Unredacted Magazine
Issue 005
Q1 2023
UnredactedMagazine.com

The MacOS Ventura Privacy & Security Guide
Refresh you macOS for optimal privacy and security

UNREDACTEDISSUE 005

IN THIS ISSUE
5From the Editor

34

6

The macOS Ventura Privacy& Security Guide

10 Minutes of Google Dorking
for COVID Documents

37

12

Wireless Security: Vehicle Remote
Entry Attack and Defense

Supermarket Loyalty Card
Privacy Strategy

38

15

Malware or Mal-Awareness?

Changing Your IMEI for
Cellular Anonymity

19

Social Links: Revolutionary AIDriven OSINT solutions

40

Sign out of Apple

42

Reader Q&A

20

An OSINT Practitioner’s Perspectiveon Privacy, or, How I Learned to Stop
Worrying and Embraced Obscurity

44

Updates

45

Letters

46

Verifiable Credentials: The Killer
Feature of Decentralized Identity

49

Privacy-themed Puzzles

50

Final Thoughts

50

Affiliate links

23

Hardening Measures for MultiFactor Authentications

25

Google Analytics

28

The OSINT Corner32

Pet Intelligence

UNREDACTED is published free of any charge to the reader, and this file may be publicly shared in its entirety. All issues are available for freedownload at UNREDACTEDmagazine.com. Contact details are also available at this site.
The contents of this publication are copyright © 2023 by UNREDACTEDmagazine.com, and are published via a Creative Commons AttributionNonCommercial-NoDerivatives 4.0 International license. You may share it for free as long as you keep the entire file intact. Commercial use isprohibited.
Cover Design by Anonymous Reader. Layout by Astropost. Special thanks to everyone who helped make this happen. You know who you are.

4

FROM THE EDITOR
By Michael Bazzell
Happy new year everyone. We
have been quite busy preparing forthe publication of the 10th Editionof OSINT Techniques, which is now
available. I want to take a moment todiscuss the changes.
The previous (9th) edition of thebook was originally written in late 2021.
In late 2022, I was asked to update
this book, as it is required reading fornumerous college courses, university
degrees, and government training
academies. I never want stale orinaccurate information being presented
within training programs, so I createdthis special revision. In many previous
editions, I only published a new version
once I had at least 30% new materialand 30% updated content. The recycledmaterial was kept to a maximum of
40%. With this edition (and the 9th),
I have deviated away from that rule.
I estimate that 20% of the content isbrand new, 20% has been updated toreflect changes throughout 2022, andthe remaining 60% is recycled from thefrom the previous edition.

FROM THE EDITOR

Much of the ninth edition content was
still applicable and only needed minor
updates to reflect changes since 2021.
If you have read the previous edition,
you will find most of those overall
strategies within this book. However, I
have added many new OSINT methods
which complement the original text inorder to cater to those who always needaccurate information. I also removed a
lot of outdated content which was nolonger applicable. I believe there ismuch new value within this updated
text. The majority of the updates areavailable in chapters 2, 3, 4, 5, 6, 7, 8,
23, 28, 30, 31, 32, and 33, along withthe digital files which accompany them.
The other chapters all have minor
updates.

chapters, as I believe they introduce
the future of OSINT analysis.
Finally, I want to thank the OSINT
community for the continued interestin my online investigation strategies.
It has been over a decade since thefirst edition, and I would have neveranticipated the popularity of OSINT
when I published it. If you are interested
in this new updated edition, please go
to inteltechniques.com/book1.html.
Thanks,MB

This edition also presents six new
chapters unavailable within previous
versions. These include Broadcast
Streams (23), Application Programming
Interfaces (28), and an entire newsection containing four chapters about
Data Leaks (30), Data Breaches (31),
Stealer Logs (32), and Ransomware (33).
I am very excited to release these new5THE MACOS VENTURAPRIVACY & SECURITY GUIDE
By Michael Bazzell
The beginning of a new year is always a great time torevisit and refresh your digital security. For me, that means a
deep cleaning of all devices. Often, I rebuild the operating
systems on all of my hardware and optimally reconfigure
my settings. This is quite easy for my daily Linux machine,especially with the various Linux Lifestyle articles from thepast three issues. However, macOS is a different beast. The
only macOS device I ever use is my OSINT machine which
is a MacBook Pro M1. I choose this due to the virtualization
options, and rarely touch the host. I explain more about thatin the 10th edition OSINT book. Since I have several clients
who rely on macOS products, I felt the need to create amacOS privacy & security protocol. The following assumes
you are using the latest, fully-patched, Ventura operating
system. I placed all commands provided here on my site athttps://unredactedmagazine.com/data/005.txt for easy copy
and paste.

6Phase 1: Update to Ventura
From your Apple device, apply all updates and fully
upgrade to Ventura. This can be done on a “dirty” machine.
We just need the OS to fully install before we reset thedevice, which will erase all data.
Phase 2: Complete System Wipe
Next, we want to wipe out our entire system. This eliminates
any junk leftover from unused apps and various cached files
eating up valuable space. First, make a backup of any valuable
data. Common locations include the Desktop, Downloads,
and Documents folders within the home folder of the current
user. I prefer to use SuperDuper (https://www.shirt-pocket.
com/SuperDuper) for this, as the backup is a true clone andbootable. Once complete, conduct the following (based on
M1). Warning: this will erase all data on your device!

• Open System Settings and type “reset” in the search
box.
UNREDACTED MAGAZINE / Q1 2023

• Select “Transfer or Reset” and click “Erase All Content
and Settings”.
• Enter your password, click continue, and confirm erase
option.
• Allow device to reboot.
• Connect to Wi-Fi in the upper-right (Required for“Activation Lock”).
• Allow activation to complete (enter account password if
required).

brew install --cask taskexplorer
brew install --cask knockknock

Phase 4: System Configuration
Next, I like to modify all stock macOS settings which
provide additional layers of privacy and security. I conduct
the following.

• Open “System Settings” and search “Update”.
• Click “Software Update” then “Automatic Updates”.

• Click “Restart” when activation completes then click“Get Started”.

• Disable “Check for Updates” and click “Done”.

• Select desired language and region.
• Click “Not Now” in the Accessibility screen.

• Apply any pending updates and modify the following
within “System Settings”.

• Click “Continue” without selecting a Wi-Fi network.

• Bluetooth: Disable Bluetooth• Click “Continue” to confirm your choice.

• Network > Firewall: Enable Firewall• Click “Continue” on Data and Privacy screen.

• Notifications > Show Previews: Never• Click “Not Now” at the Migration Assistant.

• Notifications: Disable “Allow notifications when thescreen is locked”• Click “Agree” to the Terms and Conditions and confirm“Agree”.
• Provide generic computer name and secure password.
• Click “Continue” then “Continue without enabling
Location Services”.

• Enter your password if prompted.

• Notifications > Each app: Disable• General > Date & Time > Source: Change to“pool.ntp.org”• General > Sharing: Disable All• Click “Don’t Use” to confirm choice.

• Siri and Spotlight: Disable “Ask Siri”• Choose your desired time zone.

• Siri and Spotlight > Spotlight > Disable all• Disable all analytics options and click “Continue”.

• Siri and Spotlight > Siri Suggestions > Disable all• Click “Set Up Later” for Screentime.

• Privacy and Security > Analytics > Improvements:
Disable all• Uncheck “Enable Ask Siri” and click “Continue”.
• Click “Set Up Touch ID Later” and click “Continue”.

• Privacy and Security > Apple Advertising > Disable
personalized ads• Choose your desired look and click “Continue”.

• Lock Screen > Require password immediately

Phase 3: Basic Software Installation
Next, Install Rosetta (only for newer Apple hardware),Homebrew (package manager), Task Explorer (identify
suspicious processes), and KnockKnock (identify persistentmalicious files). I run Task Explorer and KnockKnock weekly.
softwareupdate --install-rosetta --agree-to-license/bin/bash -c “$(curl -fsSL https://raw.
githubusercontent.com/Homebrew/install/HEAD/
install.sh)”THE MACOS VENTURA PRIVACY & SECURITY GUIDE• Game Center: Disable all• Wallet & ApplePay > Disable “Add Orders to Wallet”
Phase 5: Change DNS
I have explained NextDNS within previous issues, and thatis what I use for DNS queries. Something simpler which canbe applied until you create a NextDNS account is Cloudflare.
Their server addresses are 1.1.1.1 and 1.0.0.1. Within System
Settings, conduct the following.

7• Select connection (Wi-Fi or Ethernet) and click “Details”.

• Open “Little Snitch Rules” from the menu bar.

• Disable “Limit IP address tracking”.

• Click the “+” in the lower left and create profile titled“Apple Disabled”.

• Click “DNS”.
• Enter desired servers.

• Click the “+” in the lower left and create profile titled“Apple Enabled”.

Phase 6: Security Settings• Click the “+” in the lower left and create profile titled“Apple Update”.

Enable FileVault for full-disk encryption at the following
location.

• System Settings > Privacy & Security > FileVault
Next, open Terminal and consider the following commands.

• Disable Spotlight completely: sudo mdutil –a -i off• Delete Spotlight index from root: sudo mdutil -X /• Confirm indexing disabled: sudo mdutil -s /• Confirm FileVault status: sudo fdesetup status
I disable Spotlight because I do not need or want it.
This prevents Apple from digesting all of your files, emails,
images, etc.
Phase 7: Apply Firmware Password (Intel only)This only applies to older Apple devices, as M1 and newer
machines have something similar enabled by default.

• While in the “Effective in all profiles” section, disable all
options, except “Allow outgoing connections to local
network”.
• From Rule Groups, disable all options.
• In the menu bar, change Profile to “Apple Disabled”.
• Change “Operation Mode” to “Alert Mode”.
• When prompted by any Apple service, choose “Anyconnection”, “Forever”, and “Deny”.
Your machine will start annoying you. You will soon see why
we want this software. Your Apple device is constantly callinghome to send details of your usage. With Little Snitch, we canblock all of these intrusions. As I write this, macOS Ventura
possesses 64 Apple applications which send telemetry about
you to Apple’s servers. We can set this “Apple Disabled”
profile to block all of them. However, there are exceptions.
The following will allow Apple to see your DNS servers (toconnect to the internet) and keep your time synchronized.

•

Boot computer into Recovery Mode with CMD-R.

•

Choose active account and enter password.

• mDNSResponder: Allow to connect to chosen DNS
servers•

Click “Utilities” in the menu then “Startup Security”.

• mDNSResponder: Allow connections from local network•

Click “Turn On Firmware Password”.

• timeD: Allow to connect to new time server•

Provide desired secure password.

•

Quit and restart.

I also allow all Apple services which ask to “Allow
incoming connections from local network”. This will keep
various internal devices synchronized and my macOS virtual
machines happy within UTM. If I were on a public network, I
would disable all of these. At my home, I have no objection.

Phase 8: Little Snitch
This is the big one. Little Snitch is a software firewall
which prevents applications from sending out unnecessary
data about our usage. This could be to block Apple fromconnecting to iCloud or to prevent Microsoft from sending
analytics every time you open Word. For me, this is themost vital piece for a private macOS device. LuLu is a freealternative if you do not want to pay for Little Snitch, but I
find the price to justify the advanced options.

• Execute brew install --cask little-snitch in
Terminal.
• Choose “Silent” mode for now.
• Deselect macOS and iCloud options.

8

Next, let’s continue configuring our “Apple Disabled”
profile.

• Open all apps once and reboot, confirming to “Deny”
everything.
• Continue until Little Snitch alerts are finished.
• Copy all “Apple Disabled” rules into “Apple Enabled”
and “Apple Updated”.
• Change all “Apple Enabled” rules to “Allow”.
• Change “AssetCacheLocatorService”, “com.apple.
MobileSoftwareUpdate”, “CoreServiceUIAgent”,

UNREDACTED MAGAZINE / Q1 2023

“mobileassetd”, “nsurlsessiond”, and“softwareupdated” in “Apple Updated” to “Allow”.
These changes allow you to switch to other profiles whenneeded. When I want to check for updates and apply any
pending upgrades, I select the “Apple Update” profile. It
allows only the minimal services to send data. If I ever need
to, I can allow all Apple services with the “Apple Enabled”
option, but I would never do that. For daily use, I am always
on “Apple Disabled”.
Next, let’s use Terminal to confirm a few things. These
commands can be beneficial when you simply want to makesure your settings are as desired.

sudo rm -rfv /private/var/db/uuidtext/
sudo rm -rfv /var/db/uuidtext/
sudo rm -rfv /private/var/log/asl/*sudo rm -rfv /var/log/asl/*sudo rm -fv /var/log/asl.log # Legacy ASL(10.4)
sudo rm -fv /var/log/asl.db
sudo rm -fv /var/log/install.log
sudo rm -rfv /var/log/*• Confirm Spotlight: mdutil -s /sudo rm -rfv /Library/Caches/* &>/dev/null• Confirm FileVault: fdesetup status

sudo rm -rfv /System/Library/Caches/* &>/dev/null• Confirm SIP: csrutil status• Confirm Assessments: spctl --status
I like to make sure that undesired programs are not set
to launch in the background upon boot. The following
commands open the two most common places these
programs hide. Once open, you can delete them from Finder
if desired.
open ~/Library/LaunchAgents/
open /Library/LaunchAgents/

If I ever want to clear my Terminal history, I can conduct
the following.

sudo rm -rfv ~/Library/Caches/* &>/dev/nullsudo rm -rfv /var/spool/cups/c0*
sudo rm -rfv /var/spool/cups/tmp/*
sudo rm -rfv /var/spool/cups/cache/job.cache*sudo rm -rfv ~/.Trash/* &>/dev/nullrm -rfv ~/Library/Developer/Xcode/DerivedData/*&>/dev/nullrm -rfv ~/Library/Developer/Xcode/Archives/*&>/dev/nullrm -f ~/.bash_history

rm -rfv ~/Library/Developer/Xcode/iOS Device
Logs/* &>/dev/nullrm -f ~/.zsh_history

sudo dscacheutil -flushcache

The following clears macOS logs and cache files.

