The Online Operations Kill Chainâs Phase 6: Evading Detection clearly shows the theater wide viewpoint of a defender of a major platform. There are technical measures theyâve placed in this area that I included right at the very start of creating a new persona. There are simple word ban evasions. So this is all over the board from the perspective of a small unit engaging in a broad conflict.
Attention Conservation Notice:
I almost wonder if I shouldnât be rewriting the ten phase set of tactics, techniques, and procedures for company sized ISR operations. This is one of those articles I write because Iâm not sure what Iâm doing, but you might get some benefit looking over my shoulder while I wonder aloud about things.
Technical Measures First:
Geo-limiting website audiences? OK ⊠this presumes that you can do these things.
You have the ability to put up web sites.
Your web sites have some ability to see some visitor information.
You have the bandwidth to build general content for ALL and ...
You can also produce specific content for SOME.
Iâve encountered this sort of division here and there in my travels. The most notable event I can think of recently was a situation where Ukrainian refugees in Europe who could not see content there which WAS available to people still in country. This was on Telegram, a Russian platform that Ukrainians still treat as a trustworthy for communicating and organizing(!) Yes, the company made a show of relocating outside of Russia. If you are so foolish as to think that matters, perhaps this Substack is not for you.
Back during the Anonymous rampage of 2011 â 2012, The Onion Router, hereafter Tor, was a great way to conceal your location and get up to mischief. Today it is become more and more like I2P, another anonymity network that is a walled garden, having its own namespace unconnected to the DNS names with which you are familiar. Those using Tor are immediately treated as admitted behavior problems and often just shunned out of hand.
I keep a TAILS VM handy for occasional situations where I want to quickly look at something new without immediately knowing where it goes, or if it even matters. When I install a remote system I will often include Tor so I can expose ssh remove access as a hidden service. Tor is slow and erratic, but this is OK when I absolutely do not want the machine to be able to tell anyone anything about me, should it fall to some intruder.
VPNs are another matter. Most of them are absolute crap, any service that wants to install their binary client should be treated as malware and avoided. The only ones I find trustworthy are the free ProtonVPN that comes bundled with any ProtonMail account, and Mullvad. There are others based in Nordic countries that are probably OK, but I havenât had a need to diversify.
The citing of Tor and VPNs as they do seems dated to me. Today I would place VPNs in the role of Tor â an edgy form of access likely to draw attention, and how they see VPNs is how I view a tethered burner phone. As the hazards have gone up there have been âtaxesâ added all over the environment, demands for real phone numbers rather than VOIP, and the requirement for picture ID for social media accounts that only a money transmission business would have been able to ask for five years ago.
Bobbing & Weaving:
The other evasion methods are simply getting up to speed on in-group communication norms and then, if youâre clever and/or you develop some reach, adding to the lexicon. When I started into this area I was making roughly five appearances a week on DailyKos and I was among the most popular dozen or some âright hand columnâ writers â non-staff whose access to the front page was dependent on mass promotion by regular readers. Since I find producing a curious turn of phrase simple, I was often on the ârec listâ there.
Since things migrated from blogs and comments to social media things have evolved so much in this area, Iâm not longer precisely sure what works. There are too many forces at work, too many in-groups, and as a Gen-X so old the kids occasionally âOK Boomerâ me, my time in such environments has passed.
Where do things like ChatGPT fit into this? OpenAIâs ChatGPT 3.5 has been, at least for me, like a dumb but persistent technology intern. Iâve been doctoring Proxmox stuff while writing this and with it available I only need to have a vague memory of what Iâm trying to do, a couple questions will find the configuration and code snippets I need. Itâs been very empowering in this fashion, but Iâve seen others doing low key amazing stuff, like feeding bullet points to ChatGPT 4.0 and getting back tolerable drafts of articles based on the prompt.
Creating usable collateral in the form of stills has been around for a while, now weâre got examples of faked audio/video of high visibility people. A couple years ago putting someones nudes out could be highly destructive. Give that another twelve months and the response will be âlol fake!â ⊠or youâll face criminal charges.
Conclusion:
The defense evasion scenario TOOKC contemplates involves less capable pawns swarming social media and crimes against others to gather and exploit information. If youâre reading this youâre a bishop, a knight, or a rook, moving at speed and in ways no pawn ever could.
Perhaps one day soon individuals with the sanction required to cross that computer intrusion line may be reading this, but I canât imagine ever describing how to do those things in detail. There will always be new people reading the content and they need cautious, conservative guidance until they can answer âWhat hunts you?â in an immediate, fulsome fashion regarding their current activities.
OK, after an uneven start weâve got something on the first six phases of The Online Operation Kill Chain, and weâre 51 days into the 92 days of fourth quarter. Four more phases to cover, six weeks to do so. I think weâre gonna make it after all.