Killing with Keyboards – How Your Digital Footprint Can Be Weaponized — Noah Jelich

Hello. Hello everyone. Uh I hope you're ready because this one will be a bit more fun. All right, so we got it going. Uh so today I'll be telling you about your digital footprint aka what what hackers can find about you and how it can be used on a an example of a particular story.

Uh but first a little bit about me. So I'm a security engineer and software architect. Um I've done a lot of audits. I've made some tooling. I've done all the stuff.

Uh I've been up at night analyzing hacks. And after all of that, I was like, you know, I think I can do better. Then I started working with projects a little bit. And I was deeply deeply scarred. by the operational security practices of your average uh you know of your average CEO.

So I was like, huh, how do I scare these people? How do I make them understand what's going to happen? Cuz you know, hypothetically, somebody loses their encryption keys and you need to do a last minute redeployment of a, you know, of a whole system. Not not the nicest thing when you lose control of a multisig, especially when everything is ready already. Uh yeah, I also co-created was cub which is a cool tool I talked about the previous year um with Barto Barikovski from Hacken um for was coverage.

Um so yeah and also you know I love public transport and stuff but let's get into the story time because this one is a bit of a short time slot. So this is Sashko. He's a he's a Ukrainian engineer and he works at Kovchic systems. Think of it like a, you know, hardware secure devices company. Maybe a hardware wallet, maybe something more, maybe something less.

And he's like a chill guy. He's good at his job. And um and he's happy. He's a normal guy. He doesn't do anything particularly unusual with his life, right?

except that from time to time he will go online to these little chat rooms and he will do disgusting things such as following up on the news and security and talking about stuff that interests him. Uh but generally he stays anonymous, right? He goes under a little moniker. And I think this is a good uh good point to just say, "Yo, I do have some Easter eggs here." And uh you get virtual mental points from me if you manage to catch some of them and tell me about them later cuz I I try to get a few Easter eggs here, especially if you're in security to make it extra fun.

Anyway, Blink and you really miss him, but but he does provide a lot of good info. He's very useful there. He talks about cool topics and he shares his knowledge and people consider him a helpful good guy, right? Uh so yeah, that's Sashko. That's his life.

And now there's a girl. Of course there's a girl. It's a story. There has to be a girl. The other side of the world, a other side of the pond and a continent over, there's Kim.

And Kim is a teenager. She's a teenager from the Democratic People's Republic of Korea and she's what I would call a Googler maybe or a searcher. Okay. She fulfills a role every day collecting information uh on various topics on various keywords that her government provides her for others in her department or whatever to use. and she's searching for stuff and uh today today she found Sashko.

She was doing some general research on the STM32 keyword just looking up in some chats or whatever and uh she found a message and right now she doesn't know much about him. She doesn't even know that he's a he. But that will change very very soon. Back to Sashko. So, we're another day at the office.

You know, uh there was uh a good project milestone reached. So, everyone got a little bonus thingy and uh you know, for Bogdan, it's like one step closer to retiring with on a little farm or something like that away from old technology. And uh for others, I don't know. And then they spent like a whole half day um in like a quarterly security update. Okay.

And everyone was sort of pissed with that because it's meetings, that's not productive time. Uh, so it was like, let's not waste any more time on these. Um, how did this picture get rotated? Dear Lord, I just noticed that. Anyway, after that, everyone went out to like a little little coffee shop.

It's uh it's really useful. It's like this glass place. It was recently built and uh it serves the employees of the tech park and it's like really cool, you know. Um it offers free Wi-Fi. It offers six free small quiet rooms where you can take your private video calls or phone calls or whatever you need for business.

And uh yeah, it also has a discount for the tech employees. You just need to show your little ID card to to the guys working the registers and they will give you a 15% discount. And you know, while in line, they were talking about how like, you know, we have security clearance. Why are they giving us these dumb briefings? They're useless.

Like, no one does dumpster diving anymore. Come on. They have no clue what they're talking about. Back to Kim. So, at this point, Kim, you know, she's a girl, she's a teenager, she's even feeling a little bit about Sashko, and she's learning a little bit more about him.

Sorry, Sashko. About dead pirate Roberts. Um, so Kim Kim was working and her group leader often told her often told her she needs to be very patient cuz it can take weeks to find something important and you know eventually you do. Each petal helps you identify the flower it came from and each piece of the puzzle provides a new search opportunity. So she searched and searched and she follow the trail from one site to another and sometimes the seemingly unimportant stuff uh yields great results.