sudo killall -HUP mDNSRespondersudo rm -rfv /Library/Logs/*

sudo purgerm -rfv ~/Library/Containers/com.apple.mail/Data/Library/Logs/Mail/*

The following disables all leftover Siri services.

sudo rm -rfv /var/audit/*sudo rm -rfv /private/var/audit/*sudo rm -rfv ~/Library/Logs/*
sudo rm -fv /System/Library/LaunchDaemons/com.
apple.periodic-*.plist

defaults write com.apple.assistant.support ‘Assistant Enabled’ -bool false
defaults write com.apple.assistant.backedup‘Use device speaker for TTS’ -int 3
launchctl disable “user/$UID/com.apple.assistantd”

sudo rm -rfv /var/db/receipts/*

launchctl disable “gui/$UID/com.apple.assistantd”

sudo rm -vf /Library/Receipts/InstallHistory.
plist

sudo launchctl disable ‘system/com.apple.assistantd’

sudo rm -rfv /private/var/db/diagnostics/*

launchctl disable “user/$UID/com.apple.Siri.
agent”

sudo rm -rfv /var/db/diagnostics/*

THE MACOS VENTURA PRIVACY & SECURITY GUIDE

9

launchctl disable “gui/$UID/com.apple.Siri.
agent”

rules. Images of the full configuration are available athttps://inteltechniques.com/ventura.html.

sudo launchctl disable ‘system/com.apple.Siri.
agent’
defaults write com.apple.SetupAssistant ‘DidSeeSiriSetup’ -bool Truedefaults write com.apple.systemuiserver ‘NSStatusItem Visible Siri’ 0
defaults write com.apple.Siri ‘StatusMenuVisible’ -bool false
defaults write com.apple.Siri ‘UserHasDeclinedEnable’ -bool truedefaults write com.apple.assistant.support‘Siri Data Sharing Opt-In Status’ -int 2

Finally, the following disables various remote connections.
sudo systemsetup -setremotelogin off
sudo launchctl disable ‘system/com.apple.tftpd’sudo defaults write /Library/Preferences/com.
apple.mDNSResponder.plist NoMulticastAdvertisements -bool truesudo launchctl disable system/com.apple.telnetd
cupsctl --no-share-printerscupsctl --no-remote-any
cupsctl --no-remote-admin

I know this seems like a lot of work. As a reminder,
I placed all commands provided here on my site athttps://unredactedmagazine.com/data/005.txt for easy
copy and paste. Once finished, you will have the comfort ofknowing you have stopped 99% of Apple’s intrusions into
your daily life. Or, this will convince you to move to Linux.
Either way is a win.

Hopefully, you see the value in blocking the constanttelemetry being sent to Apple servers about the ways
we use the machines which we purchased. Any updates tothis guide will be posted at https://inteltechniques.com/
ventura.html.

The images below compare a partial section of the Apple
Disabled, Apple Update, and Apple Enabled Little Snitch

10

UNREDACTED MAGAZINE / Q1 2023

WIRELESS SECURITY:VEHICLE REMOTE ENTRY ATTACKAND DEFENSE
by Reginald
Wireless communications play a verylarge role in our daily lives. One of
the more exposed items we use that
rely on wireless signals is our car. Not
since the early 2000s have we mainly
relied on physically inserting a key
into a lock to open the car door, andin the early 2010s we adopted wirelessignition in earnest. In the past 20 years,
security holes in these technologies
have come and gone, and some arestill present. For instance, Honda key
fobs are vulnerable to replay attacks
with some simple know-how and cheap
equipment. Focusing on key fob andremote entry vulnerabilities, we tested
two vehicles as use-cases that anyone
can reproduce, given access to thesemakes and models, the right tools,
and the right permissions. Defensive
strategies will be covered as well.
The PremiseCertain vehicles are susceptible
to remote entry hacks given certain
circumstances and criteria are met.
Those are:1.

A vulnerable vehicle is available

2.

The attacker has close access tothe target vehicle’s key fob

3.

The attacker possesses the rightequipment to exploit the key fob

12

The most common attack is a
replay attack where the signal fromthe manufacturer’s equipment isrecorded and replayed, mimicking theoriginal equipment and signal. Manymodern vehicle remote entry systems
implement different forms of security
to disable these kinds of attacks, but
not all are effective. The most common
are rolling codes, where a uniquesignal accompanies each press of the
key fob button supposedly denying
reproduction unless certain criteria aremet. One of those criteria is correct
sequencing. For instance, if one wereto capture and record a key fob unlock
signal which was actively used to unlock
the vehicle (a bystander witnessing an
unlocking), and the vehicle responded
to that signal, the sequence is thenincremented in some fashion, meaning
the captured signal will be ineffective if
replayed in its original form.
If that same signal were captured
and recorded, but the vehicle did
not respond due to distance or RFdampening media, a replay may still be
successful, as that specific sequence of
unlock codes remains valid. The vehicle
is awaiting the rolling code incrementthat was just captured, since the vehicle
did not “hear” the key fob. A subsequent
signal from the key fob will still unlock
the vehicle, as both the vehicle and the
key fob are programmed to respondto the same rolling code sequencing,matching a specific algorithm allowing
for code increment prediction. By this,it means the car isn’t just waiting for the
next increment from the key fob; it will
respond to any signal which matches
the predicted code sequence. You can
hit the button to unlock the vehicle any
number of times without response, andstill successfully gain entry when back inrange. An attacker without that rollingcode algorithm cannot; there is no way
to predict the next code without it.
In the case of the captured signal
but unsuccessful unlock, the attacker
has just one shot and it must be used
before the key fob is successfully usedagain.
The Legalities
Before you conduct any test, gain
permission. Using equipment otherthan the manufacturer’s specified items
to gain remote entry into a vehicle
without authorization is illegal, andcould constitute breaking and entering,attempted larceny, or grand theft auto.
These crimes are serious, and you must
do your due diligence as the first step
every time. If you choose to quibble on
this matter, do it on your own time; thewarning stands.
The Risks
Any test done with equipment otherthan the manufacturer’s specified items
UNREDACTED MAGAZINE / Q1 2023

to gain remote entry into a vehicle
carries a risk of system or equipment
damage. While most wireless tests witha vehicle remote entry system will at
worst deny you entry, some tests will
trigger fail safes or uncover some otherpreviously unknown result. We’ll see
this happen as a result of one of theupcoming tests. Be prepared to visit
a mechanic if your tests result in some
sort of system failure.
The Tools
We used a HackRF One with thePortapack configuration and a Flipper
Zero. Both are software defined radioswith very different capabilities, but
appropriate for the task of capturing RF
signals and replaying them. Researching
the right signal to capture based on thetarget vehicle starts at the FCC but can
expand out with simple search engine
terms.
The Targets
We tested a 2012 Toyota Tacomaand 2016 Volkswagen Jetta. For safety
reasons, the vehicle VINs and specificmodel details will be left out.
The Operation
Conducting the test required some
homework. If the vehicle make, model,
and year are known, the FCC ID of the
key fobs can be researched to find thecorrect transmit frequency. The sameis possible if in possession of the key
fob itself. It is likely that information
stored by the FCC for one vehicle ofa certain model year is identical acrossall vehicles of that model year. Whentyping into our search engine “Toyota
2102 key fob frequency” we got
the first hit as https://www.sigidwiki.
com/wiki/Toyota_Car_Key. We learn
it is either 315 MHz or 433 MHz.
Adding “Tacoma” to the search got
us to several sites which were selling
replacement key fobs, and listing the
FCC ID. The FCC will allow a search
via the website listed in our tools, butmust be split between Grantee Codeand Product Code. For 2012 Tacoma
key fobs, the fields will be GQ4 andthe remaining characters, respectively.
The process for the Volkswagen Jetta,

and any other vehicle key fob, will besimilar. The results indicate 315 MHz forboth upper and lower range for the keyfob.
In our test, we had possession of the
key fobs, but knowing which frequency
to capture, we can perform the test
without possession if an individual
activates the key fob within capture
range of our tools. For the HackRF One,
we received a signal from the Toyota
and Volkswagen key fobs as far away
as 30 meters using a stock telescopic
aerial antenna, but conditions will vary.
The Flipper Zero captured the key fob
signal for the Toyota as far as 6 meters,
and 8 meters for the Volkswagen. Again,
conditions will vary, and these results
are based on our specific environment,
which was outdoors with clear line ofsite. Having the fob only a few inches
away from the capture tool is best. Yes,
you’re already scheming to never leave
your keys lying around at the gym or aparty anymore. Good on you.
Replaying the captured unlock signal
is simple enough, but success depends
on certain conditions being met. As
mentioned, rolling codes inherent inmodern key fob operations prohibit
direct reuse of captured signals. This
being the case, if the unlock signal
is captured by both the vehicle andthe capturing device, the vehicle will
unlock, thus rendering that particularsignal invalid for replay. A successful
capture must be done out of receive
range of the vehicle.
Achieving this, unlock was successful
via replayed key fob unlock signals fromboth the HackRF One and the Flipper
Zero for the 2012 Toyota Tacoma.
The 2016 Volkswagen Jetta did notallow such shenanigans. Upon receiptof the replayed unlock signal fromthe first device, the HackRF One, thevehicle’s remote entry system ceased
normal operation and prohibited any
subsequent remote entry via wirelesssignal, including from the original
manufacturer key fob. While researchis ongoing, it’s assumed that this isa failsafe feature implemented after
several replay attacks were successful
against older Volkswagen models.
Dealer repair costs to reset the remote

WIRELESS SECURITY: VEHICLE REMOTE ENTRY ATTACK AND DEFENSE

entry system can total between
200.00 and 300.00 USD. Of note,
this model Jetta allows ignition via
proximity detection of the key fob, thus
keyless/push-button. This feature still
functioned normally after failure of theremote entry replay attack.
Lessons Learned
The three biggest takeaways are:1.

The closer you are to the key fob
for capture, the better the capture
will be2.

Proper research is necessary to
determine the correct target
frequency

3.

More recent vehicles can have
replay attack countermeasures

Specifically for number three, weviewed this less as a failure to gain
entry and more as a successful denialof service attack. Disabling remoteentry is at best a nuisance and at worst
a safety risk if quick entry is necessary.
Keep this in mind if your remote entry
fails--have a physical key at hand to
manually unlock your door.
Defenses Against Replay Attacks
The most obvious deterrent is
keeping your key fob in your possession
at all times. If this isn’t possible, avoid
keeping valuables in the vehicle. Utilize
a Faraday bag while storing your key
fob inside your residence or workplace.
These are the simplest and least costly
solutions. Ask your dealer about
remote entry system upgrades if that isa necessary step. For those of us who
own vehicles lacking remote entry, yourthreats remain slim-jims and busted
windows.
You may have noticed that wirelessdefense is squarely on the shoulders ofthe victim. Security in the RF domain isvery weak and exploitation is difficult if
not impossible to prevent. With somebasic knowledge, though, you cangain the upper hand in preventing thissimple attack.

13

The World’s Only All-in-One
Privacy App

Sudos act as digitalfirewalls to eliminate
data trails.

Call, Text, Email, Browse, Shop and Pay
Privately and Securely

Create digital identities,

or Sudos, for different situations.

Research

TravelHouse Hunting

Jackie Russell

Jackie Russell

Jackie Russell

jackierussell@sudomail.com

jackierussell02@sudomail.com

jackierussell03@sudomail.com

Sign up without an email, phone number or password | MySudo.com/bazzell

Image: Ed Hardie

MALWAREOR MAL-AWARENESS?
By KVKK
The Normalized Forms of Spyware
and Ransomware that go Undetectedby the Standard Cultural Antivirus
1. Whatever Happened to“Spyware”?
Do you remember in the late ‘90s andearly ‘00s, the pioneering days of P2P
file-sharing platforms like Napster andKazaa, when the risk of downloading“spyware” was a common buzz? Sure,viruses and other malware were aroundthen as now, but there was concern
about “spyware” specifically. Within justa decade, we ceased to hear as muchabout “spyware” as such--for the basic
reason that this malware had by thenbecome synonymous with software: an
MALWARE OR MAL-AWARENESS?

accepted part of virtually every “free”
and soon-to-be “essential” service paid
for in the currency of personal data.
People know Facebook and Google arespying on them, but no one, not evenprivacy advocates, now articulate thisfact as “Don’t download/use Facebook
or Gmail because it could containspyware,” let alone “It is spyware.”Google Ngram shows the frequencyof the word “spyware” skyrocketing
between 2000-07, then halving from2007-15 and continuing to drop off into
the present.
More importantly than any technicalreason for the word’s decline is thatit reflects the cultural normalizationof digital spying: it would seem weno longer needed a term to specify
what has become so obviously

abundant. Indeed, in the year 2000,
which etymonline confirms is about
the time that “spyware” first became
widespread, the scale of digitalsurveillance that would soon emerge
was far beyond this word’s originally
narrow scope. Yet, Wikipedia traces
the word’s first occurrence to “1995in a Usenet post that poked fun at
Microsoft’s business model.” How
ironic and prescient, given that spyware
now is part-and-parcel of virtually every
big business model! The definition
given by etymonline, “software used
to obtain covert information about acomputer’s activities by transmitting
data covertly from its hard drive
to another computer,” could now
describe almost all software. By stark
contrast, even though “spyware”

15

would be a much more descriptive
term for some types of “cookies,” thelatter cute moniker has survived andthrived, allowing webpages and appsthat “courteously” ask to spy on us todepict this with JPEGs of chocolatechip cookies, instead of what we mightfind in a culture where privacy is thedefault: the digital equivalent of a
WHMIS biohazard symbol.
Clearly, there’s a point to be madehere about how privacy is not just atechnical battle, but a cultural one, inwhich public relations, branding, andterminology play an equally importantpart. Branding spyware as a “cookie,”
one could say, is a successful virus,
a linguistic virus, the sociocultural
equivalent of malware, aliased as legit.
Regardless of what software does at
a technical, social, or organizational
level, the ultimate measure of whatis ugly gross “mal” versus cuddly
chewy “soft”, is us. Hence begging
the question: What forms of malware
have we already unlearned to flag inour personal security policies, or neverlearned to flag? And what malwares ofthe present, like the “spywares” of thepast, will become the software statusquo of the future? Ransomware, I’llsuggest in section 2, could already be
one.
So, while the infosec battlegroundis usually framed between “malicious”
attackers and “legitimate” defenders,sometimes we all-too-easily forgetthat all of these battles themselves
take place within larger cultural warsof what defines “legitimacy” in the firstplace, and who gets to decide that. The
whole reason why “social engineering”
is a thing at all (in the “malicious”
sense) is because we’re already sociallyengineered. And the most successful
social engineering therefore is what
becomes so normalized as to become
unconscious to us, so that we no longer
even think of it as social engineering,or question its dominance. In thejargon of political philosophy, thisutter domination (to the point of
unconsciousness) is called hegemony.
The banalization of spyware, as
marked by the term’s departurefrom the public discourse, is a prime

