(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)


leave a comment »



A Note from Krampus….

Well kids it has been one hell of a fucking year for Krampus and he is feeling pretty god damned angry so you all better gird your loins for a good nut-sacking! Last year Krampus managed to get all the butt-hurt en fuego because he posted raw data and made the community look at their own shit. This year he sourced the nominations to the Krampus INFOSEC star chamber (you all know who you are and why you are wearing the hoodies when you voted!) but the general sense was that the aphorism of “None of us is as bad as all of us” is quite appropriate. To that end, Krampus is still fucking pissed with all of you really. You all, as a ‘community’ suck and you should stop thinking you are all special rock star INFOSEC snowflakes.

All of you con whores need to stop.

All of you Rock Stars need to get a life.

If you only care about breaking shit… Well… Fuck you. Hug a blue teamer so they can stab you in the spleen.

I guess Krampus just wants to quote Shatner here:

You know, before I answer any more questions there’s something I wanted to say. Having received all your letters over the years, and I’ve spoken to many of you, and some of you have traveled… y’know… hundreds of miles to be here, I’d just like to say… GET A LIFE, will you people? I mean, for crying out loud, it’s just a TV show! I mean, look at you, look at the way you’re dressed! You’ve turned an enjoyable little job, that I did as a lark for a few years, into a COLOSSAL WASTE OF TIME!

Grow the fuck up!

Ok now that Krampus has that off his plate, on to the Krampus list 2016!


JESUS FUCKING FUCK! As if the government’s current approval rating of 17% overall wasn’t bad enough they still have not clue one how to secure shit! 2016 was a fuckfest of data loss and cyber fuckery! Take heart though kids… 2017 under Der Trumpler will be EVEN WORSE!


HOLY FUCKING SHIT! could you guys please not have all your email and databases on systems secured by the local village idiot for a fucking change? What the fuck people? Watching all your email sprayed upon Wikileaks like so much CYBER JIZZ was enough for me to just pine for Putin’s shock troops to parachute in like in RED DAWN!



Allowing Putin’s re-constituted KGB do your cyber war dirty work was spectacular really but FUCK YOU.






Dear China,

You now have Krampus’ SF-86 and YET he has not had an attempt by some SWALLOWS to turn me? WHAT THE FUCK? Come on!




YOU are on the list because you sit there like a turkey in a rainstorm while all our CYBER shit goes to hell.

Krampus hates you with the force of a nuclear explosion.


Krampus first would like to say that he is often times just injecting shit into the stream to cause your SIGINT to be shitty.


THIRDLY, Krampus would like to say that your loss, carelessly, of those tools this year… JESUS FUCK! WHY NOT JUST PUT IT ALL ON THE DARKNET FOR BITCOIN HUH?

FBI: Director Comey

JIMMY! JIMMY BOY! what the ever loving fuck man? First your moaning over crypto then this whole thing with emails and fucking up elections? Extra flailing for you!


Jake Applebaum

JAKE,  your room in hell has been furnished and is ready to go. The giant drill dildo that has a perpetual spray of ghost pepper is Krampus’ idea and Lucifer approved. Ride it like you stole it you fucker.




HILLY! HIL, HILLSTER! WHAT THE FUCK? You are a smart woman and yet you fuck up the most simple things around email?

Welp… There you go… Krampus hopes that your BLEACH BIT of your history goes better than your classified data mishandling and email fuckery!



UGH, Krampus hates you all really but a few of you stood out in your cyber shit speaking and douchery! Generally though, the business of security has only doubled and tripled down on the fuckery. If Krampus really cared he could have a whole screed but he is just too shagged out over the community anyway to give a proper fuck!





Facebook (aka FaceCult)




Symantec Buys Lifelock!


Guess it is one way to make money of your shitty product…

The Media:

Shitty Reporters (general)

Krampus saw and is still seeing some truly shitty reporting on the “cybers” out there. It is still playing out with reporters not talking to experts on a thing but then again it is the new age of there not being such a thing as facts so I guess fuck it all.

THIS douche really really really got shit wrong this year in the cyber. He is on Krampus’ list for some special treatment.




Krampus had hopes for you but he always knew that you would become nothing more than an arm of propaganda for whatever intelligence service decided to use you. WHO KNEW it would be Russia? Oh yeah, ASSange did because he is their boy!

Die in a fire you propagandist fuckwits.

Written by Krypt3ia

2016/12/05 at 14:08

So Why Doesn’t Tor Blog Really Show You How To Set Up A Hidden Site?

leave a comment »


I was recently fiddle farting around on the TOR blog and looking at the setup tutorials for a ‘Hidden Site’ on TOR. When I really dug down into the alleged tutorial though, there wasn’t a whole lot of help there for someone isn’t let’s say, a “Dark Cyber Wizard”, to set up a site inside the onion. Sure they tell you to download the TOR and then to do ‘things’ and magically you have a tor site!