In this case uh Sashka was doing a little privacy security review a few years ago um and uh he was like oh I have this review site where I use my real name. I better change that to like a moniker. And he did it in a silly way. Uh so he changed his username and you know that was that but he didn't think about the fact that you cannot delete anything of the internet anything which means that the old version of the site was still in a cache somewhere. So this username change on a book review site allowed Kim by reviewing some caches and stuff uh to to find his real name.

Okay. And once she had that, everything else was easy. She was suddenly finding everything else about him. She had his phone number, his email, his wife, his children, all his social media. Come on, your real name is you're already out there.

And you know, she was digging deeper and deeper into his life. At this point, you know, she was seeing what kind of guy she was. he was like maybe you know a little bit of a crush or something and you know just digging deeper into the lives of others even the stuff that nobody even those closest to him didn't know about uh until one day Kim's work on Sashka was over her leader rewarded her for completing her 200 file she was allowed to recommend a family member member to join her at school. Soon she would have the honor of teaching her 13-year-old sister all she learned about Googling and computers. The information about Sashko, on the other hand, well, that was now available for use as needed.

Anyway, forget about this. This is just a detour. This doesn't matter at all. It's been a year. Okay, it's been a year and uh something completely different is going on.

Um you see Kim's government found out about a little um about a little potential exploit that could be used and they want to check several targets. uh they found about an exploit in say the version 3.5.1 of uh this chip architecture which has like a USB exploit uh USB bus exploit and um they want to use it to target something or someone and they need to confirm since they know this something or someone may use code systems devices they need to confirm which versions of the chip those specific devices sold at that time used and there's a conference there's conference just like this one uh and uh it's you know it's out of town it's engineering and it's not classified but let's say that this conference was a bit different it was very restricted uh every attendee required a company sponsorship and it was held in a hotel and uh the hotel conference center had guards outside the meeting rooms and stuff and you had to have conference badges when in sessions uh to make sure that you really have the right to be there. And a few days passed and Sasha was a bit tired of the conference.

He was tired after several days of the conference. And he went to the bar in the hotel and uh he saw a guy, a familiar-look face, a guy with a Dina Makv hat. He had seen him several times around the hotel. He had seen him in the lobby, in the elevators, in the restaurant. And uh of course he walked over and he was like dam here and uh let's call this guy Jack.

He was like yeah uh you're the first to notice. Well of course I'm a fan. Are you at a conference? Yeah, but let's not talk about work. I'm I'm not allowed to anyway, you know.

And they chitchated. They chatted about they chatted about life, about sports, about uh cars, women, whatever people talk about, I don't even know. And um some time passed and there they were getting a bit peckish. So Jack was like, "Oh, let's get some lunch." And of course Sashko accepted.

And they're talking some more over some wine, getting a little bit tipsy. Uh, and they're talking just a tiny bit about work, but careful not to say too much. Uh, and you know, this is a long conversation. They've been at it for a few hours. They're really good friends now, right?

And um and just in passing, Jack is like, you know, uh I was hoping to hear if uh if anyone else was thinking of using like the latest uh STDM32, uh cuz I hate to be the first one to use that chip or like, you know, this specific version or whatever. And Sashko being a helpful guy, he was like, "Oh, don't worry. We have them in such and such products. They're well documented. You don't have to worry about anything.

Uh and uh yeah, this was just a passing line in a conversation. You really forget this sort of thing. And you know, the conference is still ongoing, but after this lunch, Jack is like, "Uh, yeah, I need to go. I need to catch an early flight, you know, and he goes away. He disappears somewhere, right?"

And uh Jack is really happy as he's boarding his plane because he got the information he needed for his client from Sashko. And uh he even has Sashko as a long-term contact now. You know, if he message Sashko, Sashko would probably provide even more information to him as they're building more and more report. And meanwhile, he was able to do all of this without having to do anything at all unkind. So yeah, Sashko of course knows nothing from Sashko's perspective.

Nothing even happened. He just had a nice chat with the guy. the usual kill chain. A few weeks later, there's another massive hack. Roll a Dund to guess how many million will be lost in this one, right?

If we're lucky, it's we're rolling a D12. Um or a D20. Uh yeah, the zero day was used to to gain control one of the several wallets controlling like a multi-IG and you know the rest is history. Rest is history. Or let's talk in an alternative world, you know, maybe the chip was used by an activist group uh fighting totalitarian regime somewhere.

