The $19.95 Anonymous Cyber Profile

No ratings

Presented at DakotaCon 2019 by

"The $19.95 anonymous cyber profile" is a walkthrough of how to create an almost untraceable cyber profile for threat hunting and red team engagements. The creation of an anonymous cyber profile is possible by exploiting the flawed trust model used by most internet service providers.I will explain at its root internet service providers push identity validation from themselves to another source, creating a circular trust between vendors that lacks any accountability. This talk will demonstrate how email service vendors are the internet's trust model highest validator. Once this trust is gained, all other account controls fall away. To illustrate my idea, most internet services only require a valid email address to create accounts or gain access to the vendors service, such as PayPal, VPS or to register a gift card. As long as you have an email provider validated your identity the means to create fake companies or cyber identities is trivial. Recently email vendors have required the use of a mobile phone number before account creation. However, this control can be bypassed with a burner phone number. Currently, several prepaid phone vendors allow for account creation by only purchasing a SIM card or plan credits. Again, gaining trust without accountability.By the end of the presentation attendees will gain knowledge on how to anonymously create fake accounts to gain the ability to create an anonymous infrastructure. I will highlight a few gotcha's in using gift/prepaid cards, why I don't just use blockchain currencies and other pitfalls I ran into creating a fake identity.Lastly, I will point out on the how Single Sign On simplifies the exploitation of the internet's broken trust model.