16

example of such hegemony, which isfurther illustrated by how even the mostblatant and egregious forms of digitalsurveillance continue to go unmarked in
the public media. Why, even in spite of
the Cambridge Analytica scandal, does
Facebook still even get labeled (i.e.,socially engineered), in and by the media
viruses, as a friendly-neighborhood“social media” platform instead of asa social surveillance, data-theft, and
SaaS (spyware-as-a-service) platform?
Ultimately, it’s because the culture hascontinued to accept its “un-malicious”
PR marketing as such (much in the same
way that FB has recently rebranded
to Meta, to foment forgetfulness andobliviousness). The word “PR” itself isanother example of good society-levelsocial engineering: it’s still called “PR,”not “social engineering.” Software
unmarked by the prefix “mal” may be
no more than the maliciousness we’vebeen conditioned to accept as “soft.”
Controlling the definition of malware
vs. “benevolent” “norm”-ware is itself
part of the infosec battleground.
To illustrate the point, I’ll now tell astory of how software whose effect is
indistinguishable from ransomware
nevertheless passes unflagged by thecultural antivirus.
2. Forced 2FA as a Form ofRansomware: The Case of Google
My story builds on a previous
Unredacted article: Michael Bazzell’s“When 2FA Harms More Than Helps”(Issue 2, Jun. 2022). Bazzell relates thestory of a client who, after having herphone stolen, lost access to all her
accounts because she was following
some typical “good” security advice:
she had a password manager and twofactor authentication. However, thismeant that she no longer knew anyof her passwords (because they were
all stored on her phone) and could nolonger access her 2FA tokenizer. Her
security measures had a critical flaw,
because they utterly depended on her
having access to the physical device. A
bureaucratic rigmarole with her cellularprovider ultimately concluded in her
getting a kiosk clerk to perform forher the equivalent of a SIM swap: thus,
proving that “Any adversary could havedone the same thing in her name.” Inshort, in this situation, “soft” and “mal”
traded places: her own good security
policies backfired into her worst enemy,
and her cell provider’s vulnerability to“malicious” SIM-swap attacks became
her only friend. Bazzell’s key takeaway
is, “Never use 2FA with your true
cellular number.”
But what if she hadn’t been so“lucky”? What if the story had stopped
there, at the kiosk clerk?
Let’s imagine, instead, that when she
lost her phone, she hadn’t enabled
2FA on her accounts; but then, when
she went to access, say, her Google
account, it asked her for a secondary
validation anyway--because Google,
being the “good” security-conscious
watchdog that it is, “protective” of its
assets (including users!), unilaterally
updated its user agreement andsecurity policies to align with “good”
infosec industry practices (which it also
helped define!).
This is basically what happened toa friend of mine, albeit under slightly
different circumstances. Back in 2011,
she had had a YouTube account tohost promotional videos for her small
business. When she closed the businessand cancelled its web domain hostingin 2013, she neglected to shut down
the YouTube account as well, which
was associated with an email accountunder the domain name of her former
business website.
Unfortunately, it wasn’t until years
later that she realized the YouTube
account was still active. Fortunately,
she still remembered her password.
But when she went to log in, YouTube
prompted her for a secondary
validation code, from the now-defunctbusiness email address. (Also, clearly,
my friend was no longer signing in fromthe account’s last-known trusted device
or IP.)She personally had never activated
2FA on the Google account (it seems
inappropriate to say “her” account at
this point). But, because of changes in
the infosec landscape (both at Google
and in general) in the intervening years
UNREDACTED MAGAZINE / Q1 2023

(e.g., the legacy of the 2010 Operation
Aurora hack), as well as Google’s
amalgamation of all its services like
Gmail and YouTube under one general“Google” account circa 2015, Google
by now had unilaterally imposed astricter security policy onto all of its
user accounts. In the intervening years,
Google had probably at some point
notified its users of updates to theiruser agreement, which surely would
have informed her in the boilerplate
legalese that by continuing to use
Google’s services she was agreeing
to such-and-such terms. But as we allknow, no user really “agrees” to suchagreements; and in her case any such
impersonal notification never would
have reached her at the defunct email
address anyway.
The hard lesson that my friend
discovered is that Google provides
no practical recourse to recover youraccount, in this situation or similar.
The Google Help Centre provides anumber of How-Tos (“Tips to complete
account recovery steps”, “accountrecovery,” etc.), but these instructions
address only a very limited number ofsituations, and the hyperlinks ultimately
just send you into a loop, back to thesign-in page.
For example, when you click the “Tryanother way” option for the secondary
validation, then unless you alreadyconfigured your account with a cellnumber to receive a text, there is noother recourse except email. If you go
to the “Can’t sign in to your Google
account” help page, select the issue“You’re having trouble with 2-Step
Verification,” then select the “You can’tsign in to your device or an application,
like Outlook” option, it just leads you
back to more instructions for how to
set up 2FA. When you select “You’rehaving a different issue,” the button
doesn’t even work: it doesn’t evenprovide you any information at all.
Remarkably, even when you go to the“Find out if your Google Account has
been hacked” page, most instructions
just assume you can still access youraccount! Under the “Suspicious
account activity” subheading, there isa bullet for “If this setting was turned
MALWARE OR MAL-AWARENESS?

on or off without your knowledge,”
but it provides hyperlinks only once
again back to the basic “Two-step
verification” info page.
Finally, of course, there isn’t any
readily available Google “customer
service” to speak of. It’s just an endlesslabyrinth of more DIY steps andcommunity forums. In the latter, you’ll
find other users confirming your worst
fears: you’re screwed.
I’m not trying to suggest that
Google’s security policy is necessarily abad practice. Nor am I suggesting myfriend was without fault. Obviously, shemade some key mistakes: when you
open or close any account, you should
also consider its interdependencies.
And it would be a good idea to keep
track of all digital assets you have in thefirst place, so you don’t lose track ofyour digital footprint for years.
Nonetheless, the situation raises animportant point: “good” security is
not always your friend, especially if it’s
imposed on you from without; what’s“good” may not be good for everyone.
One person’s fortress is anotherperson’s prison, because privacy andsecurity are two sides of the same coin:a digital feudal lord grants security inexchange for other insecurities.
In my friend’s case, the effect ofGoogle’s“protection”(corporate
protectionism) was indistinguishable
from a sort of ransomware: Google’sumbrella/governance model of security
had locked her out of her own data. (Bycontrast, in the original Proton Mail,the service at least made clear to youthat if you forgot your password, there
was no recovery option, due to theirprivacy policies.) And of course, shewasn’t alone. When I Googled “Google
is holding my data hostage” I foundmany worse stories of people losing
all of their data to locked accounts,
and having no legal recourse (not even
the FBI). They, too, described this as a“hostage” situation, with one user evencomparing Google to “living in China.”
In the meantime, what happens to
the data? It remains there, indefinitely.
Google owns it, now, but the liability

is still assumed by the user. Because,just imagine, statistically, how many
unrecovered accounts must exist, somesubset of which have expired domains.
And some subset of those accounts
will have weak passwords, or will haveusernames and passwords that match
up to breached account datasets fromsome other service. Once a hacker has
cracked the password, then they would
simply need to either buy the domainname and set up the defunct email
account anew, or otherwise exploit the
Simple Mail Transfer Protocol to redirect
the validation code… In this scenario,
suddenly Google is a storehouse ofdefunct accounts ready to exploit. Butof course, it already was this—it’s justthat the difference between “mal”
and “norm” is a question of trust
and perspective: whom you trust to
protect your data, and which sociallyengineered version of the world you’ll
accept as “norm”-ware. Because
the above vulnerability to users isn’t
the sort of thing you’d find on a bug
bounty list; it’s not a security “flaw,” it’sa security policy. And yet, as my friend’s
case shows, from another perspective
there is indeed a gaping flaw here--interms of security, privacy, and personal
digital asset ownership.
My friend’s last resort has been to file a
DMCA Takedown notice with YouTube:
claiming that her own account isviolating her own copyrighted material.
Ironically, in order to do so, you haveto create a YouTube account, because
you then have to fill a web-form whose
selection options assume that you arecomplaining about another person on
YouTube who copied your own YouTube
videos. So you have to fudge one of the
URL fields and then indicate in a freetext field that your “infringed” work
isn’t, in fact, online. So, the prospects
already aren’t good: this could be a
prolonged and work-intensive task toprove that she is the rightful ownerand, in the end, even if YouTube ends
up taking down the account’s video
content, this still might not technically
prove that she is the rightful owner of
the account itself.

17

SOCIAL LINKS:REVOLUTIONARY AI-DRIVEN OSINT
SOLUTIONS
Sponsored Message

Since 2015, Social Links has operated
at the forefront of the emergent opensource intelligence market. Theiraward-winning products have been thesolutions of choice for law enforcement
agencies around the globe, as well as
many enterprise IT corporations fromthe S&P 500. As pioneers of OSINT
technologies, the company continues
to deliver advanced tools that empowerorganizations across a range of sectors
to significantly streamline workflows
and achieve key goals.
The developer’s products offer
various powerful features, which
national law enforcement agencies
frequently use to harness the potentialof open data, drawing from social
media among other sources. The
AI-driven facial recognition tool
included in the flagship solution SL
Professional enables investigators toderive huge volumes of relevant datafrom a single photo or profile picture.
Such technologies often provide crucial
insights that lead to breakthroughs andthe identification of criminal actors.

SL Professional has also proved to
be an essential tool in cyber security.
Link analysis and digital footprinting
techniques enable security professionals
to find subtle connections which would
slip beneath the radar of conventional
search methods. This facilitates a truly
thorough detailing of cyber perimetersand greatly enhances threat intelligenceprocesses such as penetration testingand incident response.
The sphere of corporate security
likewise benefits tremendously fromSocial Links software. In particular, SL
Professional has been a central tool for
conducting high-quality due diligenceand background checks. For instance,
the bespoke search methods hidden
Facebook friend detection and image
search by geolocation have beenused to great effect in establishingclandestineconnections
betweenorganization employees and external
contractors.
Furthermore, SL Professional can beessential for national security, allowing

SOCIAL LINKS: REVOLUTIONARY AI-DRIVEN OSINT SOLUTIONS

analytical units to successfully monitor
and detect organized groups that posethreats to attendees of public events.
In such cases, features which have been
instrumental are group identification
and Telegram and Discord searchfunctions.
SL Professional is a powerful all-inone OSINT solution for conducting
in-depth investigations across social
media, blockchains, messengers, andthe Dark Web. The solution provides
sophisticated access to over 500 data
sources, 1000+ built-in original searchmethods, plus AI/ML technologies, andhas integrations supported by Maltego,
i2, and Spiderfoot HX.
If you would like to learn more about
how Social Links OSINT tools can helporganizations streamline processes andaccomplish core goals, follow the link
below for a free product demonstration.

BOOK A DEMO

19

AN OSINT PRACTITIONER’SPERSPECTIVE ON PRIVACY, OR, HOW
I LEARNED TO STOP WORRYING ANDEMBRACED OBSCURITY
By Anonymous
For the past twenty years, I’ve been
an “OSINT practitioner” and have usedthose capabilities to support operations
to save lives and put bad guys in jail or in
the dirt. I’ve used OSINT with a varietyof organizations in a variety of settingsand scenarios from intelligenceled academic research, situation
awareness & understanding, strategicplanning, cybersecurity operations,and investigations. Over the years, I’ve
conducted OSINT activities against
hostile nation-state actors, terrorists,
interstate drug traffickers, hacktivists,
estranged spouses, and ordinarycriminals. I certainly acknowledge that
others in the OSINT field are doing
absolutely incredible work by using
their knowledge sets and diverse data
sources.
Open sources have evolved andchanged over the years and thediscipline requires an ability to adapt
to those changes. For instance, social
media sources such as Facebook andTwitter were excellent sources toobtain information on individuals anddevelop situation awareness. Overthe years, those sources have been
increasingly less available throughuser privacy settings and throttling byrequiring payment to extend “reach”.
Likewise, what might have taken hoursof querying in Lexis-Nexus would now
take just seconds in a publicly available
search engine.

