every petal helps you reveal the flower it came from. And uh eventually if you search long enough you'll find something. In this case uh you know how you cannot delete stuff off the internet. I I mean I don't mean like the image folder that you lost with very useful images. I mean like stuff that you would actually like to delete like your data or whatever.

Um your personal tidbits. Well, Sashko had a little security review a while ago. He was like, "Oh no, I I had my real name on this book review site. I better change that." Um and uh he did.

He did. he went and he changed his name on a book review site uh because he want to be more private. But in doing that he actually made a connection because his older view stayed on an archive or in some cache or somewhere where it could be found and uh suddenly I mean some always you can you can find that and by matching the comment let's say she could correlate that it was him and once he had his name well everything else was easy right everything else was very very easy from his name she got most of his iversal data within hours. She had his phone number. She knew about his family.

She was digging deeper and deeper into his life through old accounts, whatever. Public records leaked. I mean, I'm from Croatia. Our entire health record system got leaked and like two years ago. Entire system.

Come on. And it's like that for more or less every government. Every like five to 10 years it happens. It's insane. And you know, she was finding more and more about him.

She was having like a little bit of a crush on him. You know, you spend like 200 hours researching a guy and you're a teenager. What else is going to happen, right? But she kept writing the file. She kept working on it.

And she was finding out even stuff that those closest to him didn't know about, you know, maybe his uh black hat days or whatever. Um maybe some other stuff in his life. Uh, and she kept working and working and working diligently until one day Kim's work on Sashko was over. There was now a file, a file in Sashko containing all useful and crucial information about him along with dependencies about specific topics that may be used and she was done with it. Um, and now it could be used by other members of her, let's call it, organization group.

uh as needed to potentially conduct any operations in the future completely unimportant especially the class drop. Um, some time passes, you know, it's been maybe a year, maybe two, who knows? This this data stays in that file forever, right? uh and u Kim's government has found out about a potential exploit uh I mean a real exploit in a certain version of STM uh 32 chip let's say in firmware 3.5.

1 where there is a USB uh bus handling exploit which allows remote uh which allows arbitrary code execution and uh they would just love to use this to attack some potential targets which they know use code check system devices and uh what they really need to know is is it a vulnerable version in those devices. They cannot access them physically. They need some information and there is a conference just like this one uh actually not quite just like this one. It's a it's an invite only non-classified but invite only conference where you need company sponsorship from let's say some of these major companies to get in and it's being held in a hotel um like a little hotel conference center uh and it's been a few days you know not not like this not just the beginning it's been a few days it's been maybe a bit you know rough schedule rough schedule and uh Sasho is at the conference uh he's and he's going, right? His company sends him there to get educated and stuff to get learning and uh and he's tired and he goes to the restaurant bar to the to the bar at in the hotel and there is a familiar face there.

There is a guy wearing Dina Movie hat. Huh, interesting. Of course, he approaches him. That's his favorite football club. Remember from the file?

And uh yeah uh they they kick off the conversation right away. Uh like you know you're a huge fan, me too. Oh my god. Who's your favorite player? Shvshenko, whatever.

Uh right. Uh and they get talking and it's going pretty good. It's a pretty charismatic little conversation, right? And they're talking for a bit and you know their stomachs get rumbly. Uh so so this guy, let's call him Jack, he's like, "Oh, let's grab some food.

I have I have a company budget, you know, let's spend it. Uh, and they go on, they have their little bromance. They continue it and they talk and talk and talk and, you know, it's it's been two hours. They're eating this slow dinner. And you wouldn't even notice this.

This is a passing sentence. Uh, and like Jack is like, "Oh yeah, my company it's it's like going to work on these with these chips, and I was just wondering if there's any issues or whatever. we're going to work with this version, you know, and uh and he asked Sashko, and Sashko is he's a helpful guy. He's he's been briefed. He knows not to share any classified information, but and he hasn't he's been avoiding any real work talk.

They're just talking about life and sports and family and whatever. Um and you know, just just passing by, you know, Sasha just says, "Oh, don't worry. we used it and such and such product and it's it was okay. It was well documented. No, no worries there.

And they continue talking and oh yeah, just I don't have my speaker notes so I'm a bit more scatterrained. Jack, he's this is a restaurant lobby. This is a lobby. This is not the classified space uh of and you don't really he's he's seen maybe Sashko has seen Jack in in like the elevator in the lobby and places like that but not at the conference yet. Um and you know it's it's pretty good.

