Skip to content

Commit 94d3b39

Browse files
carlospolopcarlospolop
authored
Merge pull request #2805 from HackTricks-wiki/codex/privacy-digital-world-20260907
Add offensive privacy, attribution-evasion and OPSEC section
2 parents 83868c4 + f270666 commit 94d3b39

22 files changed

Lines changed: 4707 additions & 0 deletions

‎src/SUMMARY.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,30 @@
101101
- [Web3 Signing Workflow Compromise Safe Delegatecall Proxy Takeover](blockchain/blockchain-and-crypto-currencies/web3-signing-workflow-compromise-safe-delegatecall-proxy-takeover.md)
102102
- [Lua Sandbox Escape](generic-methodologies-and-resources/lua/bypass-lua-sandboxes/README.md)
103103

104+
# 🕵️ Privacy
105+
106+
- [Offensive Privacy, Attribution Evasion and OPSEC](privacy/README.md)
107+
- [Anonymous Internet Access Technique Catalog](privacy/anonymous-internet-access-techniques.md)
108+
- [Anonymous Payment Technique Catalog](privacy/anonymous-payment-techniques.md)
109+
- [Capture-Resilient Authorized Field Nodes](privacy/capture-resilient-authorized-field-nodes.md)
110+
- [Offensive Infrastructure and Attribution Evasion](privacy/offensive-infrastructure-and-attribution-evasion.md)
111+
- [Covert Physical and Wireless Access](privacy/covert-physical-wireless-access.md)
112+
- [Government and APT Case Studies](privacy/government-and-apt-case-studies.md)
113+
- [Financial Obfuscation Tradecraft](privacy/financial-obfuscation-tradecraft.md)
114+
- [Attribution, Detection and Countermeasures](privacy/attribution-detection-and-countermeasures.md)
115+
- [Authorized Adversary-Emulation Labs](privacy/authorized-adversary-emulation-labs.md)
116+
- [Threat Modeling and Identity Separation](privacy/threat-modeling-and-identity-separation.md)
117+
- [Network Privacy and Anonymous Connectivity](privacy/network-privacy-and-anonymous-connectivity.md)
118+
- [Advanced Network Privacy Architectures](privacy/advanced-network-privacy-architectures.md)
119+
- [Privacy Operating Systems](privacy/privacy-operating-systems.md)
120+
- [Privacy-Preserving Communications and Sharing](privacy/privacy-preserving-communications-and-sharing.md)
121+
- [Authorized Red-Team Infrastructure](privacy/authorized-red-team-infrastructure.md)
122+
- [Private Digital Payments](privacy/private-digital-payments.md)
123+
- [Cryptocurrency Privacy](privacy/cryptocurrency-privacy.md)
124+
- [Privacy-Preserving Payment Protocols](privacy/privacy-preserving-payment-protocols.md)
125+
- [Reproducible Privacy Testing](privacy/reproducible-privacy-testing.md)
126+
- [Operational Privacy Playbooks](privacy/operational-privacy-playbooks.md)
127+
104128
# 🧙‍♂️ Generic Hacking
105129

106130
- [Archive Extraction Path Traversal](generic-hacking/archive-extraction-path-traversal.md)