20

Any OSINT analyst needs to be awareof how sources worked in the past, how
they currently work, and how thosesources may change in the future, andwith that, how those analysts need tochange their practices. “Change is theconstant” applies to OSINT. An online
tool may be free one day and become alimited or subscription-based the next.
Many OSINT tools are provided freefrom others by their own largess. Those
tools may not be updated or include
bugs/errors.
As an analyst, my ability to get
information on individuals and dig
into their privacy is based on time
available, search/analysis capability andefficiency, and data available. When
I’m doing an investigation, it’s usuallytime sensitive. I could spend numerous
hours chasing dead ends and billing for
those hours. That drives the cost up andmakes for unhappy clients. In the samevein, I need to make sure I’m doing acomplete investigation. Efficiency iskey. Another part of this time factor is
the workload: these investigations havedeadlines. I may have multiple cases towork in a limited amount of time. I’m
not a reddit investigator that has theability to crowdsource the work.
Ethics, legal constraints, and privacy
also play into the investigative process.
I need to be 100% certain of derogatory
material. If it’s up for question, thenit doesn’t help to present a final
conclusion on the case. Even though
I’m digging into someone’s privacy,

personally identifiable information (PII)
protections come into play. On a stateby-state basis, the legal limitations on
private investigations vary. Some states
have some pretty strict requirements
while others are loose. Another factor isensuring that investigations are done ina forensically sound manner. The results
need to be complete and repeatableas some intelligence or investigative
material may wind up in court.
One of the most significant factors
in OSINT analysis is the skillset ofthe analyst. What tools do they haveavailable? How well experienced arethey on the tools and do they use themon a routine basis? How well do they
adapt to changing data sources—are
they familiar with just Facebook or dothey know TikTok as well? Can they
think creatively in doing searches orcollection? Can they stay focused on acase and avoid distractions during thefull course of the investigation and stayin scope? To remain focused, I blockparts of my brain with cyberpunk rave
techno or melodic black metal, buteveryone has their thing. How efficientare those analysts in time management
and use of tools available?
A good example is building sockpuppets. I have built several, but not
kept them up. It’s a lot of work tomaintain them on multiple platforms
and invent activity for them. Some of
the fake person generators out there
help in creating information to build out
the background of these sock puppets,

UNREDACTED MAGAZINE / Q1 2023

but it’s never an airtight process. I
don’t try and catfish with them because
that’s too much work and their legends
aren’t that well built out. Ultimately it
becomes a time spent versus benefits
gained matrix, and I haven’t come up
positive with the types of investigations
I perform.
For those who are privacy-savvy,
none of what I have below will comeas a surprise. “Security throughobscurity” works. As an investigator,
I have Extreme Privacy and the Open
Source Intelligence Techniques books
and have read them. I know what a halfassed PMB looks like. I have a favorite
set of tools and a second set in case
I don’t get the results I need. With all
this being said, I offer the following
set of tips and practices that diminish
a sizable portion of your open source
footprint. Keep in mind, other analysts
and investigators out there are moreskilled than me, have access to more
tools, and have more time. Here aresome privacy tips.

Avoid social media like the plague.
As hard as it might be, try to avoid being
in photos from other family members.
When I’ve run into dead ends on someinvestigations, I’ve “spiraled out” tolook at family members or possibly
known associates. I often start first withthe target’s mother and then work myway across the family tree. At this point
in time, the cons greatly outweigh thepros when it comes to social media use.
I have one social media account that I
use for OSINT collection and that’s it. I
post nothing, just collect.
Counter facial recognition as muchas possible. Most law enforcement
agencies have the capability or accessto the capability for it, but it requires
significant detectable facial features forthe analysis to be effective. Obscuring
or disguising one’s face remains aneffective means of defense. Hats andsunglasses work, are cost effective, anddon’t raise unwarranted attention. Facecoverings have become less ubiquitousin the past year as the pandemic winds
down. In some places, those facecoverings may gain more attention
depending on the environment. If you
walk into a hospital, it’s normal. If you
walk into a bank, it will set the tellers
on alert. You can fool facial recognition
systems with bizarre haircuts and facepaint—best applied if you’re at some
sort of comic convention at least. And,yes, I have used facial recognition in
investigations. I found a subject on aswingers site and found that he wascheating or attempting to cheat on his
wife.
Diversify usernames. One mistakethat is frequently made is re-using thesame username over and over again.
I understand it’s helpful for creating a
sense of consistency among platforms.
For instance, if you’re running a small
business, it makes sense to have thesame handle across Google, Instagram,
and Twitter (or Mastodon if you’vebeen following the news). Each of
those services is owned by a different
provider and some crossover throughshared authentication is possible. For
privacy purposes, have a set of varying

INDUSTRY LEADING TECHNOLOGYAND A 24X7 SOC WORKING FOR YOU
Cyber threats are evolving rapidly. SMBs and Enterprisebusinesses are looking to their Managed Service
Providers to provide them with cybersecurity solutions.
Our managed SOC is highly-skilled in the constantly
evolving threat landscape and will provide absolute
security for you and your clients.

FORTIFY24X7.COM | (800) 989-2647 | INFO@FORTIFY24X7.COM

usernames and related accounts. If
I can’t directly connect a username
to an individual, it’s just a hunch andthat’s the end of it. Likewise, if it’s acommonplace username, it makes
attribution difficult as well.
Embrace “unintentional synthetic
identities”. While conducting an
investigation on someone I alreadyknew to a degree, I found that one
personal information search toolcompiled information together of him,a prior resident of an address, andsomeone with a similar name. That tool
had created an “unintentional synthetic
identity” for him. This was not the firsttime I’d seen such a phenomenon.
From the privacy-focused camp, it
helps to add a level of obscurity andrequires an investigator chasing down
what will likely be dead ends. This
wastes time and introduces inefficiency
into the whole process. A step further
for those constructing their privacy
defense-in-depth
isintentionallyseeding disinformation to amplify thesesynthetic identities.
Embracing cut outs. On a similar note,targeting for friend for demonstration
purposes led to several people thatwere certainly not him, but made forsome good cut outs. I’ve known him
for over twenty years and should easilyfind him with address and people
searches. Instead, I found individuals
with the same or similar name and age,good overlap with former states ofresidence, and even relatives with thesame names. Had I been doing this asa “black box” investigation instead of a“white box” investigation where I knew
what answers I should get; I may nothave known the difference. Without aphotograph, I’d be forced to head backto my original source information andre-evaluate. The rabbit hole and false
positive potential is high.
Mundane SSIDs for Wi-Fi. Consideredoutside of the typical OSINT realm,
but catching on. Any on-the-ground
analyst or investigator looking at anelectronic signature will have access to
a decent Wi-Fi scanner tool and myriad
repositories online. If down to closeaccess at or near a target’s residenceor place of work, wireless signatures
can play a heavy role in confirming ahost of other clues. You may discover a
network broadcasting a target’s nameor something seen in previous hits likeneighbors’ names. Broadcasting a SSID

with an anonymous and bland identifier,like “2S19M2”, helps blend in withall the other residential networks out
there. Also, if you move, change it.
Be careful who you Venmo with.
That information is available and it’svery easy to follow who gives money
to who and possibly for what. Again,using varying usernames helps in
obfuscation. As always, cash and othermore anonymous payment methods
work better.
As OSINT evolves, so do the resultsin the final intelligence product. In
turn, privacy measures must evolve
too. It’s a constant process. Fromthe practitioner’s side, the ability tosuccessfully find useful information
has clear limitations, mostly with thetime and scope of the work, skills andmindset of the analyst, and information
available. Let’s not forget the money
needed to access premium data orhouse the petabytes of free data. As
a privacy-loving would-be target, thebasics work. Stick to the foundations
and take the time to get the lowhanging fruit picked, and something
about a bear and being faster thansomeone else.

Invest in Your Business
Invest in Yourself
An Exclusive Online Community
For Investigative Professionals*Interactive Member Forums*Educational Training & Webinars*Robust Curated OSINT Library* Exclusive Member Discounts

Try Our App

www.investigators-toolbox.com
Join Today As A Member
Use Code UR23 To Save 20%

Cynthia Hetherington- President, Hetherington Group & founder of OSMOSISCON“The Investigator’s Toolbox is an outstanding platform for PI’s created by a PI with
our profession in mind! This is one of those industry standards that will raise the barfor investigators who want to stay informed, communicate with others in the field andhave access to tremendous vendors, education and business building tools.”

HARDENING MEASURESFOR MULTI-FACTOR AUTHENTICATIONS
By André Monteiro
Authentication plays an importantrole in any system nowadays. It verifies
whether someone is in fact who claims
to be. Basic authentication comes in
the form of a password but for sometime now, Multi-Factor Authentication(MFA) has been seen as a standard anda “must have” since it provides extra
protection. MFA can be implemented
and used in many ways like physicaltokens, biometrics, software apps, SMS
and more.
Since not everyone is aware of tokens
or biometrics as a means to perform
MFA, app-based methods are being
adopted as a safer way to authenticate
users instead of SMS’s or phone calls. A
tendency that is growing according toMicrosoft.
Basic MFA functioning relies on OneTime Passwords (OTP). Software apps
like Authy or Microsoft Authenticator
have
implemented
cryptographic

hashing functions such as Hashbased Message Authentication Code(HMAC) to generate OTPs, that usually
are composed by a 6-digit number,computed with a timestamp and asecret key.
In order to use a Multi-Factor
Authentication, three factors must be
considered and two of the three are
required.
Those factors are:a.

Something you know. Thismethod is based on the usage ofa password or passphrase, a PIN
or the answers to secret questions(challenge-response). It involves
verification of something provided
by the user.

b. Something you have. This can bea token device, a smartcard, ane-mail, a cell phone number or asmartphone in combination withan OTP software app. It involves

HARDENING MEASURES FOR MULTI-FACTOR AUTHENTICATIONS

verification of an item that the user
has in their possession.
c.

Something
you
are.
Like
fingerprint,
facialor
voice
recognition, retina or iris scan.
This method involves verificationof characteristics inherent to theindividual.

The subject of MFA has been sufferingchanges in order to become robust over
the years. Malicious actors continue todiscover new ways of compromising
the authentication process as it has
been seen most recently by groups
like Lapsus$ that take advantage of thestate of the fatigue of the users.
Considering the basic functioningof the concept, the following are five
hardening measures that enhance theuse of corporate MFA. The measures
are based on current best practices andrecent forms of exploitation, employedby adversaries today.

23

1. Disable MFA Default
Configuration for text messages
SMS as MFA tends to be widely usedbecause it is easy to configure and only
requires a phone number to receive the
OTP. This out-of-band authenticationis considered the weakest form of
MFA and organizations like NIST and
Microsoft consider it deprecated andhave been increasingly advising toleave aside its usage.
This type of MFA is vulnerable
to SIM Swapping, does not rely inencryption, can be intercepted using
software-defined-radios, FEMTO cells
or SS7 intercept services, is phishable
and can be brute-forced. Changing
the authentication process to physicaltokens, biometrics or software basedapp is highly recommended.
2. Disable Pop-Up Notifications to
Avoid MFA Fatigue Attack (MFA
Bypass)Recently, threat actors, like theLapsus$ group, have begun looking
for ways to compromise what should
be a security enhancing practice likeapp-based authentication. After threat
actors obtaining valid credentials, they
have been successfully compromisingaccounts with spamming/bombing
push notifications by exploiting “MFA
Fatigue”.
“MFA Fatigue” can be seen as asecond factor authentication bypass
and the modus operandi of thethreat actors concerns the overloadof notifications a user receives
during a day to perform logins orapprove different actions. With theoverwhelming volume of notifications,fatigued users try to dispatch whatever
pop-ups are upsetting them and startputting security best practices aside.

due the technology but the humanstate of constant attention in thecontext of the excessive number of
notifications. Fatigued users tend toaccept notifications when they wantto make them disappear, and many
MFA users are not familiar with this
attack due its recent exploitation which
ends in some cases in the approval of
fraudulent notifications.

allowed which consequently reduces
the attack surface. In summary, it
is advised enabling authentication
only for the countries known for daily
work. Authentications from countries
not recognized by the company aslegitimate, should be blocked.

In sum, this type of MFA exploits
the fatigue and human attention. It isadvised to disable pop-up notifications.

Physical tokens and biometricauthentications use FIDO U2F protocol
for authentication. The protocol isdesigned to act as a second factor tostrengthen the username/passwordbased login flows. It uses public-key
encryption, which means that for eachservice used, a new pair of keys is
generated and an unlimited numberof services can be supported, all while
maintaining full separation between
them to preserve privacy.

3. Block User Account After Several
MFA Denials
Nowadays,mostcompromised
accounts
comefromgathering
passwords from data breaches andperforming password stuffing attacks.
Considering people use software appbased or SMS for the MFA, threat actors
may abuse the OTP authentication bybrute-forcing it.
In this sense, it is not common to findsecurity controls by default to restrict
the abuse of OTP authentication.
Whenever possible, every accountshould be configured to be blocked
or to initiate a password recovering
process after a certain number of MFA
denials occur.
App-based MFA is vulnerable tobrute-force, phishing and malware
running in the victim’s device. In thiscontext, configuring a maximum
number of MFA denials should be anecessary rule.
4. Block Access By Location

Since the Covid-19 era, theoverwhelming mobile pop-ups andnotifications have increased consideringthat different business models haveturned to remote work and enabled
Virtual Private Network (VPN) to accessinternal resources.

Foreigner origins not expected
for daily labour should not be used
for authentication. For example,
in a scenario with no restrictions
implemented, a threat actor aftergathering a pair of credentials froma data breach and that bypasses the
MFA using the MFA Fatigue attack,would not have his location as an
obstacle, however distant might be, tosuccessfully compromise the victim’s
account.

With all the considerations declared,
the attack is not particularly effective

Blocking accesses by locationconsistently reduces the authentications

24

5. Configure Physical Token or
Biometric Authentication

The U2F protocol can be used in 3
ways.
a.

Passwordless or tokenless: theuser just needs to unlock the device
using biometrics.

b. For mobile: the user inserts theusername and password and thentouches the registered physicaltoken.
The
communication
between the token and theregistered devices is made via NFC
or bluetooth.
c.

For USB: the user types theusername and password, inserts thephysical token into the computer
and touches the button.

The U2F protocol also guarantees
that the user login is bound to the realsite. In other words, the authentication
will fail on a fake site even if the user
is convinced it was real. In short, theorigin binding mitigates most of theattack surface, including sophisticatedphishing attacks.
For the token usage, this type of MFA
is vulnerable to hardware theft. For thispurpose, it is advised having a second
physical token as backup stored in asafe location.