And soon after Jack is like okay yeah I got to go I have an early flight to catch right. Uh and uh and Jack is very happy Jack got the information he needed from Sashko without even once having to explain why he's not participating for real at the conference, why he's not at any of the lecture in any of the closed spaces. uh and instead he can just uh you know he he can just go and uh do whatever he wants and later on if he needs to he can contact Sashko again he's made a good friend who will probably provide him additionally useful information uh and all of that all of that so beautifully without having to do anything at all unkind mind. So yeah, this is let's say um a more realistic high budget production of a hack of a of a killchain where you have a goal and you have honestly the fairly cheap resources to get it executed. Um, and the question is like, oh yeah, uh, I forgot I forgot the punch line.

No speaker notes, right? Um, and the punch line is, uh, five weeks later, there's another hack because North Korea, of course, used the exploit that they confirmed to get control of the private keys controlling a multi-IG of some bridge or exchange or whatever. uh and thus you know the rest is history, the rest is wreck news or in alternative scenario maybe they sell it to I don't know uh another regime or maybe those devices were instead being used by some activist network to encrypt their communications and once again they have a back door to that and uh a bunch of people are murdered. So what does all this mean? What what what are what am I trying to get across here?

This is a realistic scenario of uh of a AP advanced persistent threat attack. But what I really want is get a message of what really exists out there across because there's a lot of security theater. There's a lot of security portion. There's a lot of companies earning money off paranoia more so than real need. So the first question is what you can do.

Well, in general, you know, uh, buy a VPN and get the data service. No, don't. Those mean nothing. Data deletion services mean nothing. Cash exists, right?

For for a real hacker, it's not going to make any difference. And for Facebook, it mean makes no difference either because they have all your data already. They have a shadow profile of you since the day you were about negative -4 months old and your mother had an increase in searches for stuff generally associated with possible pregnancy or something. It's insane. It's honestly insane.

Uh so none of those actually mean anything. What you should do should not be guided by paranoia. It should be guided but by your actual goals. Who are you protecting? What is the end goal in case your data gets leaked?

in case something happens. Is is the outcome um a hack, a ma massive loss? Do you die? Do you get arrested? Are you concealing illegal activity?

You know, uh it really varies. Um so like are you protecting basic privacy rights, some comfort, some money, your life, and who is actually chasing you? Are you are you just trying to get away from nosy exes or or some trolls or some script kitties? Cuz those they generally will not have this level of skill. I mean, this was a child searching, but she was doing it full-time.

Uh and a smart child. Um competitor cyber criminals proper like stalkers, they may have some more serious resources. So, um different levels of protection, they may have skill. And for high tier, they don't even need skill. They can just barge in.

You know, they can pay someone to raid your house. They can legally raid your house. Again, maybe you're concealing illegal activity. Do not tell me, please. People keep telling me.

Do not tell me. Uh so yeah, it really it really depends. And what happens if they win? Again, what's the loss? Uh anything that doesn't actually take into account your real threat model is just paranoia.

And the thing is I cannot give you general advice because the opsec uh currently actually here's here's a good one. We're currently working on an opsec uh playbook uh and uh I may I will probably share it soonish in a chat but uh like I cannot give you a general object playbook because it doesn't work for a general person. Um so what what do you actually do? Well, okay. In general, um, don't get suckered into privacy products, especially while you have Instagram installed on your phone or while you're using Telegram, a fully clear text app which can see all of your messages.

And by that I mean the Russian government can see all of your messages and clear text, there is no encryption. I know there's an end to-end encryption somewhere in there, but zero trust in that like because for one, you're not using it, right? Um, two, a VPN means more or less nothing. Uh, and three, okay, so what do we do for an extreme? Just to have fun.

Let's say you're a hacker trying to pull off a $5 million heist. What do you do? You acquire devices using cash. you actually get um a tour connection but before the tour connection you download all packages and large files necessary through um random Wi-Fi network uh this is keep in mind this point not a hot device in terms of being tracked um you have all of your payload and you set up an operating point uh in that operating point you execute your hack which you have prepared and uh yeah I'm going to need another like probably 30 seconds on top of that. Uh so from that operating point you execute your hack and uh let's say it works well.

Uh you're currently not traced. uh all that exists about you right now is that a certain wallet that was funded through mixed uh funds like through a mixer uh that were previously purchased P2P using cash managed to execute a hack. What do you do now? You get that convert to Monero. You crush all of your devices and you change nothing about your life.

You now have a piece of paper with 50 Monero keys with the distribution of all those funds that you may very very slowly spend. That's it. You do not brag. You do not tell anyone ever for any reason because here's what works. You cannot conceal your own privacy.

I am Noah. I am public. Everyone knows everything about me already. What I can create as a new identity and keep it completely compartmentalized from from my real one when I need to execute something. Once I do not need it anymore, it is ephemeral.

It is gone forever. It shall never be used reused again for any reason. And that is it. And I shall not change anything about my life to in any way reflect that something has happened. This goes for hacks, but this also goes for activists, for protesters, for everyone who's actually trying to keep their privacy.