*blank stare*

No TOR blog not really. Since the disappearance of Vidalia and your pimping of the TOR Browser only really, you seem to be neglecting adding to the complexity of the onion with, ya know, actual sites to look at in there. So to that end I thought I would just write up this quick and dirty for Ubuntu (I hear the hisses out there already from some) and give you some guidance on what to do after you get it running. I am using Ubuntu because FUCK YOU is why! So just deal with it.


Phase one: Install your web server

Step one: Install lighttpd

sudo apt-get install lighttpd (or NGINX or whatever you like really but lighttpd is what is recommended by TOR)

Step Two: Start the server

sudo /etc/init.d/lighttpd start

Step Three: Check it is up

Open browser and go to and see if you see the default page. If that isn’t working I suggest you google some things about how lighttpd works

Phase Two: Install TOR and configure Hidden Site

Step One: Install TOR

sudo apt-get install tor

Step Two: Edit TORRC

sudo nano /etc/tor/torrc

UN-comment these two lines (in red) and of course change the port from 80 to something else if you want to.



Step Three: Start TOR

sudo /etc/init.d/tor start

Step Four: Get the onion address

sudo nano /var/lib/tor/hidden_service/hostname

Step Five: Copy the address in the file and close out.

If you have followed these steps then you “should” have a working TOR hidden site and that default page in lighttpd will be showing up in the onions. Now this mind you is just to get the shit installed and working right? I mean, there is much more to this hosting an onion site that concerns security. For that I suggest you all learn how to secure your Linux install, your lighttpd version and install, and of course the TOR itself. You are gonna have to keep up on the vulns for TOR and everything else to insure you aren’t just hanging your dick out there on the internet for everyone to slap right?

But this all leads me back to the question of why TOR blog does not simply just give you the means to install and use this product? Are you guys afraid of being liable for a naughty site to be out there? Are you guys instead all trying to be dark cyber wizards keeping secrets like some cyber dragon in their cyber cave?


It’s not that fucking hard but man you guys really make all kinds of stupid about it.

Ok kids! Go install and play!


PS.. if all of this Linux stuff is too arcane for you… well..




Oh yeah, by the way, you should really run an OnionScan against your new site to see what may be leaking or insecure. Go do that now… If you have issues please get in touch with @OnionScan

Written by Krypt3ia

2016/11/29 at 19:53

Posted in RTFM

Re-Counts and Forensics in 2016

leave a comment »


Since the election I have taken a break from the insanity as much as I could. I blocked off Trump on Twitter but he keeps leaking through the blocks anyway. I have been reading though on the usual source sites like the New York Times and other news sites and with each day I am seeing the utter unravelling of America. Thinking about it though I have to wonder if the unravelling happened long ago and this is all just an echo of the failure finally reaching us all like a radio wave from a distant dying pulsar…

Anyway, I wanted to write today about the current debacle concerning the vote and the calls for an audit of that vote. Since the Green’s have gotten the ball rolling and the Clinton camp finally agreed to look at the vote it seems to be happening and that is a good thing. In an election where blatant tampering through hacking and information operations (DISINFO and IFO-OPS) by the Russian state one can have some sense that perhaps the same adversaries ‘might’ have tampered with the actual votes as well. Now, had it been just troll propaganda wars I might say; “Ok we have been played, they did it, we lost because we as a people are unable to comprehend real news from fake news” but that is not all that happened here. We saw actual hacking campaigns carried out on our voting infrastructure and one of the parties outright and still no one is clamouring for a re-count AND an audit of the systems that are already known to be security challenged?

It is incomprehensible to me at times how our government works at all. The group think and the lackadaisical attitudes towards information security are staggering but this whole episode takes the cake. You mean to tell me that the DHS and the government, the ones who brought us the OPM hack and other massive data breaches are going to tell us that the vote could not have been hacked and it is silly to even consider a forensic audit? This is what I keep hearing in the media and out of the government as calls for the votes to be re-counted and audited. It is also what I am hearing post Halderman’s paper and blog post that says: “I’m not saying the vote was hacked but there is evidence enough to say maybe we should look into it”  What the fuck? We know things went down so why all the reticence to check?

Well let’s look at it another way shall we? let’s say the government, ya know the one who keeps claiming we have “cyber superiority” in fact is shown to have such a poor state of security (like OPM isn’t enough to cast doubt on that one) that the election systems, the ones that the security community has been warning about as insecure for years now, was in fact manipulated as part of a larger operation to fix the election for Putins puppet regime? What exactly would the outcomes be from that revelation?

  1. The system would not be trusted
  2. The country would be in chaos
  3. The government would be seen as incompetent
  4. Putin wins.