UNREDACTED MAGAZINE / Q1 2023

GOOGLE ANALYTICS
by tlundgren
In this article, I will explain what
Google Analytics is and how it works,
then I will tell you, and show you, how
to see analytics in action on an Android
device. Finally, I will briefly comment
on why defensive measures are usuallytaken at the network level. The article
will be simple, although you will needsome technical knowledge if you want
to replicate the hands on exercise.
Google Analytics is part of Firebase,a solution Google offers developers tointegrate into their apps analytics, crash
reporting, authentication and manyother features that they would simply
not be able to develop and operate on
their own. It works on Android, iOS,the web, desktop apps and games, ismoderately easy to use and for manyuse cases totally free.
Analytics, the main component
handling telemetry, works by capturing“events”. In the context of an app or a
website, an event could be Bob adding
a new item to his shopping list or Alice
opening a help page. Events can becomplemented with context. Following
the previous examples, the name of theitem Bob added to his list and whether
Alice was a first time or regular visitor
to the website.
Further, Analytics offers the possibility
to attribute all generated data to a
specific user id. How user ids are built
and what they mean is a topic worthy
GOOGLE ANALYTICS

of its own article, but suffice it to sayhere that the id can identify the userof a specific app on a specific device, auser across different apps and different
devices, etc. Analytics also logs someuser attributes automatically whenknown, e.g. age, gender, interests,
language, OS, device model (somerestrictions apply in the case of iOS).
All this information is then sent
regularly to a server, typically owned by
Google, where it can later be analyzed.
Google provides several tools andinterfaces for completing that task.
Now let’s see Analytics in action(note, however, that Google does
not let us see information “captured”
by them automatically, like gender,among other things because this data
is not collected by the app, but rather
is already known by Google). Connect
your phone to your computer andmake sure it is accessible from adb (seeepisode 246 “Android Sanitization”
on IntelTechniques.com if you don’tknow what that means). Open a shellor command prompt window and set
Analytics logging to verbose.
adb shell setprop log.tag.FA
VERBOSEadb shell setprop log.tag.FASVC VERBOSE

Display Analytics logs.
adb logcat -v time -s FA FASVCOpen an app and interact with it. As
you do so, some messages will start
appearing on the screen (if none or justa few, it might be that the app does not
use Google Analytics; try with anotherone). In my case, I opened an app similar
to Ebay’s and loaded My Favorites
page. Among the events generated
by the app were the transition to theFavorites page as well as the displayof an ad. Details included the previous
screen I was in, the ad provider andidentifier, the type of connection I wasusing...
10-28 12:11:11.374 20106 21147 V
FA-SVC : Logging event:origin=auto,name=screen_view(_vs),params=Bundle[{ga_event_origin(_o)=auto,
engagement_time_msec(_et)=1992, ga_previous_class(_pc)=BottomNavigationActivity,
ga_previous_id(_pi)=
3699676308727422989, ga_
screen_class(_sc)=
BottomNavigationActivity,
ga_screen_id(_si)=3699787308727422994,
ga_screen(_sn)=View_Favorite_
Items}]

10-28 12:11:11.522 20106 21147 V
FA-SVC : Logging event:origin=app,name=Impression_Ad_
Bid_Time,params=Bundle[{start_
time=137704413,
result=failure,ga_event_origin(_o)=app, ga_

25

screen_class(_sc)=Bottom
NavigationActivity, ga_screen_id(_si)=3699676308727422989,
request_id=/150868415/App_Topbanner/Wall_Gad,
advertiser=Amazon, connection_
type=wifi, end_time=137704924,
AdUnit=5da46525-b241-463394c9-10d78c22a86d}]

Later, I run a saved search andgot more privacy relevant results.
Notice how the event below includes
the search keywords, my location(coordinates, street name and number,and distance to the vendor of the first
item in the results page), whether the
search returned any results, and whatlooks like the flavor of the algorithm
used to determine the results that weredisplayed to me.
10-28
12:12:36.666(20106): Logging event:

V/FA-SVC

origin=app,name=search,params=Bundle[{
latitude=51.50722, orderBy=
most_relevant,hasResults=true, source=

stored_filters, screenId=111,
experiment=non_shippable_
boost_factor_variant_baseline, ga_event_origin(_o)=app, ga_screen_class(_sc)=SearchWall
Activity, ga_screen_id(_si)=-5842017622675563967,
longitude=-0.1275,
keywords=laptops,
newSearchLocation=221B Baker
Street,London searchId=
a83ab289-17d4-4661-97dd07292ea40ca8, savedSearchId=
9f44a10d-8fff-4274-84af-27cfdb4adb3e,
firstItemDistance=390}]

If you run these tests it is very likelythat you get a lot of messages on thescreen. While there is a lot of clutter, it isalso very likely that the app is recording
most of your interactions with it.
You can restore Analytics logging to
the default values (empty strings) by
simply rebooting your phone. You canfind your current values by running:

MDR | XDR | INCIDENT RESPONSE | PEN TESTINGVCISO | WEB3 & BLOCKCHAIN | MANAGED SIEMHELPDESK | IDENTITY MANAGEMENTDISINFO MANAGEMENT

adb shell getprop log.tag.FA
adb shell getprop log.tag.
FA-SVC

Finally, since I referred to theAndroid sanitization episode of
the IntelTechniques podcast, I will
clarify that the commands provided
by Mr. Bazzell then have no impact
here since they target OS, not app,telemetry. Speaking of OS’s, I don’tknow whether using GrapheneOS
has any effect on Google Analytics:
telemetry functionality is provided bylibraries bundled with the apps weuse, so GrapheneOS would have tooverride stock Android libraries thatprovide functionality to those otherlibraries without impacting acceptable
use cases. That might be the case, but
you should still bear in mind that not
all telemetry solutions are provided by
Google nor depend on Google code. At
any rate, the simplest solution against
telemetry is to prevent the data fromleaving your phone or your network, a
topic which has also been explored in
the IntelTechniques podcast.

REAL-TIME THREAT
DETECTION

REAL-TIME THREATRESPONSEPROTECT YOUR ENTIRENETWORKPEN TESTING AND
VULNERABILITY SCANNING

REDUCE YOUR IT/SECURITYWORKLOAD

AFFORDABLEPRICINGFORTIFY24X7.COM | (800) 989-2647 | INFO@FORTIFY24X7.COM

COOKIES BLOCKED. TO
THE MOON.
Privacy-focused websitesthat sell.

Astropost

Astropost is the official design partner for this issueof UNREDACTED MAGAZINE. Need an ad designed
for the magazine? We’ll help you out!

Image: Dan Dimmock

THE OSINT CORNER
By Jason Edison

Jason instructs live and online open-source intelligence courses for IntelTechniques in addition to working asa cyber-crime detective for a large U.S. police department. Each issue will feature an OSINT tactic from theIntelTechniques online training.
In the investigative and analyticalfields, we often discuss the importanceof context as the keystone intransforming information into
actionable intelligence. Our mission isalmost always one where we want towork towards a small stack of neatlyorganized intelligence versus a large
pile of information. The first sectionof our reports should represent thefindings which respond directly tothe questions posed by our clientsso that they may quickly ingest thekey takeaways without having to dig
through the entire document. This,
however, does not alleviate us of the
responsibility to substantiate thosefindings. This is where proper sourcing
becomes important as a means ofsupporting key findings while notoverwhelming the reader with detail inthe early stages of the report.

28

As someone who not only writes,
but who also reviews intelligencereports regularly, I would like to sharesome general advice as well as somepotential pitfalls in how we source ourinvestigative findings. As always, theseare just my opinions on the matter andkeep in mind that your own mission
and reporting parameters may vary.
I find it most useful to share
recommendations and best practices
in the context of a scenario. In
this case let us look at sourcing
in the context of a due diligence
investigation. A due diligence reporton an individual typically focuses on
locating online sources which expose
personal information which could
damage that individual or associatedentities, such as business interests, atsome point in the future. Issues withsourcing may arise in the researchor documentation phases of theinvestigation.
During a due diligence investigation,
we will be searching for accounts,
identifiers, and references such as
articles and other postings related toour target. These may be personal
data exposures which pose an
exploitation risk at the hands of cybercriminals, a reputational risk due tothird-party postings, or even thetarget’s own social media activity. We
will typically list the most impactful
findings at the beginning of the report,
followed by a profile detailing exposed
personal identifying information. In
reviewing these types of reports there
are two primary issues that I see arise
on a regular basis:
1.

Proper Annotation – Failure
to properly source where theinformation was located
UNREDACTED MAGAZINE / Q1 2023

2.

Diversity of Sources – Gathering
information from a very narrow
type or limited number of online
sources (lack of comprehensive
search)The former issue is verystraightforward: clients and otherthird parties must be able to verify
the accuracy of any findings in our
open-source intelligence reports byreviewing where we pulled the datafrom. The client should not haveto trust our findings, but rather the
documentation should provide aneasy path for them to review or audit
our investigation. Any data pointreferenced in the report should include
an exact URL showing where it was
located on the internet during ourinvestigation. There are many methods
for annotating reports to connect
sources to stipulated findings, butsome of the most common are:Footnotes – This is one of the mostcommon methods of including sourcesin documentation. It has the added
benefits of looking professional
and also being intuitive. URLs andreferences are listed at the bottomof the report pages which keep thenarrative sections clean and easy to
read.
Tables – Tables make for easyorganization and association between
specific identifiers (account, username,etc.) and the sites where they werelocated. This is the most common
method of displaying data where
we need to correlate identifiers withsources. If your report includes ratings,
such as seriousness of data exposure,
you may wish to color code cells andinclude a color key.
Embedded Links – Embedding thelinks in the listed identifier is an option
but is often not ideal because it does
not translate well to printing out hardcopies of the report. There is also an
increased risk that your client may
click on and open links unintentionally,
which could create an operational
security issue or further exposure.

THE OSINT CORNER

Combination – Footnotes can be
included in tabled entries, or the links
to the source may be listed in thetable directly depending on formatting
preferences. Including embedded links
in your tables along with footnotesor full URLs is an option that somechoose. It is wise ensure that any
embedded links are not directing
your client to questionable sites that
could expose them to threats or anadversary.
Appendices – Your report appendix
may include full captures, lists ofsources, or both. Keep in mind thateven if you include sources in yourappendix, you may want to include
them in the profiles portion of yourreport as well for convenience. If
your client has to hunt through theappendix anytime they wish to see
an exact source, they may find thereport cumbersome and frustrating tonavigate.
File Attachments/Supplemental
Documentation – Larger captures of
raw pages, images, or videos may beprovided in a zip file or other archive.
This should be in addition to proper
sourcing in the report and not as a
substitution for proper sourcing. Manyclients will not be interested in digging
though the raw data to find the source
URLs, so we will increase the valueof our report by properly annotating
sources throughout the report.
The second issue with sourcing isless obvious: if you use only a small
number of online sources during the
research phase of the investigation,
your findings have a much higher
chance of being inaccurate and/or non-comprehensive. Let’s say we
did a good job listing the sources
used to locate email addresses,
phone numbers, and aliases for ourtarget, in our due diligence report.
Those sources may increase our“confidence” in the accuracy of ourfindings only if they come from adiverse set of sources. For example,
if every listed source for the target’s
online accounts is Spokeo.com, thatis problematic. People search engines

such as Spokeo do not vet their data,
and they have a very high instance offalse positives in how they associate
people with accounts, locations, andother individuals. If someone hired
you to do an OSINT investigation,and you provide them with whatis essentially a regurgitated reportfrom a single people search site, they
are not getting a good return on
their investment. Failure to search a
broad selection of sources is usuallyindicative of lazy OSINT.
Fortunately, this problem is easy torecognize and remedy when reviewing
your final report prior to submitting
it to your client. Review all sources
pertaining to specific findings andhighlight any which are attributed
to a single online source. Conduct
additional research to hopefully locate
additional, disparate sources for thesame data. For example, if you list a
residential address for your target, but
you have only located it in a people
search engine, such as Spokeo, thenext step should be investigating that
address for any public records whichmight corroborate the ties to yourtarget. Maybe your target paid taxes
on that property, which would likely
be evident when looking at county
records for that tax parcel, or maybe
they used that address when filing for
an LLC or other business license. We
will not always find multiple sources
for each key finding, but we shouldattempt to exhaust a diverse set ofsources whenever possible.
In situations where we dig and dig
but are unable to locate additionalsources, we might consider including
a list of sources that were checked
to show that a comprehensive search
was conducted, despite lack of
substantiating results. For any results
which we cannot further substantiate,
we may want to add a note indicating
a low level of confidence due to it
being from a single source.
The following sample is provided as an
example of very simple sourcing whichmeets the most basic requirements.
There is room for improvement and29some polish, but we are providing the client with 1) a simple and intuitive table of identifiers 2) data points each associatedwith a footnote indicating the information source 3) a diverse set of sources used and 4) a note indicating where theclient can review page captures of the sites listed without having to browse to the live pages. Analysis, such as level ofrisk, may or may not be included in your reports depending on the scope of the engagement. With this simple table as afoundation, we may then use any additional time to locate more data sources or make some aesthetic improvements prior
to submitting our final work product.

Target: Jane Anne Doe
Phone: 555-555-1234

Fastpeoplesearch.com

Risk: Moderate

Targetsdomain.com
LexisNexis
Address: 55 Arcane Ln.,

Fastpeoplesearch.com

Santa Fe, NM

Whitepages.com

Risk: High

PertinentCountryrecords.gov
DOB: 10/12/2001

Fastpeoplesearch.com

Risk: High

LexisNexis
Judyrecords.com
Alias: Ms. Crabapple

Fastpeoplesearch.com

Risk: Low

Imgur.com

Twitter: @randomperson66

Fastpeoplesearch.com

Risk: Moderate

Twitter.com
Targetsdomain.com
Email:
someone@randomdomain.com

Spokeo.com

Risk: Moderate

Hunter.io
LinkedIn.com

30

UNREDACTED MAGAZINE / Q1 2023

New 2023 OSINT Book
Hardcover & Paperback
New & Updated Content
550 Pages @ 8.5 x 11
Our Full OSINT Playbook
Supports Our Free Podcast
Order at IntelTechniques.com

OSINT & Privacy Video Training
100+ Hours of Video Training | Optional OSIP Certification
Register at IntelTechniques.net

Image: Meritt Thomas

PET INTELLIGENCE
By Dennis LawrenceOver half of American households
own a pet. As a result, there is asignificant likelihood that the subjectof an investigation may have a dog
or cat. This seemingly trivial issue
can prove useful when attempting
to locate an individual who may notwant to be found or whose address is
unclear in public records. In addition,
pet ownership details can be misusedby threat actors targeting a victim to
help uncover their personal contact
information for any number of reasons
ranging from stalking to breaching anemail account. Let’s explore this topic
from a few angles:
Social Media
People love posting content about
their pets on social media, and someeven create accounts for them on
platforms like Instagram. This behavior
can unintentionally lead to privacy
exposures and a treasure trove ofintelligence collection opportunities.
Merely referencing a pet’s name can

32

help threat actors create password
cracking scripts to breach a victim’s
email account since pet names
are commonly used to formulate
passwords. In fact, a study released
during May 2022’s National Pet Monthand World Password Day revealed
that one third of US pet owners haveused their pet’s name as part of theirpassword for an online account.
The simple act of posting a dog’s
photo on Facebook can also be
exploited if the resolution of the image
is high enough to where a user can read
the writing on its tag. Not only can pet
tags reveal previously unknown phone
numbers and addresses belonging toan individual, but they can also include
multiple phone numbers listed together
that respectively belong to the owner
and a previously unknown girlfriend
or boyfriend who could be of value in
an investigation. Another uncommon
way to take advantage of this common
oversight is to geolocate an individual’scell phone number seen on the pet tag
using third party services that will ping
the device.