‎src/privacy/README.md‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# Offensive Privacy, Attribution Evasion and OPSEC
2+
3+
This section studies privacy from the viewpoint of a red team, an intrusion operator and the defender trying to reconstruct that operator. **Anonymity is not merely hiding an IP address.** Mature operations separate the people, endpoints, accounts, infrastructure, network paths, payloads and payments that could be joined into an attribution graph.
4+
5+
The material deliberately includes techniques reported in government and APT operations: operational-relay-box (ORB) networks, compromised edge devices, residential exits, redirector tiers, fast flux, domain fronting, dead-drop resolvers, nearby wireless pivots, covert drop devices, satellite-link abuse, false personas and financial layering. Each technique is presented as:
6+
7+
1. the operational objective and ATT&CK mapping;
8+
2. the mechanism and trust boundaries;
9+
3. what every observer can still record;
10+
4. the mistakes and stable artifacts that defeat it;
11+
5. defensive telemetry, analytics and mitigations; and
12+
6. an authorized emulation using owned or explicitly scoped infrastructure.
13+
14+
This is therefore both an offensive tradecraft reference and a defender's attribution manual. The aim is to make advanced behavior understandable and testable, not to pretend that one commercial service makes an operator invisible.
15+
16+
**Research cutoff:** 8 September 2026. Provider availability, product behavior, sanctions, cash/prepaid thresholds, SIM-registration rules, and crypto regulation change frequently; verify them again before relying on them.
17+
18+
{% hint style="danger" %}
19+
Understanding a technique is not authorization to perform it. The pages explain criminal abuse such as compromised routers, a neighbor's Wi-Fi, hidden devices, stolen identities and laundering at the mechanism-and-detection level. Reproduction steps use only owned lab systems, synthetic identities and test assets. Never access a third party, evade KYC or sanctions, or conceal criminal proceeds. Unauthorized access is criminalized in many jurisdictions, including under the US CFAA, the UK Computer Misuse Act, and EU member-state laws implementing Directive 2013/40/EU.<sup>[[2]](#references)</sup><sup>[[3]](#references)</sup><sup>[[4]](#references)</sup>
20+
{% endhint %}
21+
22+
## Adversary objective map
23+
24+
| Adversary objective | Technique families | Principal defensive question |
25+
|---|---|---|
26+
| Hide the operator's origin | VPN/Tor, external and multi-hop proxies, residential/mobile exits, ORBs, satellite links | Is the last-hop address an actor asset, an unwitting victim or a short-lived relay? |
27+
| Keep the real C2 undiscoverable | redirectors, CDNs, domain fronting, dead-drop resolvers, dynamic DNS, fast flux | Which stable behavior survives IP/domain rotation? |
28+
| Borrow trust and reputation | compromised servers, routers, cloud and web-service accounts, domain shadowing | Is a reputable asset behaving differently from its historical baseline? |
29+
| Cross a physical or network boundary | nearest-neighbor Wi-Fi pivots, on-site drops, rogue peripherals, cellular backhaul | What new radio, device, switchport or outbound tunnel appeared? |
30+
| Separate the human from the operation | personas, account/device compartmentation, cover communications, procurement separation | Which recovery field, browser, schedule, language, payment or admin event joins the personas? |
31+
| Obscure funding and cash-out | mules/nominees, prepaid value, mixers, CoinJoin, peel chains, chain hopping, OTC brokers | Where do on-chain and off-chain identity records reconnect? |
32+
33+
The closest ATT&CK resource-development and C2 concepts are **Acquire Infrastructure (T1583)**, **Compromise Infrastructure (T1584)**, **Establish/Compromise Accounts (T1585/T1586)**, **Proxy (T1090)**, **Dynamic Resolution (T1568)** and **Web Service (T1102)**.<sup>[[6]](#references)</sup><sup>[[7]](#references)</sup>
34+
35+
## Privacy, pseudonymity, anonymity and security
36+