It seems to me that most of these things have already come to pass. Sure, we have not actually proven that the systems in key Electoral College states were tampered with by malware or added code yet. That code could have been put in the supply chain easily by infecting the key systems the polling places use (see Halderman’s paper *think USB and ballot templates*) but all it takes is a real forensic evaluation to determine if something was amiss right? Yet I still don’t hear a clamour to get this done. Why is that really? We have been sold the idea on many occasions that it is too hard to hack the election but really, with a limited target and a goal of manipulating it subtly one would not see it blatantly would they? I mean fuck, look, Clinton has what like 2 million more popular votes and this fuckwit wins the college? It is either fantastic strategy on the part of his campaign (I mean Putin’s campaign) or, given all of the other evidence of tampering and obfuscation that something could be amiss with the known insecure systems we vote with right?

Really what I am saying here is this; “We have been played. We have been played and now we have this kleptocrat in office who’s been placed there, whether or not you want to hear this, by the Russian governments intelligence apparatus. The least you can do now is do the due diligence to see if something more happened than the hacks and disinformation operations we already know about.” I suspect though that the government does not want to do this because it would call everything into question. It would openly call out the fact that a nation state fucked with us in such a fundamental way that the only real response would have to be, well, war? I mean what is the response to something of this scale anyway right?

Weigh the evidence.

Occams Razor this shit.



Written by Krypt3ia

2016/11/28 at 13:39

Posted in .gov, 2016

Dear Republicrats, You Are Now Comrade Putin’s Puppets.

with one comment


Well you did it GOP and America, you finally elected a person who seems to be on the face of it, aligned with Russia, is an asset of Russia, or in fact is just a “Useful Idiot” as Uncle Joe Stalin called it. Worse still, it seems that you also have given access to at least three people within the Trump campaign who have had ties, direct ones, to Russia, the Kremlin and Alfabank to the White House. These people too may in fact be outright assets of Putin and the KGB.

Congratulations America.

What’s worse is that the GOP has actively pursued this all in the guise of being alt-right or more American than most Americans all the while you have been Putin’s pawns as well.

Once again, congratulations America.

I fear for the country in more ways than one. I fear that our President elect can easily be led to foolish action. (just look at his Twitter)

I fear that his strong man sensibilities and his crazy ideas about NATO will make the world a more dangerous place.

I fear that he has no idea how to run the country and likely will not listen to those who do.

I fear that in an age of Cyber “Warfare” and espionage this man has no cogent ideas on how to protect the nation.

I fear that this man also has a hair trigger and will pursue actions both Cyber and otherwise in the warfare arena that will only end in escalation of tensions globally.

I fear that his minions, and by that I mean the neo nazi’s the white supremacists, and the general maladjusted nut cases like those Alex Jones has in his thrall will only be emboldened to take actions against anyone they don’t like.

In short people we are fucked.

See ya..

Or maybe more on point, “dasvidaniya


Written by Krypt3ia

2016/11/09 at 20:28

Posted in 2016

Shits Gone Plaid: GDD53 and Slate

with one comment



Last night, Halloween Night, it turned out was the last of the last nights for October Surprises and this time I was dragged into the mire by piss poor reporting by Slate’s Franklin Foer. Evidently Franky has been talking to “Tea Leaves” the titular secret security squirrel who has been pimping this conspiracy theory about Trump email servers and Russian banks for a while now. I came across the story when someone I know got hold of me asking technical questions about the story. I then did the due diligence and began looking into it and wrote a blog post that in the end after a couple updates dismissed Tea as a fabricator and moved on with life. I then edited the post with an update that in fact, part of Tea’s story was right that the New York Times had looked into this. While this was true, it is also true they dropped it for lack of evidence that you could get past editorial, so my blog confirmed that much at least. Unfortunately Tea still  shopped this around until someone took the bait hook line and sinker (Foer) putting out speculation, anonymous testimony, and not much more as proof positive that Trump is in league with Russia’s Alfabank via secret emails and configured servers.


There was none. There was a lot of speculation and theory but what Tea had put on the darknet and had been shopping around was not forensically proven and in fact all of the metadata that may have existed had been stamped out of all documents or never existed in the first place as they were using text files. In looking at the so called evidence I called bullshit and began questioning Tea. Tea emailed me trying to pimp more of this story but I asked pointed forensic questions and about the provenance of their “data” after doing so, Tea claimed they “never got the email”. This was utter bullshit because I even created an account on the same encrypted email server as theirs to send it to them. Clearly they did not want to or could not answer my direct questions on authenticity.

Here were the questions:


I got nothing back so I walked away from this story updating the blog with the image you see at the top. This was a non story and this was someone’s troll or an IC operation of some kind. I left it at that… That is until last night when this fallacy laden report came out of Slate.

