The Story begins...
Greetings, readers! Today you'll see a promised interview with a fascinating individual! Keep in mind that his responses are entirely based on OpSec, (2) ideas.
So there's some background information. I was seeking for a company that recovers data from broken hard drives and cold crypto storage devices such as Ledger/Trezor, and I had made a few posts on well-known clear-net and deep-web forums when I came across an interesting guy with whom I had a conversation.
As is customary, our acquaintance began with a reaction to my unusual nickname (I remind you that this is a joke and a simulacrum; I do not work or have ever worked for any government, nor have I ever worked for comparable entities) and a general curiosity in the Bitcoin business. He offered me some links to some decent manuals that he used and I'll include them as a bonus at the end of the interview.
Imagine the situation: you are an employee of a secret service, and your task is to calculate a particularly dangerous criminal, engaged in blackmail and appearing in the network periodically and only for the transfer of data. For his criminal activity he has a separate laptop from which he "cut out" the microphone, speakers and camera. A sensible decision, given that the speakers can also listen.
He uses Tails as his operating system, although he should have used Whonix for maximum anonymity. Anyway, all the traffic goes via Tor, he doesn't trust VPN or only trusts his VPN and he needs Tor for the DarkWeb "work" anyway.
Today I would like to talk about how to become a good OSINT investigator, but to continue the conversation I would like to make a small disclaimer - I will tell you only some aspects because the topic is very vast and I can not describe everything in one article, however, I will try to show you the way and how to pass this path.
To begin with, I want to say that I will consider OSINT as a set of skills or a mindset, because it can be directly related to doxing, military GEO-INT performed by a security company employee or just media OSINT performed by a VC fund employee in order to find new projects for investment, taking the theory of handshakes as a basis. Or even a crypto-forensics specialist investigating a major Web3.0 hack case. In other words, it can be used in all spheres of life because it is only a method of working with, assessing and ranking information - do not ever forget that we are all living in the Information Era.
| Much thanks vice.com for a mention!
| Here I will tell you exactly how I investigate crypto hacks and security incidents, and describe methodology:
- Usually in blockchain investigation I use tools first for manual analysis such as http://tenderly.co, http://ethtective.com, http://breadcrumbs.app, http://9000.hal.xyz, http://dune.xyz, http://nansen.ai, , http://bloxy.info.
- I seen also a rather unusual method - the use of VR, which will empower the first step: https://ethresear.ch/t/open-source-3d-and-vr-blockchain-visualizations/3297/2
- Second, I try to set clusters to check them through @chainalysis or http://amlbot.com (investigation regime only).
- As a third step, I check contracts/addresses through the impersonator, the http://unrekt.net or http://revoke.cash checker and other tools. As an example, http://tutela.xyz http://github.com/TutelaLabs tool can help in tacking funds behind @TornadoCash
- When investigating an incident, it is also important to conduct a classic OSINT investigation, for example, if we are investigating a hack - it is necessary to check messages from chats, interview employees and eyewitnesses. Sometimes this yields data: www.1337pwn.com/how-to-investigate-cryptocurrency-crimes-using-blockchain-explorers-and-osint-tools/
| This awesome article initially made by MaxWayld, originally: @maxycrypto/solana_tools & then translated, edited by Officer_CIA.
A) Understand that all sorts of blockchain.info, TrustWallet, MetaMask and other wallets are just interfaces.
B) Consider cold wallets, personally I do not trust Ledger or Trezor. There is a hardcore version BitLox Ultimate, which is literally stuffed with security-related features, lets the traffic through Tor, and has several levels of encryption. Or an ascetic cold card which is a good choice for those, who love simple and clear mechanics.
C) Make a cold wallet yourself. For example, from an old smartphone. You can also make a cold wallet with Electrum and let all the traffic through Tor. Know AirGap weak sides.
D) Check what are you signing, if we speak about ETH and similar chains, never use your main cold storage for casual work, but if you have to (for example, sign a gnosis-safe multi-sig transaction), always check if there are no allowance approve (which allows to drain your wallet) or proxy (behind which mentioned function may be hiding). Revoke approvals here.