In addition, background images inpet photos can provide insights into
a person’s location or pattern of life.
Street signs, geographic landmarks,
and property photos can be analyzed
to help determine the possible locationof a residence. Images taken inside ahome can be compared with historicalimages of a possible residence
identified on real estate websites.
Reviewing the social media accountsof an individual’s close associates may
also prove beneficial as they may postcontent of the pet during visits or while
dog-sitting due to its owner’s trip to
Mexico for the week.
Lastly, a review of an individual’s“liked” pages on Facebook may
reveal their pet’s veterinarian andpreferred kennel which probably havethe individual’s up-to-date contact
information on file. These offer strongsocial engineering opportunities tothreat actors who can elicit additional
details about a victim via phone calls
at a relatively low risk. In addition,
phishing emails disguised as messages
from an intended victim’s preferred
UNREDACTED MAGAZINE / Q1 2023

animal hospital containing a malicious
attachment labeled as an invoice are
more likely to be opened.
Pet Owner Marketing Lists
Sooner or later, many pet parents end
up on pet owner marketing lists. Theselists are often divided by geographic
location (i.e. state), and have been
compiled using data sources as diverse
as veterinary hospitals and online petfood websites. Why do they matter?
They are filled with contact informationsuch as names, email addresses, andphysical addresses that can sometimes
supplement content found in traditional
data
records
aggregators.
For
example, an investigator may uncovera disposable email address used by anindividual for his dog food subscriptionthat was also used to create a social
media account to harass a public figure
which has direct relevance to theirinvestigation.
Marketing companies like LISTGIANT
and US Data Corporation havecompiled pet owner lists for over 30

million Americans which represents
about 10% of the US population. Even
Experian has joined the pet marketing
data business. Until April 2021, thecredit bureau had a self-service option
for purchasing pet enthusiast mailinglists which have since become restricted
but may still be available to corporateclients.
Microchips and Pet Recovery
Services
It is an increasingly common
practice to implant microchips in pets,
particularly in big cities, as a method ofassigning them a unique identification
number that is difficult to tamper with.
Upon adoption, pet owners often
make a nominal payment to one of ahandful of pet recovery services in the
United States that register both the
pet’s microchip number and owner’s
contact information in a database. This
process helps animal shelters, rescue
groups, and veterinarians identify theowner of a lost pet without a tag by
scanning the animal’s microchip using
a radio frequency identification (RFID)

reader and calling a hotline to help
reach its owner. However, pet recovery
services can be socially engineered
with nothing more than a pet’s name,owner’s name, and the owner’s last
known contact information under the
auspices of the owner seeking to verify
that their details are up to date. Afterall, pet owners are supposed to callthese services every time they move orchange phone numbers to make suretheir information is current.
The human bond with pets can bevery profound and impossible to break.
In an increasingly digital world, these
seemingly innocuous relationships
can leave traces online that can be
exploited by players on both sidesof the law. Anyone with pets should
understand how to manage thedigital risks associated with having afurry friend. Conversely, investigators
seeking to track down a suspect may
benefit from following the digital paw
prints.

Is privacy and security overwhelming?
We can help.
Whether you are ready for a complete

anonymous relocation with a full privacy reboot
or simply need a one-hour call directly withMichael Bazzell, we can eliminate thefrustrations encountered whentrying to be invisible.

IntelTechniques.com

Image: Diana Polekhina

10 MINUTES OF GOOGLEDORKING FOR COVID DOCUMENTS
by Jon Gaines
Well now that we are all hopefully past the height of thepandemic. I thought I’d start to examine the technical debt
left over from this. Now that isn’t to say more won’t beappearing online. That said, let’s look at literally 10 minutesof some basic dorking and what we come up with!

These documents also linked to documents from otherpeople via the recommended sidebar:

First off, I found a lot of people posting their results to
Scribd. I guess for easy access? Maybe they don’t realize that
this information is public? Here are some examples of French
COVID tests and the results I found on Scribd. I must’ve
found around 30 in a second. Note I blurred out a lot of theinformation even though technically it’s public online.

34

UNREDACTED MAGAZINE / Q1 2023

Scribd however wasn’t the only site containing these
documents. As I found Yumpu.com links that also had user’s
COVID papers that they self-published.

Clicking on the link to the UK site prompted me to view
another French COVID test PDF for someone. However, I
noticed it in a directory that hinted at containing other files.
So I removed the filename, hit the URL and discovered a
directory listing:

What was a LITTLE reassuring was the fact that these
French COVID tests only contained, First Name + Last Name,
Date of Birth, Address and Phone Number. All of which aredefinitely sensitive, especially in countries where GDPR is ineffect however that was the extent.
That said, I immediately noted the “2ddocNeg” within
the Document titles. That led me to do some dorking forpossible directories containing troves of these documents.
Using a simple dork like: “2ddocneg” intitle:Index Of
came back with 0 results. Which was disappointing but also agood sign. That said, don’t let looks deceive you. I then useda different dork: “2ddocneg” inurl:uploads, which led toGoogle responding with two results, one link to Scribd and
one to a UK site.

10 MINUTES OF GOOGLE DORKING FOR COVID DOCUMENTS

Definitely not good… But it’s just COVID test results….
right? There were a lot of files, so I didn’t click each one.
However, I did see files like this:35

As well as some classic French COVID tests like the ones
shown above and then this:Which if you can’t see, contains First + Last Name, DOB,
Address, PASSPORT NUMBER, sometimes Social Security
Number and more! Needless to say, I stopped there andhave reached out to the organization in question to tellthem about their data leak. Remember this was all found inunder 10 minutes. As of the writing of this article, the leakhas been sealed! The organization is no longer leaking thisinformation.

Are Trusts and LLCs overwhelming?
We can help.
We believe all large assets should be titled to a Trust or
LLC for privacy protection. Doing this correctly
requires a lot of experience. We make sure
your homes, vehicles, and any otherassets which require titling stayout of your name. Contact us toreserve a consultation.
IntelTechniques.com

SUPERMARKET LOYALTYCARD PRIVACY STRATEGY
By: the privacy pirate
A new supermarket opened near
my home recently and was actively
seeking new members for their rewards
program. I normally don’t sign up formarketing campaigns of any kind,
however, when grocery stores offer
cash savings for scanning a rewardcard, I’m willing play the game. I’m justnot interested in providing any of mypersonal information in the process.
The store was opening new accounts
onsite by scanning customer driver’s
licenses into their database and issuing
new cards ready for immediate use. I
asked for a paper application and wasinstead asked for my driver’s license
and told “it only takes a minute”. Since
it was my privacy I was worried about
and not my time, I declined. Instead,I printed a rewards card applicationfrom the store website when I returned
home and completed it at my leisure.
The form asked me to provide mydate of birth, home address, phone
number, driver’s license number andstate issued, number of people in myhousehold and their names and email
addresses; none of which I answered
truthfully. The application also statedthat a “driver’s license verification isrequired to prevent program abuse.”
I typically avoid any activity thatrequests identification to participate,but in the rare event that I do, I

minimize the potential risk as much as
possible. In this scenario, since there
was a good possibility that my ID would
be requested, I entered an altered andmisspelled version of my first and last
name. I gave a date of birth that wasclose but not quite right, a physicaladdress of a relative with the same
last name in a faraway state, but themailing address of my local post officebox. I checked the box for “Seasonal
Resident” and provided a new Sudo
email address and a fictitious phone
number. I left the number of people
in the household blank, but added
a completely different name for my“partner”, as IDs are not checked for
additional card holders.
When I returned to the store, I
approached the customer service
counter and told the clerk I wasinterested in getting a new rewards
card. As she started to ask for mydriver’s license, I said “here is mycompleted application” and handed
her the rather lengthy document that
she would need to enter manually. I
knew this would keep her occupied
while I tackled the issue of showing my
ID. While she was busy entering all of
my incorrect information, I explainedthat I forgot my wallet in the car andwould be right back. I walked outside
and waited for a minute or two, thenreturned to the customer service desk
where the clerk was finishing up. I
displayed my passport book, NOTSUPERMARKET LOYALTY CARD PRIVACY STRATEGY

my driver’s license, but kept it at a
distance and didn’t hand it over. As
the line behind me grew longer, theclerk had no interest in prolonging thetransaction any longer than necessary,
quickly glanced at the ID that waspresented to her, and my new rewards
card with fabricated information was
issued and ready to use.
In this example, even though adriver’s license scan was “required”
for verification and faster processing of
the discount card, doing so would havecompromised my privacy. Completingthe paper application allowed me
to input lots of misinformation into
their database, which all needed tobe manually entered by the customer
service clerk. The act of “forgetting”
my wallet added another element ofannoyance to the task and the extra data
entry took the focus away from showing
my driver’s license. I took a calculated
guess that the clerk would not botherto compare the true information on
my passport, a credential likely notviewed very often in her position, withthe altered name and date of birthon my application. If challenged for adriver’s license, however, my responseis always the same: “I travel frequently
and choose to use my passport for
identification. I can board a plane andenter any country in the world that
credential.” That statement usuallygets the job done.

37

CHANGING YOUR IMEI FORCELLULAR ANONYMITY
By SRLabs
Being anonymous in mobile networks
is hard as mobile network operators cantrack users through multiple identifiers.
Even users that often change their
SIM cards can still be tracked throughtheir device identifier, the International
Mobile Equipment Identity (IMEI).
Therefore, we suggest to change the
IMEI each time the SIM card changes.
We implement and verify our approach
for a “portable 4G LTE privacy router”
called Mudi.
We discovered that Mudi’s privacy
promises can be undermined bytracking at Wi-Fi and cellular protocol
levels. In addition, the device storesMedia Access Control (MAC) addressesof connected devices, which may
facilitate forensic analysis.
To address both, we randomize IMEI,
Basic Service Set Identifier (BSSID),

and MAC addresses and wipe logs. We
provide an OpenWRT package *bluemerle* that implements the proposed
measures and publish source code anddocumentation(https://github.com/
srlabs/blue-merle).
Privacy threat assessment  
The Mudi router comes with abuilt-in Virtual Private Network (VPN)
and onion routing (Tor) capabilities,
promising anonymity online. However,
the anonymity promises do not extend
to the Wi-Fi and cellular protocol levels.
In addition, the device stores MAC
addresses of connected devices, which
may facilitate forensic analysis. Thispermits two tracking scenarios:
1.

Tracking of the user’s activity, thedevice’s location, and, in somecases, the identification of thepurchaser is possible through the
IMEI.

The simplest method of mobilenetwork tracking is based on theInternational
MobileSubscriber
Identity (IMSI), which uniquely identifies
a subscriber by their SIM card. This
tracking threat can be mitigated byregularly changing SIM cards. However,each mobile device has a unique IMEI,
which is persistent across SIM changes.
It is a common misconception thatchanging the SIM card – ideally to
one that is not registered – results
in a completely new mobile identity,
dropping all traceability. In fact, a userchanging SIM cards would only change
their subscriber identity in the eyesof their mobile network. If the device
remains the same, both identities canbe linked through the IMEI. By changing
the SIM, and therefore, the IMSI, a user
can obtain a new subscriber identity. Bychanging the IMEI, a device can obtaina new identity.

Figure 1: IMEI and IMSI change scenarios and linkability.

38

UNREDACTED MAGAZINE / Q1 2023

Figure 1 illustrates how IMSI and IMEI
identifiers can be linked if not changed
simultaneously. Only by changing IMEI
and IMSI at the same time, the user canshake off the traces accumulated by
the old subscriber- and device-based
identities.
A device might even be traceable
to a specific purchase, allowing
identification of the purchaser.
2.

MAC address and BSSID enable
Wi-Fi-based location tracking.

The BSSID is an identifier associatedwith a specific WLAN access point,
included in all wireless packets whichcorrelates the access point to theassociated clients. By convention, an
access point’s MAC address is used as
the ID of a Basic Service Set (BSS).
BSSIDs are constantly transmitted
by the Mudi router when it is offeringa Wi-Fi network. By passively collecting
BSSIDs, device identifiers can bemapped to locations. Mobile routers
thereby also observe the MAC
addresses of connected devices,each of which could be uniquely
identifying a user. In case of loss, theftor confiscation, this data collection may
prove detrimental to the users’ privacy
interests. Additionally,theMAC
address can be collected by passiveintercept. Therefore, the unique andstatic MAC address is in itself a risk for
activity and location tracking.
Necessary features to mitigate thesethreats  
To address the previous presented
threats, one would need three
additional features.
IMEI randomization
An IMEI change should be conductedupon every SIM card change toprovide a new device identity.  TheMudi router’s IMEI can be changed byissuing Quectel LTE series-standard AT

commands. This command allows for
two approaches to IMEI generation.
The first method we implemented
deterministically seeds the new IMEIwith the SIM card’s IMSI, while thesecond generates a random IMEI. To
minimize the risk of an IMEI change,
three things should be considered:
Multiple IMEI changes
Multiple IMEI changes increase
the likelihood of alerting an ISP of
suspicious behavior. Therefore, the
IMEI should only be randomized when
also the SIM card is changed.
IMEI randomization
Ideally the generation process would
only allow for IMEI randomization whena SIM change takes place and would
associate a single, randomly generated
IMEI to that SIM card. However, thiswould require the new IMEI to be
stored within the device. Therefore, the
IMEI should be deleted from the routerwhen the SIM card is removed.
Old IMEI leakage
To ensure that there is no leakage ofthe old IMEI after rebooting the device,
the radio is switched off in advance. Thisdisrupts the device’s connection withthe mobile network during the time the
IMEI is changed, and the connection is
only reestablished once the device isrebooted.

