ninethehacker.xyz Top Eight Opsec Fails

Top Eight Opsec Fails

failing to plan is planning to fail


If for whatever reason you don’t want to be found the best bet is radio silence. However most people just want to talk shit behind people’s backs or pretend to hide for attention. We have to ask ourselves, is a life without social media even worth living? If the police or just someone you’re not a fan of is following you around you’ve probably fucked up one of the following.

Before we get started, please don’t use this info to do terrorism or a crime. If you do, don’t fucking tell me about it, I don’t want to know.

8. not doing any

Let’s be honest, most people aren’t as paranoid as you and I. The problem is, at random, some asshole with too many followers and a coke habit can start yelling random shit and filming their licence plate. I’ve written my MP multiple times letting them know I think it should be legal to shoot people like this. But until they get back to me everyone’s just going to have to take things a little more seriously.

A notable example would be that red shirt guy that had his horny posts on reddit exposed.

9999. posting your crimes

The police are not omnicient or omnipotent. Even though they have offices to watch the net they usually wait for a tipoff to act. This means your cheeky burnout vids on insta are one tip away from earning you police enforced harassment.

If you believe that people are not that petty or wouldn’t mess with the police I advise you to look up “SWATing”, one of the main reasons internet privacy is a worthwhile goal.

-1. a rose by any other name

People are actually really shit at thinking of names. I’m shit at thinking of names but because I’m aware of it I work hard to come up with original ones. OTOH I link them all together by shilling my website on them all, but nobody’s perfect. People are so shit at thinking of names there are actually, multiple, python scripts on github that do an amazing job of turning one handle into all of your handles.

Essentially if you’re thinking of an original nome-de-plume don’t compose it out of bits of your old one. Try this instead: https://www.wutangnamegenerator.net/.

This is particularly important to quarantine leaky apps that tag geolocation data.

8008135. playing battleships

If you think comms are compromised don’t let on by posting about it. Even if you don’t, keeping it private when you think someone is getting close will avoid provoking a reaction or getting yourself in shit if they are.

A notable example of this was the HWNDU pranks, where 4channers managed to geolocate a livestream with a car horn by honking and listening to the stream audio. They demonstrate the huge amount of information that can be exposed in a single stream.

69. the things we do for love

This one is more for the blokes.

There are no girls on the internet. Probably sexist, but words to live by. You’ve gone your whole life without random women approaching you to see your genitals why would they start now? Even if you think your clout warrants it do you really want to be involved with a woman into internet weirdos?

420. clean your fingies

Did you know your camera embeds GPS co-ords into your photos? Probably, which is why this is so low. Most services scrub EXIF metadata, but crucially not all of them do, and most of them archive it first. I personally fuck that shit off with GIMP by opening the file and then clicking File > Overwrite > unticking "Save Exif" > Export. It’s also worthwhile shrinking the image to 1000px wide and compressing the file to under 200kb while you’re at it.

0. don’t shit where you eat

I’m pretty comfortable with people knowing I’m in Melbs, and what country I’m in, I don’t want them to get as close as a postcode. There is no point in my life that I have posted anything about my suburb. You think selfies at the local servo or maccas are fine? How many petrol stations do think are in the average city? The answer is not enough. Probably there’s some dude that named his business after the suburb in the background anyway.

The master of this is probably John McAfee, who on his Carribean escapades posted photographs taken in other countries to throw off investigators. Having said that, as I write this he’s in a Spanish jail so maybe don’t push your luck.

1. the company we keep

Changing a handle is not enough if you remain friends with the same people. Most likely you have a bestie who didn’t also change their handle or go private and your new account is on their friends list. This kind of rudimentary network analyis is probably the place where people mess up the most. It may have turned your dramatic breakdown into looking like a retard. It might have had more dire consequences. If you’re serious about disappearing you have to move your friends onto a private platform, if they won’t join you they probably weren’t your friends.

So that’s the list.

Let me and my readers know if there’s any other OPSEC fails worth mentioning, or you have funny stories of doxing and internet detectivery.


there are no comments yet


all comments are manually reviewed before publication