In case you're on a more corporate uh perspective, you are more likely to gain news from um instead of operational security deception. Ak you want to infilt you want to provide a lot of false information about yourself to the internet. And you also want to make your threat model clear publicly. AK, if you take me and torture me for 15 hours, I will not provide any keys because I could never provide them anyway. I do not have them on me.

And that's how you ensure you're not tortured. So that's if you're in case you're, you know, walking around right now with private keys that have access to like $5 million, do not do that. Make sure that everybody knows that you're not doing that because again every year there's one that gets sliced up and thrown into a river after being tortured like at these conferences. That's it. Uh there's no clear answer.

If you have specific questions, if you have a specific situation, please contact me. And thank you for listening. I hope this was interesting and I hope I cured someone's paranoia. [Applause] Do you have any questions? Oh, there's a question.

So, you can a hardware wallet is not really improving your digital presence much. I think that I more or less answered it. You can do some hardening. You can stop using social media, but generally want to make it clear that you're not the target. You want to be inconspicuous.

You want to look like you don't really have that much. You want to look normal. You just want to look very, very normal. That's it. That's what makes your target being pompous.

Sorry, I just question that

instead of using the app. What is the cleanest way to fund a new wallet that you want to anonymize?

Good question. Okay, I'm going to say uh while you're traveling, probably within the Shenhen area where it's hard to trace, you would find uh someone who doesn't know you on a P2P site, you would wear heavy makeup to make yourself hard to recognize while also not memorable because as a woman especially, it's a lot better. You can wear sort of festively makeup and it can just be a personal expression and not a privacy thing. I I hear this a lot from activists and protesters. You know, they can sort of hide themselves without looking like they're hiding.

You will again for funding a wallet, you just need like 10 20 bucks. Again, flash loans are amazing for allowing us to hack without any real capital, right? So, you will go and using some P2P exchange or maybe just ask someone random at the conference, hey, could you just me very anonymous person, totally not memorable, send me some funds. Then you will mix those once or twice and that's it. You have just fun in the wallet successfully.

Thanks.

I mean there is the classic find the hobo thing.

Oh yeah. Yeah. There there was there is a joke in the in the creation community uh that uh and again I'm just uh not to offend anyone uh but uh I'm just saying as it is said in Croatia. So KYC is considered to be know your T gun because of the rampant use of um you know

that's that's the current running uh gag. So yeah.

Do we have any more questions? I love how everyone's just trying to, you know, interpretally get to executing a hack.

Hello. So, if I understood correctly, you were saying, uh, there is this way to execute something online where you don't have presence. It's like a call device. You execute it and then you crash it and hide all this identity. How do you actually get a cold device?

Cash. Cache maybe used devices are very good. Again, you do not need a beast rig. You can use a 15 year old laptop that you got off a grandma that like that you found on like the local equivalent of Craigslist, right?

Okay.

So, you do not need actually that device being sort of old and hard to trace is better and you will be destroying it. It is ephemeral. You're leaving only with a piece of paper with private keys, nothing else and you're burning everything. Yeah, I I was a bit pointing towards uh like in most countries if you want to get a device now, you either order it, so that's the trace or you buy it in a store and there's a camera

or maybe you get it from a friend.

Heavy makeup, heavy makeup, festivaly makeup. If you have the time, you're going during a festival, you know, you're going right now is Pride Month, right? There's a there's a parade somewhere. Heavy makeup. Let's go.

Got the phone in the meanwhile.

Okay. Thank you.

I feel like the gentleman here also has

truly experienced. You're saying

do we have any more questions? No more questions. I have a question actually. If uh someone is really good at tracking onchain data, like myself, for example, if you send me money from any of your wallets, I'll most likely be able to find the rest of your wallets. Uh what would you advise?

It's like going back to her questions on like how do I even put any money into my code wallet? that I was lucky enough to essentially buy um things straight on my like Bitcoin straight on my code wallet and I haven't transferred money from that wallet ever. But if I ever want to use the money on my code wallet, I'll still need to go through an exchange or I would need to transfer it to a DEX and that's normally where people catch you.

Um I mean that's that's up to you again. Who are you hiding from? Are you trying to keep privacy for privacy sake or are you trying to hide your $17 million of illegally stolen Bitcoin? Because one of these is like, well, you're

I don't have 70 million for all the scammers.

You're going to you're going to put a tiny bit of effort, you know, to make it a bit more private, which is fairly easy. Like you could just go through some P2P people, mix it up, but if it's 17 million that you're talking about, then it's a very different situation. And Bitcoin is not a great network for that because it's not a privacy network at all. Right? But you should use decentralized services and you should use them through to tour and you should keep every step of your way ephemeral.