BSSIDs of Wi-Fi clients such as mobile
phones. This can be addressed byrandomizing the MAC address on eachboot. In this way, the device cannot belinked to past activities, whereabouts,
and Wi-Fi connections.
MAC address log wiper
To prevent the risk that third parties
with remote or physical access canenumerate the devices that haveconnected to the mobile router, all
MAC addresses stored on the device
should be wiped at each boot.
We have implemented an OpenWRT
software package called *blue-merle*
which takes all our considerations
into account. A pre-built package, thesource code and further documentation
can be found at https://github.com/
srlabs/blue-merle. We look forward
to contributions from the community.
We welcome pull requests to support
other devices using the Quectel EP06E/A baseband, or other basebands
that allow changing the IMEI. We havenot tested *blue-merle* on devices
other than the Mudi mobile router. In
principle, our approach can be adapted
to other devices. Please keep in mind
that the anonymity highly depends on
the SIM card used which also depends
on local laws and the possibility
to obtain an anonymous SIM card.
Furthermore, this is a research project
without any warranty.

BSSID and MAC randomization
Since BSSIDs are another caseof personally identifiable data, theprotection of which can be eluded incertain legislative settings, randomizing
it serves as a privacy measure.
To remove this uniquely identifying
artifact, the BSSID should be
randomized
regularly.
This
also
minimizes the risks of the BSSID being
used to geolocate the user via open
databases and the leakage of SSIDs andCHANGING YOUR IMEI FOR CELLULAR ANONYMITY

39

SIGN OUT OF APPLE
By NSDestr0yer
A big problem with many mobile
apps is that they require you to log
in via one of the abominable social
media sites such as Facebook, Twitteror Snapchat. This is commonly referred
to as Single Sign-On (SSO) where foryour convenience, you don’t need toremember additional passwords otherthan the one you use for a popularsocial media account. When you use
SSO, those social media companies
generate an access token that your app
can use to verify you. That means theapp has access to your token, and thecompany developing the app can often
use that token for nefarious purposes.
An example is when Facebook SSO
provides the token to a mobile app
and on the back-end the app uses it todownload all of your Facebook photos
without your knowledge. While this has
been changed so that the user has toconsent to photo access, there’s stillother profile information and meta datathat an app developer can harvest via
your token. It’s up to the developer of
the app to respect your privacy and use
the token responsibly. We know privacy
is always top priority for the various
executives and tycoons alike.
Apple attempted to fix the problem
by introducing its own sign inmechanism that developers could use- Sign in with Apple. How it works isthat you log in via your Apple accountcredentials and the app receives asimilar token that it can validate on
Apple’s side with minimal information40

about you. That way, you don’t have toassociate a social media account withthe app or risk having it harvest a large
amount of social media data about you.
Some parts of this alternative soundpromising but there’s a big caveat. You
need iCloud to use this service. Apple
states “To use Sign in with Apple, youneed to use two-factor authentication
and be signed in to iCloud with that
Apple ID on your Apple device”. I’m(fortunately) not an engineer at Apple
but I know that tokens have been
exchanged and validated in various
forms for decades without requiring“the cloud”.
Interestingly, Apple’s developer
guidelines state that if apps use SSO
from a third party such as Facebook,they must also offer the Apple SSO.
Apple assures us this is in no way aboutmaintaining a monopoly position but
is for your safety and security. You may
also be surprised to learn that somedevelopers have tried to fake the Apple
button with their own sign-in methods.
Apple’s review process attempts tokeep those developers at bay, making
sure they use the real button.
Here’s my problem with theirimplementation. As soon as you areforced to enable iCloud on your device,
it immediately starts syncing your data
to the cloud. You can turn that off, but
can you turn it off so quickly that noneof your data makes it to the cloud?
For the data that does, is it already
replicating across multiple redundancy
servers? Does a delete truly destroy

the data? This seems like a strange
trade-off. Instead of an app using yourFacebook token to pull social media
data about you, all of your device data
is uploaded to the cloud.
One might think Apple’s cloud may
be more secure (ha), but we’ve seen
many cases of iCloud breaches in thenews, especially when the celebrities
get breached. Apple had in fact
planned end-to-end encryption for the
cloud, but then backed off. Only some
information is end-to-end encryptedsuch as health data, but the majority isnot.
This auto-enabling and syncing ofdata is an inherently larger problem withApple and it starts right from when you
set up your phone or download yourfirst app. Their prompts entice you to
use their services, making the cancel or“no thanks” button very small, and it’soften not clear what you are agreeingto.
For example, when you download
an app from the app store, you arepresented with a dialog to log in.
Most people I’ve talked to think thisis a prompt only to verify that one
download. They do not understand that
this has logged them in persistently
and globally on their device up until
they manually log out. Every action you
do from that point onward is associatedwith that logged-in account. If you’refeeling unconcerned by this, note thetitle to a previous podcast by MichaelBazzell - “The Creepy things Apple
Knows About You”.

UNREDACTED MAGAZINE / Q1 2023

So we’re back to the same problem.
Can I download an app and sign out
right after, so quickly that no bits ofpersonal data have a chance to escape
my device? One solution is to use an
anonymous iTunes account and notuse any apps that mandate this typeof sign-on. However, I feel that Apple’s
SSO checks both the “has potential”
and “needs improvement” boxes.
For one, Apple’s SSO offers the ability
to mask your email. They have a private
relay service that creates a unique andrandom address that forwards to yourreal email. That way, you can give theapp a masked one. The app developer
does get an option to know if theunderlying email is verified – that is,whether Apple verified the email ornot. But we don’t know how they verify
it and developers have to proactively
implement this extra feature.
Another potential is that the service
has some basic on-device machinelearning capabilities to detect Apple
spam accounts. This could be good formost of us when it comes to deterring

fraud. In a more detailed document,
Apple states “Apple determines
whether a user is a real personby combining on-device machinelearning, account history, and hardware
attestation using privacy-preserving
mechanisms”.
First off, what constitutes a real
person? And does Apple have a listof them in their data center? In a
perfect world, this hardware attestation
would keep spammers out (preferably
sending them to another planet). Again
however, only if apps choose to canthey use this feature to ensure theaccount is authentic.
In my experience, apps usually
implement the bare minimum toget a feature working. When project
managers are presented with rollingout an optional method, it almost
always gets put in the “when we havemore time” parking lot, which is infact not a parking lot but a cemetery.
And even if apps implement thisfeature, it’s hardly reliable as there are
all but three options returned fromApple: “Likely Real”, “Unknown” and“Unsupported”. Would a spammer be
unknown or unsupported? Or a “Likely
Real” spammer? It beats me.
I thought I’d never say this but
Google’s account attestation is moreseasoned. Android offers a full range ofservices, such as SafetyNet. But without
getting into a comparison of each OS,
I’ll say there are some well-meant
initiatives by both sides to provide theuser with security and privacy. Now
we just have to figure out a way to get
the developers and companies to use
them. Maybe we can do that if we push
our privacy to the limits, only support
companies that put privacy first, andApple, if you’re listening, make it sousers don’t have to sync their data
just to use a more secure version ofsigning in.

A FACE WITH NO FACE.
Complete brand identities.
For businesses that respectprivacy.

AstropostImage: Ludovic Migneault

READER Q&A
By Michael Bazzell

Q: If I share a Mac with one otheruser, so two user accounts, and I use
Little Snitch to block Apple Telemetry,does that block it for both users or
only for me and not the other user?
Also, if I add a firmware password
will that apply to the other user as
well?
A: Little Snitch runs on the network
level for all users. While you could
eliminate the application from within asecond profile, I assume your primary
profile will still receive connection
notifications if both are logged in.
I would avoid this. I would set up
Little Snitch identically on both user
accounts with identical rules. Firmware
passwords apply to the machine, andnot specific users. You would only set
that once.

42

Q: In the past, MB has mentioned
using the Mint Mobile app toactivate SIM cards. Would there be
any advantages or disadvantages toactivating Mint SIM cards using theirwebsite?
A: I have explained how one could use
the customer service chat on their site,or call them via telephone, to activate a
new account. All are acceptable.
Q: Mr. Bazzell, why do you install
multiple versions of Firefox when
Firefox can already run simultaneous
profiles with the --no-remote option.
Is there a benefit to using slightly
different code? Or, perhaps you wantto organically “spoof” the browser
header?

A: I prefer multiple Firefox browsers
for two reasons: isolation andsimultaneous usage. When I have
two isolated Firefox instances, I canmake changes to the browser icon
or appearance to immediately know
which version I am in. I want them toappear visually different. Since I heavily
modify my daily Firefox browser withvarious global settings, I want anothercopy of Firefox untouched. Sometimes
I tweak things to the point of breaking.
Having an untouched Firefox helps me
always have a “clean” browser without
restrictions. Often switching profiles is
not enough for me.
Q: Are there any options toexport Firefox settings including
about:config to some file?

UNREDACTED MAGAZINE / Q1 2023

A: Yes. You can save the “prefs.js”
file within your Firefox profile. It should
contain all modifications, including
settings and extensions. If you createa Firefox profile exactly as desired andexport that file, you should be able
to import the file into a new build to
replicate the modifications.
Q: I’ve found that the worst dataleak of our home address is voter
registration data. While we are taking
steps on our privacy journey, we havea way to go. We rent an apartment so
it’s hard to conceal much of our info
it seems, and the hardest yet is ouraddress tied to our voter registration.
Various people search sites havepopped up that return addresses
based on voter registration data. Not
to mention, if you go to the Board ofElections page for our county, you
can search by name and find anyone’s
address (try searching Smith, forexample, in Summit County, Ohio https://lookup.boe.ohio.gov/vtrapp/
summit/vtrlookup.aspx). Is there a
way to be registered to vote without
having your real home address
divulged?
A: PMB nomads can register at their
PMB address for national elections if
desired. I would contact the appropriate
office and tell them you are moving andcurrently using a local PO/PMB/CMRA
address until you buy a new house.
Q: You mentioned that Stealer logs
are becoming more prevalent. You
also mention that you are gathering
more Stealer logs to conduct yourinvestigations.
What
operatingsystems do you believe is being
adversely affected the most bystealer log malware? Is it primarily
Windows systems that are being
infected with this malicious malware
or are you also seeing stealer logs
from Linux systems as well?

A: I always have a backup YubiKey.
When I attach my primary YubiKey toa service, I then add a second device
and also connect my backup YubiKey
for that service. They are not identical,
but either can be used. They will eachhave a unique challenge and response.

of those shows if a client pursues theopportunity.

Q: I am still not ready to be aGrapheneOS user and therefore
trying to be as private as possible
on my iPhone. I tried following the
instructions on the latest editionof Extreme Privacy and installed
ProtonVPN and setup NextDNS
on my iPhone. However, for somereason, I cannot get them to work
together. If ProtonVPN is connected,
NextDNS is not being used. As soon
as I disconnect ProtonVPN, NextDNS
becomes active again. I tried looking
for an option to use custom DNS,
but iOS ProtonVPN app does nothave that feature. Do you have aworkaround for using ProtonVPN
with NextDNS on an iPhone?

A: I like work trucks and base-model
vehicles, but even those are not
perfect. The big things I stay away fromare embedded cellular connections andany type of assistant, such as On-Star.
My newer vehicle has neither. Every
year, this becomes more difficult. I used
to avoid wireless tire sensors which eachbroadcast a unique ID, but those seemto be standard in most vehicles now. I
predict there will be a huge market forvehicle privacy modifications soon.

A: I have not used iOS in some time,
but in the past, I changed the VPN
protocol within Proton VPN in order
to allow both to run. However, notethat iOS now sends some Apple data
outside of your VPN anyway.
Q: Any plans to introduce some
type of notification system like emails
for new podcasts/blogs/magazine
uploads?
A: We have one. The feed at https://
inteltechniques.com/blog/feed/will
notify you of all new blog posts,
podcast episodes, and magazine
issues. Subscribe within your favorite
RSS reader. I receive no information
about you, I don’t have to worry
about collecting email addresses, andyou don’t have to worry about yourinformation being abused/leaked/
breached/etc.

A: In my experience, they are 100%
targeting Windows systems.

Q: Can we get more guest episodes
or client success/failure stories?

Q: What happens when your
YubiKey breaks? What do you do?
Is it possible to get two identical
YubiKeys for backup/redundancy?

A: I would like to, but it is hard. My
clients are mostly wanting to stay awayfrom any attention. I never push any
client to come on the show, but somehave volunteered. I am open to more

READER Q&A

Q: What do you look for in a new
car to minimize privacy invasivenessin terms of “features” to stay away
from?

43

UPDATES
By Michael Bazzell

Due to the release of the new OSINT book, I have applied
several updates to the OSINT tools since the last edition. The
current tools can always be accessed at https://inteltechniques.
com/tools/. Below is a summary of a few of the changes.

• Search Engines Tool: Updated several Tor resources.
• Facebook Tool: Fixed issues with date queries.
• Instagram Tool: Added Toolzu.
• LinkedIn Tool: Added post timestamp decipher.
• Images Tool: Added FaceCheck reverse image search andreplaced Google with Google Lens.
• Virtual Currencies Tool: Updated conversion utilities.
• Audio Streams Tool: Removed iframe due to insecure site
access issues.
• API Tool: Added options for domain registration
history.