37+
| Goal | Meaning | Typical failure |
38+
|---|---|---|
39+
| **Confidentiality** | Outsiders cannot read content | Metadata still identifies the parties |
40+
| **Privacy** | Information disclosure is limited to what is necessary | A provider retains more data than expected |
41+
| **Pseudonymity** | Activity uses a stable identity not publicly tied to a legal identity | Recovery email, payment, IP, photo, or writing style links it |
42+
| **Anonymity** | An observer cannot distinguish the actor from a meaningful set of others | Login, fingerprint, timing, location, or transaction correlation shrinks the set |
43+
| **Unlinkability** | Two actions cannot reliably be attributed to the same actor | Reused identifiers, simultaneous activity, or shared infrastructure joins them |
44+
| **Security** | Systems resist compromise | A secure but identified account remains non-anonymous |
45+
46+
These properties are observer-specific. A merchant might not see a card number while the issuer still knows the customer and transaction. A website might see a Tor exit rather than a home IP while an account login identifies the user immediately.
47+
48+
## Start with the observer
49+
50+
Before choosing tools, write down:
51+
52+
1. **Assets:** identity, location, browsing destinations, message contents, social graph, payment details, client name, red-team source infrastructure, or stored evidence.
53+
2. **Observers:** local Wi-Fi operator, ISP/mobile carrier, VPN, Tor entry/exit, DNS resolver, website, ad network, cloud host, payment issuer, merchant, exchange, counterparties, employer, or government.
54+
3. **Correlation handles:** IP address, account/recovery fields, phone number, device identifiers, cookies, browser fingerprint, time zone, payment instrument, shipping address, writing style, transaction graph, physical presence, and cameras.
55+
4. **Capability and time:** passive commercial tracking is different from a targeted observer able to subpoena providers, seize endpoints, or watch both ends of a connection.
56+
5. **Failure cost:** embarrassment, account suspension, client harm, financial loss, physical danger, or legal exposure.
57+
58+
Then select the smallest sustainable controls. A complicated plan that is routinely bypassed is weaker than a simpler plan used consistently.
59+
60+
## Quick decision table
61+
62+
| Need | Sensible starting point | What it does **not** solve |
63+
|---|---|---|
64+
| Hide browsing metadata from an ISP/local network | Reputable VPN or Tor Browser | Accounts, cookies, device fingerprint, endpoint compromise |
65+
| Stronger web anonymity | Tor Browser; Tails for an amnesic session | Global traffic correlation, personal disclosures, physical observation |
66+
| Persistent compartmentalized work | Whonix or Qubes-Whonix; separate qubes/profiles | Hypervisor/host compromise, behavior linking identities |
67+
| Fast authorized red-team egress | Client-provided jump host or engagement-specific VPS/VPN | Provider/customer attribution; scope and cloud policy obligations |
68+
| Reduce merchant exposure of a card number | Issuer virtual card or tokenized wallet | Issuer/network knowledge, shipping, account and device data |
69+
| Minimize point-of-sale payment data | Lawfully obtained cash where accepted | CCTV, receipts, withdrawal trail, cash limits |
70+
| Improve public-chain crypto privacy | Own wallet/node, new addresses, coin control, Tor, supported PayJoin | Exchange/KYC, counterparty records, permanent-chain analysis |
71+
| Default on-chain amount/receiver/sender confidentiality | Monero with separate wallet contexts and network privacy | Acquisition/off-ramp records, endpoint compromise, merchant/shipping data |
72+
73+
## Core rules
74+
75+
- **Separate contexts before activity starts.** Retrofitting separation after accounts, devices, and payments have already been linked rarely undoes the history.
76+
- **Do not customize yourself into uniqueness.** Browser fingerprinting can correlate activity even after cookies are cleared or an IP changes; standard configurations with larger anonymity sets are usually preferable.<sup>[[5]](#references)</sup>