Uh so um yeah maybe that exploit was sold somewhere else and uh it it was eventually used to decrypt crypt or access communications of that group and uh pretty soon all of its members were executed. So I hope you're scared. I hope you're scared uh because you should be uh and you should be preparing questions because there's one question that all of you should be asking yourself at the end of this presentation and if you approach me with it uh and ask me the question in private later maybe you get an answer but first what can you do uh we have a few minutes so let's go through this quick um I cannot tell you what to do like this uh there's no list of rules rules that you blindly follow. You cannot just get a VPN and pay for some data removal service or whatever they call themselves these days. Uh because you build your defenses based on who's after you, what they want, and what happens if they succeed.

So, who are you protecting? Are you protecting sensitive personal data? Are you pro protecting business information? Are you protecting illegal activities? Because these have different risk factors.

Are you a journalist, an activist, or a hacker? Depending on what it is, you actually need to justify how much effort you're going to put into protecting the data. The other question is who is chasing you? Who are you protecting against? Uh because an X that's stalking you, you can actually mostly protect from someone like that.

But like mid-tier or high tier threats are very different. Some may use technical exploits while you know the law enforcement could just send the police and question you. If you're in the wrong regime, they can torture you. You know, the stronger your enemy, the more airtight your ops needs to be. And lastly, what happens if they win?

Uh do you uh do you just get doxed? Do you get harassed? Do you lose access to your accounts? Do you face legal consequences? Do you get arrested something worse?

If the consequences of you being caught are lifealtering, uh you shouldn't play around, you know, and that's where the compartmentalization and anominity comes in. So for last two minutes, I think uh I'm just going to tell you a few short tips. Let's say you were conducting a hack. First first tip, the one tip you should remember is you cannot protect this identity. I am Noah.

I am here. You already saw my face. You already know who I am. Um too late, too late. You can make new identities, new compartmentalized identities separate from each other, ephemeral, used only for the purpose, minimal purpose that you need.

Okay. Um second thing, yeah, Telegram is not private nor secure. I I love how it managed to get that marketing, but it's not even end to end encrypted. Like, you're literally sending clear text messages that Telegram can see in full and probably keeps logs off. So, it's a bit silly.

Okay, that's the first thing. The other thing is if you're conducting a hack, uh you should start with um tools aka computer, internet access, etc. purchased anonymously using cash untraceable to you while you were wearing heavy makeup and uh a hat or something like that to not be recognized. And what you should end with would hopefully be a piece of paper with a bunch of Monero keys with your already laundered money. Okay.

Um and a pile of trash where you shredded all the computer equipment that you then burn and then you also throw the lighter in the fire. So yeah, a bit more detail in a longer format maybe. Uh but yeah, you really shouldn't shouldn't be trying to protect your real identity at this point because you cannot get away with anything if you're using your name. It's your name, right? So yeah, there is a lot more to ask here.

Let's get straight into the Q&A. Um so I hope someone has a question right now. Uh, going in three, two, one. Are there any questions?

At least one.

Well, I I think they're scared they're going to be f, you know, dogs. Like a common question would be, okay, but what about the information that's already out there? you know and about that you can do some delion but generally it's all in a cache somewhere another one is uh how do I launder some money uh and uh the answer is generally monero is pretty good uh third one is what if I'm not a criminal what if what if I'm a corporate operation uh and for that one I'm going to say that uh maybe you can contact me you know directly and uh I can give you some tips especially if you're a high-profile person within the company you will likely be targeted but even people of a lower status are very useful for extracting basic information so nobody should be really saying anything openly you know You should be careful. Everyone here is going to be very talkative, especially today after getting a bit drunk. So, yeah, be careful with the company secrets.

Hey, seems like we have a question.

Do you find that tornado cash is any good for that laundering, too?

Uh, so let's say this. If tornado cache wasn't any good, Alexi Pertzer would not be in prison.

What about privacy pools? Maybe I the thing is tornado cache is good enough. It's already a tool and the more volume there is in a tool the better the mixing you know and that's why Monero list of private keys on paper you know you should get to Monero somehow of course you should avoid getting blocked you should there's a lot to it but uh once you're in Monero you just wait and it gets mixed you know and yeah also do not buy Lamborghini Because I remember when I was at Defi Security Summit like two years ago and like uh we were just talking about the hack that happened and then the guy got caught on like the Turkey Greece border or something like that with a car full of cash which was I I bet it was a good idea you know to just carry cash across border and a massive amount could have been underground you know have tools and use them but don't do illegal kids don't do illegal stuff. So yeah, thank you very much for listening and uh

did did anyone find any Easter egg?

Oh yeah, any

was the rotated image an Easter egg?

No, that was not that was just an error. But there were there were a few if you know some history just a little bit.

Okay,

but you can approach me later. Anyway, uh thank you very much and uh let's give him a big applause. Until next time.