This magazine serves as a compliment to the podcast, which
can be found at IntelTechniques.com. Below are summaries of theepisodes from last month.
279-Comms Ownership & Open Databases: I discuss true
ownership of our communications including phone numbers,
email addresses, domains, and monikers, and present two OSINT
updates.
280-The Future Of Extreme Privacy: I offer a glimpse into themajor projects we are working on for the next level of Extreme
Privacy.
281-The Obsession Of Extreme Privacy: I revisit some impactsof extreme privacy and security on our mental health when we
become obsessed with the little things, and offer ways I keep myown balance in check.
282-Major OSINT Updates: I offer numerous new OSINT
strategies and their corresponding IntelTechniques tool usage,
plus the latest news and updates.
283-Announcements, Updates, & News: I offer numerous
announcements, updates, and news items related to privacy,
security, & OSINT.
284-Back to Basics: Password Managers: I revisit theimportance of password managers and offer new strategies fordaily usage.
285-Travel Security Revisited: Jason joins me to revisit travel
security protocols.
286-Closing Out 2022: I close out the year and announce theupcoming annual listener questions show.
287-Listener Questions: Our annual listener questions show.

44

UNREDACTED MAGAZINE / Q1 2023

LETTERS
By Michael Bazzell

Your Site Has Been Hacked by info@
ji-gartenkonzepte.de
PLEASE FORWARD THíS EMAíL TO
SOMEONE íN YOUR COMPANY WHO
iS ALLOWED TO MAKE íMPORTANT
DECíSíONS! We have hacked yourwebsíte https://unredactedmagazine.
com and extracted your databases. Our
team has found a vulnerabilíty wíthin
your site that we were able to exploít.
After findíng the vulnerabílity we wereable to get your database credentíals
and extract your entire database andmove the ínformation to an offshore
server. We wíll systematically go
through a series of steps of totally
damagíng your reputation. Fírst yourdatabase wíll be leaked or sold to thehíghest bídder whích they will use
wíth whatever their íntentíons are.
Next if there are e-maíls found theywíll be e-mailed that theír informatíon
has been sold or leaked and your site
https://unredactedmagazine.com was
at fault thusly damaging your reputatíon
and having angry customers/assocíates
wíth whatever angry customers/
assocíates do. We are wíllíng to refrainfrom destroying your site’s reputatíon
for a small fee. The current fee is$3000 ín bitcoíns (BTC). Please send
the bítcoin to the following Bítcoin
address (Make sure to copy and paste):
3KRAmntM9bwp96aTN4QbBZyc3Lt
PLQNYbS
Editor’s note: I wasn’t aware we
had any databases, please let us know
where you post them!
Response to ‘WIFI Geolocation
Concern’ by nonattribution
When I finally read that article amonth or so ago it helped explain amystery that I have been trying to solve.

LETTERSI subscribe to Cox Cable residential
broadband and use a cox-provided
cable modem/router/Wi-Fi AP. Thereis a “CoxWiFi” program where all cox
modems can be used as Wi-Fi accesspoints by all other Cox customers.
But that option can be turned off ineach user’s Cox account. Also, thereis the normal way to turn off the Wi-Fi
networks on the cox-provided modem/
router - in the modem web interface.
However, even if both of these areturned off, the modem continues tobroadcast a “hidden” Wi-Fi SSIDs on
several channels and bands. That is even if you turn off wireless networks
on your cox modem it will still operate
as a Wi-Fi node with a hidden SSID.
The radios seem to be operating as
WPA and WPA2 access points with
WPS turned off. The only way that I
can get the modem to not operate asa Wi-Fi radio is to unplug it. Many Cox
modems have these hidden networks
operating - and you can find them on
Wigle or just by ‘stumbling’ aroundin a Cox coverage area. But I believethat Privacy Mike has provided thereason for their existence. They must
be continually collecting information
about other wireless networks within
range. This could also explain why
most ISP-provided Wi-Fi Access Point
modems all seem to clump on thesame channels even when auto-selectchannel is turned on. I will continue todo research on this, I just wanted tosend a quick note as well as my kudos
to everyone involved in creating themagazine.

database. There’s not much you cando if you ALREADY have a ham radio
license as your name and address are
already public in the database. Thatsaid, the FCC does allow common law
names and PO BOX/CMRA mailingaddresses as you pointed out in yourresponse. There’s also nothing illegal
about having 2 separate Federal
Registration Numbers (FRNs) which
is how one typically identifies unique
individuals on the FCC’s ULS. So if you
already have a ham radio license, theonly way to make yourself private it is
to voluntarily cancel your existing ham
radio license, get a new FRN with acommon law name in an alias and new
mailing address, retake the ham radio
test to get the license in the new name,you’ll have to work with a VE team on
a VEC that is friendly to common law
names - there are some out there but
I won’t publish that here, the VE teamwill accept an affidavit in your real andcommon law name along with ID in yourreal name for the test. There is at least
one individual I know of who goes by
Log Killer (W2LOG) that only has that
common law name and his PO BOX in
the FCC database, there is no otherlink to their real name and/or homeaddress. More info available here:
https://commonlaw.name/fcc.html.

Amateur Radio Privacy by Lucky225,
WA6VPSIn the last issue someone asked
for tips about privacy with the FCC

45

VERIFIABLE CREDENTIALS:
THE KILLER FEATURE OF DECENTRALIZEDIDENTITY
By Dr. Paul Ashley of Anonyome Labs
I’ve been exploring decentralized
identity in Unredacted (Issue 2 andIssue 4) so we can better understandthis new technology that’s giving users
greater control over their personal dataand identity. This issue, I go straight todecentralized identity’s killer feature:verifiable credentials (VCs). Whatmakes VCs the standout? Simple:
VCs are what will make decentralized
identity ubiquitous on the internet in
the next decade.
What are VCs?
VCs are cryptographically protected
andprivacy-respecting
digitaldocuments that convey information
about a user. [1] Trusted identity
providers (called issuers) create these
digital documents. Any physical card or
document that a person can carry (e.g.
in a wallet) could be replaced with adigital VC—think: digital driver license,
digital passport, digital health card,
digital travel visa, or even something as
mundane as a digital gym membershipcard or a digital library card.

Every credential has an identifier and some metadata but, most importantly,
it also has the claims or attributes the issuer is asserting about the holder (user).
The issuer digitally signs the credential so verifiers receiving proofs based on
the credential can confirm any credential information that is asserted plus thecredential’s authenticity.
Decentralized identity-based VCs are designed to be privacy preserving. The
holder (user) maintains absolute control over which elements of their personal
information (contained within the credential) they choose to provide. This is very
different from physical credentials (e.g. a driver license), where the verifier canalways see everything contained within the credential the user presents. Anotherkey benefit of VCs is that the verifier can independently verify them without any
communication with the credential’s issuer, which ensures issuers cannot track
when the holder uses their credentials.
How do VCs work?
You’ll see here the parties involved in VCs, plus the data flow between thoseparties:

The VC process starts on the left with the issuer. An issuer is an entity (e.g.
government or business) that wants to issue VCs. To do that, the issuer must firstregister some specification information on the blockchain (termed the verifiabledata registry). Using the Hyperledger Indy network as an example, the issuer
writes their decentralized identifier (DID), the credential schema [2] (which defines
the elements of the VC), and the credential definition (linking the issuer DID andcredential schema) to the blockchain.
VC Structure46

Once the issuer has registered information on the blockchain, they can create
and issue VCs. It begins with the holder (a user) and issuer forming a DIDComm
connection (e.g. Aries RFC 0160: Connection Protocol). Over that connection
UNREDACTED MAGAZINE / Q1 2023

the issuer sends the VC (e.g. Aries RFC
0036: Issue Credential Protocol 1.0),
which will be stored in the holder’swallet (e.g. Aries RFC 0050: Wallets).
At this point, the holder can present
their information from the VC to service
providers who require it. To do this,the holder establishes a DIDComm
connection to the verifier and transfers
the VC proof presentation (e.g. Aries
RFC 0037: Present Proof Protocol
1.0). The verifier must connect to theblockchain to read the issuer DID (which
includes their public key), credential
definition, and credential schema, sothey can verify the presentation proof.
The
keyprivacy-preserving
capabilities of this process include:• The verifier can determine that thecredential has not been altered andis authentic.
• Verification happens without theverifier communicating with theissuer.
• The holder (user) can select which

information from a credential theypresent to the verifier.
What are AnonCreds?
The AnonCreds or anonymous
credentials specification is based on
the open source verifiable credential
implementation stemming from theHyperledger Indy project. Extensive
use of AnonCreds worldwide has madeit a de facto standard for VCs.
Some important concepts around
AnonCreds make it a very attractive
solution for VCs, such as:• Anonymity—Using unrevealed
identifiers for holder-to-VC binding
prevents correlation based on
those identifiers. [3] This prevents
colluding organizations fromcorrelating user-specific identity
information.
• Revocation—AnonCreds provides
a revocation scheme that proves apresentation is based on credentials
that the issuer has not revoked.

• Reduced PII exposure—An
implementation of zero knowledge
proofs (predicate proofs) helps
eliminate the need to share specific
PII (e.g. holders can prove they areover age 21 without disclosing their
specific birth date).
The current AnonCreds specification
matches the existing Hyperledger IndySDK (“libindy”) and Indy Credential
Exchange (“credx”) implementations,[4] but recently there was a proposal
to make AnonCreds a standalone
Hyperledger project, which will help
it to grow with future enhanced
capabilities.
One key factor to note is the use of
the term proof presentation. This term
describes the holder presenting one ofthree items to the verifier:1.

all of the data in the credential

2.

part of the data in the credential (apartial disclosure)3.

a zero knowledge proof for somedata in their credential.

Extreme Privacy Book
Hardcover & Paperback
New & Updated Content
500 Pages @ 8.5 x 11
Our Full Playbook
Supports Our Free Podcast
Order at IntelTechniques.com

Using ZKPs is a critical aspect ofAnonCreds—that is, it is not the actual
VC that is presented to the verifier, butrather a cryptographically derived proof
that allows the data in the credential
to be presented securely. As such, theuser can keep more of their PII private
while still answering questions such as,“Are you over 21?”, “Do you live in thiscountry?”, or “Do you have a college
degree?”What are W3C VCs?
In addition to AnonCreds, the
World
Wide
Web
Consortium(W3C) has created the Verifiable
Credentials Data Model v1.1. [5] This
W3C recommendation is publishedand being used in government andcommercial applications.
W3C VCs are also open source andprovide the same basic functionality
as AnonCreds—that is, this standard
provides holder, issuer, subject, verifier,and verifiable data registry roles andsupporting functionality. Some of themain target use cases [6] are:• education—transcripts, test taking,transferring schools, online classes• retail—address verification, adult
beverages, fraud detection• finance—Know Your Customer,
money transfer, closing an account,trying a new service, create a bankaccount from home• healthcare—prescriptions,
pharmacy, insurance, traveling48

illnesses, proving legal disability
status• professional credentials—finda doctor, quality training, job
applications• legal identity—driver license,
immigration, air travel, refugee
status• intelligent devices—manufacturing,delivery, autonomous.
The W3C VCs standard also supports
ZKPs, [7] but not all W3C VCs support
being asserted as ZKP responses.
The choice of whether to enable thiscapability is left up to the credential
issuer. In order for a holder to assert
a ZKP response, they must use acredential that has been created toallow for this purpose. Using W3C VCs
for ZKPs requires the issuer to do twothings:1.

Add a proof property to the VC.

2.

Where they use a credential
definition, also define it in thecredential schema property.

[1] This is the most common case. It is also
possible for other scenarios such as the user
issuing a credential related to an organization.
[2] In the future it may be uncommon for
issuers to write their own schemas. Instead astandards body could write the schemas andissuers would only write credential definitions.
[3] This paper by Kaliya Young challenges
the notion of “link secrets” as a viable
alternative to including the credential subject
information. This opinion is in turn refuted bythis paper by Daniel Hardman.
[4] It is also argued in the paper by Kaliya
Young that not having a mature specification
is a weakness not allowing sufficient analysis
by the industry and it also lacks a standard forinteroperability testing.
[5] Verifiable Credentials Data Model v1.1,
World Wide Web Consortium, 3 March 2022,
https://www.w3.org/TR/vc-data-model/[6] Verifiable Credentials Use Cases, World
Wide Web Consortium, 24 September 2019,https://www.w3.org/TR/vc-use-cases/[7] Verifiable Credentials Data Model v1.1,
World Wide Web Consortium, 3 March2022,
https://www.w3.org/TR/vc-datamodel/#zero-knowledge-proofs

So long as those two requirements
are met, W3C VCs can be asserted in azero knowledge fashion, as we covered.
AnonCreds and W3C VCs have a lotof similarities and some key distinctions,but that’s a topic for another issue.
The main point is that both standards
describe great implementations of VCs
and mainstream platforms will be using
both for the foreseeable future.

UNREDACTED MAGAZINE / Q1 2023

PRIVACY-THEMEDPUZZLESPRIVACY-THEMED PUZZLES

49

FINAL THOUGHTS
By Michael Bazzell

I again thank everyone involved in getting this issue published. I also announce yet another release schedule. This issue
felt somewhat rushed, which I blame on the holiday season. I have decided that all future issues of UNREDACTED will be
released based on content, and not a scheduled date. Once we have enough quality content to satisfy an entire issue, wewill release it. Hopefully, that keeps us within the quarterly release schedule (or sooner). However, I am willing to take moretime and publish whenever the issue feels “done”. The pressure is now on you. What will you submit? Will we have a newissue ready to go by April? I look forward to what you create.
MB

AFFILIATE LINKS

If you would like to support this free publication, please consider using the following affiliate links. If you plan to purchaseany of the items below, or other items from the vendor (such as Amazon), the following links provide a small financial
contribution to us without costing you anything extra. We see nothing about you or your order.
Extreme Privacy Book (Amazon): https://amzn.to/3D6aiXp
OSINT Book (Amazon): https://amzn.to/3zoMZpZ

ProtonVPN VPN Service: https://go.getproton.me/aff_c?offer_id=26&aff_id=1519

ProtonMail Encrypted Email: https://go.getproton.me/aff_c?offer_id=7&aff_id=1519

50

UNREDACTED MAGAZINE / Q1 2023

New 2023 OSINT Book
Hardcover & Paperback
New & Updated Content
550 Pages @ 8.5 x 11
Our Full OSINT Playbook
Supports Our Free Podcast
Order at IntelTechniques.com

OSINT & Privacy Video Training
100+ Hours of Video Training | Optional OSIP Certification
Register at IntelTechniques.net