77+
- **Protect the endpoint.** Network anonymity cannot save an unlocked, infected, or seized device.
78+
- **Encrypt content and minimize metadata.** End-to-end encryption protects message content, not necessarily who communicated, when, from where, or with which device.
79+
- **Treat providers as observers.** VPNs, email services, cloud hosts, exchanges, payment issuers, and alias forwarders see different parts of the activity.
80+
- **Prefer verifiable claims.** Look for protocol documentation, reproducible software, public audits, retention details, and transparency reports instead of “military-grade” marketing.
81+
- **Reassess periodically.** Services, laws, threat actors, and defaults change.
82+
83+
## Offensive-first section map
84+
85+
- [Anonymous Internet Access Technique Catalog](anonymous-internet-access-techniques.md) — 48 access-path families with pros, cons, deployment/emulation steps, detection, capture exposure and controller-side discovery monitoring.
86+
- [Anonymous Payment Technique Catalog](anonymous-payment-techniques.md) — 48 payment families with pros, cons, lawful workflows, detection, capture exposure and compromise monitoring.
87+
- [Capture-Resilient Authorized Field Nodes](capture-resilient-authorized-field-nodes.md) — stable outbound rendezvous, dual-uplink recovery, secret minimization, capture drills and discovery/compromise monitoring for owner-approved drops.
88+
- [Offensive Infrastructure and Attribution Evasion](offensive-infrastructure-and-attribution-evasion.md) — ORBs, multi-hop/residential relays, redirectors, fronting, fast flux, domain shadowing, web services and persona infrastructure.
89+
- [Covert Physical and Wireless Access](covert-physical-wireless-access.md) — nearest-neighbor attacks, public access, drop devices, cellular backhaul and satellite abuse.
90+
- [Government and APT Case Studies](government-and-apt-case-studies.md) — reconstructed public cases and the telemetry that exposed them.
91+
- [Financial Obfuscation Tradecraft](financial-obfuscation-tradecraft.md) — how payment layering works, why it fails and how investigators follow it.
92+
- [Attribution, Detection and Countermeasures](attribution-detection-and-countermeasures.md) — a cross-layer detection model and practical hunting logic.
93+
- [Authorized Adversary-Emulation Labs](authorized-adversary-emulation-labs.md) — reproducible exercises using owned networks and synthetic data.
94+
95+
## Operator fundamentals and supporting guides
96+
97+
- [Threat Modeling & Identity Separation](threat-modeling-and-identity-separation.md)
98+
- [Network Privacy & Anonymous Connectivity](network-privacy-and-anonymous-connectivity.md)
99+
- [Advanced Network Privacy Architectures](advanced-network-privacy-architectures.md)
100+
- [Privacy Operating Systems](privacy-operating-systems.md)
101+
- [Privacy-Preserving Communications and Sharing](privacy-preserving-communications-and-sharing.md)
102+
- [Authorized Red-Team Infrastructure](authorized-red-team-infrastructure.md)
103+
- [Private Digital Payments](private-digital-payments.md)
104+
- [Cryptocurrency Privacy](cryptocurrency-privacy.md)
105+
- [Privacy-Preserving Payment Protocols](privacy-preserving-payment-protocols.md)
106+
- [Reproducible Privacy Testing](reproducible-privacy-testing.md)
107+
- [Operational Privacy Playbooks](operational-privacy-playbooks.md)
108+
109+
## Guide and verification index
110+
111+
| Technique | Deployment guide | Verification/failure test |
112+
|---|---|---|
113+
| All Internet-access technique families | [Anonymous Internet Access Technique Catalog](anonymous-internet-access-techniques.md) | Per-technique detection plus [reproducible labs](authorized-adversary-emulation-labs.md) |
114+
| All payment technique families | [Anonymous Payment Technique Catalog](anonymous-payment-techniques.md) | Per-technique detection plus [synthetic payment lab](authorized-adversary-emulation-labs.md#lab-6-synthetic-peel-chain-and-bridge-graph) |
115+