So once it enters the mixer, you should be maybe on a different device set when exiting the mixer, you know, and you should be carrying as much data as you can on paper between these steps.

Oh, can we use the mic, please? Because you're also recording it.

Oh, yeah. By the way, for those interested in this, um, right now in the case against Alexi Perzv and Roman, uh, so the tornado cash people, one is going on in the Netherlands, the other one is in the US. Uh, there is a very interesting case from the defense where the defense just asked to be provided the version of CH analysis that government has access to because they tried to replicate the actual analysis and they couldn't. So the actual tracing capabilities are very high. A lot of hackers get caught.

Like three years ago, I was at the DeFi security summit in Paris and as we were just sitting there, the hacker guy got caught with about $200 in cash in a car trying to cross uh the Turkish border with Greece.

So yeah. So, so we're using Monero for cleaning up our bitcoins. How safe is it to use Monero? And then like in his example in 70 millions you you can like slowly drum.

Monero has protocol level privacy. Whether that privacy is good or not is a matter of time and effort. I am there have been cases of like let's say minor breaches of privacy in Monero. there's a lot and I mean a lot of um of actual Monero nodes and endpoints which are fully um taken by governments which means governments can trace it. So if we're talking about escaping government surveillance I'm not sure that without very advanced techniques it's cons uh sufficient.

You know the reason North Korea is so good at this is because they don't really need to escape government surveillance. They just need to mix it well enough that they can sort of pay for something, you know, but everyone already knows who done it.

Partially partially uh even there there's some more advanced techniques. There's some more advanced techniques but like um I cannot give give you like a little guide off the top of my head

any either a guarantee that it would keep you

Yeah. Yeah. because there could be so okay I did some ZK audits uh at hacken and like we were auditing Binance proof of reserves and there was a uh there was a bug. So proof of reserves was at that point running for let's say half a year and we found a bug that completely invalidated the entire history of proof of reserves. Imagine in 17 years in 17 years they find a bug maybe I find a bug in Monero that completely invalidates the entire history of privacy of Monero.

You know that's why ephemeral okay I wouldn't fully trust anything. I would assume that everything could eventually be found. Uh but you know what cannot be traced that that easily cash. So there is always the option of cash as a hop and just not changing your life. You know if you if you have $17 million in your uh in your mattress and you're not using any of them, it's going to be a bit harder to find them than if you buy a Ferrari.

So, so basically slowly drip your wallet if you have a plenty of month of dark money.

Yes. Yes. Or stay within the dark economy. That's the other um the other approach which is okay. Uh there's going to be a split.

There's going to be the legal stuff and the legal stuff. The legal stuff is going to be fully accounted for and you're going to be able to more or less trace it and justify it and that's going to be your visible life. And there there's going to be an another anonymous economy running on top of this which which is just going to be based on more or less unjustifiable money, right? And it's always worked like that. It's just that instead of just the that economy consisting of cash like in Croatia about let's say another 50% of all stuff like all salaries and stuff like that is still done illegally.

a lot of people are on minimum salaries and receiving cash and it's like that in most balcon countries. Uh so you're going to have a similar situation. It's just that now instead of having bank accounts, cash, you're going to have crypto and more private crypto and you're going to have a little split of crypto into the legal and illegal crypto. That's it.

I'll put an end to this conversation because I don't like where it's going when I'm in that room. So I I'll ask a different question. These are all just hypotheticals.

Yeah, absolutely.

As a security researcher, I have never committed a crime in my life except stealing a Kinder egg once when I was seven.

It's recorded. So now everyone knows what you've done when you were seven.

Yes.

Well, I have a question about AI and how it could be used. I don't think it's there yet, but I believe that at some point there will be essentially AI agents that will be able to track everything that we've ever posted on Twitter. If you ever have a podcast, you'll be able to script everything and extract your views.

Yeah. Yeah, they are. They are. But I don't think they they're as good as I imagine them to be in 5 years because in 5 years I think or even even sooner it would be

not public. They're just not public. Again, Facebook has had shadow profiles and very accurate advertising with more or less no data uh or minimal data for years. Um the difference is whether you're looking for a general profile or like personal profile because for advertising and such stuff, a general one is okay. For personal stuff, you can you can always dig up.

It's just that you're not a target. I'm not a target. I I

yeah,

I talk some stuff, but like who's going to actually target me properly? You know,

the kid looking for his egg from when you stole it from him seven years ago.

Store that was a store.

Here he is extracting from me. You know, the the the punchline of this whole talk was I am Sashko. I'm just leaking everything.

Or maybe that's just, you know, my my my visible identity. Who knows? I would never admit anything.

Thank you so much. That was such a pleasure having you. [Music]