| Owner-approved physical field node | [Capture-Resilient Authorized Field Nodes](capture-resilient-authorized-field-nodes.md) | Capture drill, off-device state monitoring and suspected-discovery runbook |
116+
| ORBs, residential relays, fronting, fast flux and dead drops | [Offensive Infrastructure and Attribution Evasion](offensive-infrastructure-and-attribution-evasion.md) | [Owned emulation labs](authorized-adversary-emulation-labs.md#lab-1-owned-orb-and-redirector-chain) |
117+
| Nearest-neighbor Wi-Fi, drops, cellular and satellite paths | [Covert Physical and Wireless Access](covert-physical-wireless-access.md) | [Owned wireless-pivot lab](authorized-adversary-emulation-labs.md#lab-4-nearest-neighbor-wireless-pivot) |
118+
| Cross-layer infrastructure and operator attribution | [Attribution, Detection and Countermeasures](attribution-detection-and-countermeasures.md) | [Exercise report template](authorized-adversary-emulation-labs.md#exercise-report-template) |
119+
| Peel chains, mixers, chain hopping, nominees and OTC conversion | [Financial Obfuscation Tradecraft](financial-obfuscation-tradecraft.md) | [Synthetic transaction graph](authorized-adversary-emulation-labs.md#lab-6-synthetic-peel-chain-and-bridge-graph) |
120+
| Identity/browser compartment | [Threat Modeling & Identity Separation](threat-modeling-and-identity-separation.md) | [Browser and OS tests](reproducible-privacy-testing.md#browser-compartment-test) |
121+
| VPN, Tor, guest Wi-Fi, travel router, cellular | [Network Privacy & Anonymous Connectivity](network-privacy-and-anonymous-connectivity.md) | [Network-path test](reproducible-privacy-testing.md#network-path-test) |
122+
| Split relays, OHTTP, namespaces, bridges, onions, I2P | [Advanced Network Privacy Architectures](advanced-network-privacy-architectures.md) | [Tor/onion and route tests](reproducible-privacy-testing.md#tor-and-onion-service-test) |
123+
| Tails, Whonix and Qubes | [Privacy Operating Systems](privacy-operating-systems.md) | [OS isolation test](reproducible-privacy-testing.md#operating-system-isolation-test) |
124+
| Signal, SimpleX, Briar, OnionShare and encrypted files | [Privacy-Preserving Communications and Sharing](privacy-preserving-communications-and-sharing.md) | [Communications/file tests](reproducible-privacy-testing.md#communications-metadata-test) |
125+
| Authorized red-team egress/drop nodes | [Authorized Red-Team Infrastructure](authorized-red-team-infrastructure.md) | [Accountability drill](reproducible-privacy-testing.md#authorized-red-team-accountability-drill) |
126+
| Cash, prepaid and virtual cards | [Private Digital Payments](private-digital-payments.md) | [Payment privacy test](reproducible-privacy-testing.md#payment-privacy-test) |
127+
| Bitcoin, PayJoin/CoinJoin, Lightning and Monero | [Cryptocurrency Privacy](cryptocurrency-privacy.md) | [Payment privacy test](reproducible-privacy-testing.md#payment-privacy-test) |
128+
| Silent Payments, Zcash, Taler and federated e-cash | [Privacy-Preserving Payment Protocols](privacy-preserving-payment-protocols.md) | [Payment privacy test](reproducible-privacy-testing.md#payment-privacy-test) |
129+
130+
## References
131+
132+
- [1] [EFF Surveillance Self-Defense — Your Security Plan](https://ssd.eff.org/module/your-security-plan)
133+
- [2] [US Code, 18 USC §1030 — Fraud and related activity in connection with computers](https://uscode.house.gov/view.xhtml?req=title:18%20section:1030%20edition:prelim)
134+
- [3] [UK Computer Misuse Act 1990, section 1](https://www.legislation.gov.uk/ukpga/1990/18/section/1)
135+
- [4] [EUR-Lex — Directive 2013/40/EU on attacks against information systems](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32013L0040)
136+
- [5] [W3C — Mitigating Browser Fingerprinting in Web Specifications](https://www.w3.org/TR/fingerprinting-guidance/)
137+
- [6] [MITRE ATT&CK — Acquire Infrastructure (T1583) and Compromise Infrastructure (T1584)](https://attack.mitre.org/techniques/T1584/)
138+
- [7] [MITRE ATT&CK — Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)

0 commit comments

Comments
 (0)