Anonymous Security Professionals

So here is what I believe happened with Slate and Foer. Tea, not happy with my ignoring their bullshit, went on to pimp at least five venues looking for a way to get this wide and Foer was the gullible one to do so. Now, with a live one on the line Tea spun their tale and added the new twist that they are in fact a group of “security professionals” with insider knowledge and that this story is really real. Of course once again they provided no real proof of Trumps servers being configured for this purpose, no evidence of actual emails, and no real forensically sound information that proves any of what they say can be proven in a court of law. This is a key thing and Slate may not care but others do. Even in the previous dumps on the i2p site that tea set up their diagram said “this is what it would look like” would is not proof, that there is speculation and not evidence.


So more fuckery and none of it can be proven out, in fact as many on Twitter last night including Rob Graham skewered the whole thing pretty well. In the end there is no proof here that these events happened as they are being stated and if there is evidence, solid evidence, then it is being hidden by those said same security researchers because… Because why? If you have evidence that Trump has been in league with Russia via email servers as a defacto hotline then give the evidence to the FBI! What the holy hell are you doing spinning tales to fuckwit reporters? Like I said on Twitter last night, you lack the courage of your convictions sir.


Meanwhile, the story spun by Tea and now Camp et al on Slate makes me wonder just who Tea is. Obviously Camp knows Tea and the others and this is a small world so let’s work out the connections shall we?

Camp –>Vixie –> ??? let’s just assume that Camp knows these persons well and if one starts to dig you could come up with a few names of people who “would” (there’s that would again) have the kind of access to DNS data that is needed. Let’s just start naming names like Dan Kaminsky for example as Tea just because fuck he has access to that kind of stuff! It’s fuckery sure, but it is just as valid as that fucking slate article am I right or am I right?

Just remember Tea and company, we all know each other in this biz and someday your anonymity will be blown because of your fucking bad OPSEC. When that day comes then you better produce some solid evidence.

Just sayin.

Reporter Fuckery

Lastly, let me just say that I never “softened” to Tea. I got some facts that NYT looked at this and I postulated that it is possible for this kind of stuff going on but in the end I said that there was no proof. So this line that I am sure Tea gave to Slate about my “incorrect assumptions” was outright fuckery.

Proof or get the fuck out.


Written by Krypt3ia

2016/11/01 at 12:59

Posted in 2016

LinkedIN: The APT Phisherman’s Friend

leave a comment »


I get some interesting requests for connection on LinkedIN. Some of these are just the rando security wonk or government type, others, well, they are much more targeted and potentially adversary activity looking for an opportunity to mine your connections or you for bits. In the case of the profile above, I believe this to be a fake account created by group looking to get into my links and perhaps someday send me some file that they hope I will click on. Now you all know me, I am an infamous bastard and I vet my connections most of the time so when this one came in all the bells started going off once I took a closer look at her bonafides.

The problem with her is that I cannot verify much of anything she claims in her bio. I looked her online and nothing. I looked up her company that she works for and all I got was a real estate company out of Florida not NYC as she claims to be located in. I then went on to inquire with the secret squirrels out there on the internets whether or not she had in fact worked for RAND. The responses I got back were that she had not worked for RAND, which sure, maybe she did and they could not locate an old email acct and just didn’t know her, but, there are no other remnants in the OSINT out there showing her to be an employee there at all.



Neither could I locate her current company solidly and the company that has the name is run by some guy alone so I am not thinking that that is a solid hit. I then cross referenced in searches on Google for “Harbor Capital LLC NYC” and all I get are names that are close to this but not the same. Once again nothing comes up here that validates this person, never mind the company itself. The alarm claxon is getting louder and louder here ain’t it? So I started the cross searches and yes there are “Elisabeth M Jones'” out there but no one specifically pops up as the definitive person I am looking for here.



Then I used the image search engines to see if I could catch the photo as being re-used. This woman looks kinda familiar, like I have seen her in something on TV but I cannot place it. Coincidentally neither can Tineye nor Google. Neither of these services gave me a solid hit on this image so either this is someone who is rarely photographed, or, this is someone who’s pic has never been hoovered and catalogued by the great Google machine.



Once again, here we are at a loss to show this person really exists. Nothing in these searches can lead me to believe this is anything but a cutout account looking to gain access to my connections and I on LinkedIN. Now some of you out there will likely say “Meh so what?” Well, this is what, this type of attack with social engineering is what I use against targets and many of you out there in the pen-testing arena do too. More so though, the APT types have been using LinkedIN for a long time to gain access to people and then send them malware or links to malware. China has been very good at this for a long time. Iran was doing this a few years ago post Stuxnet, and now the DPRK is gangbusters on LinkedIN phishing.

Put another way gentle reader.. If you work for anything and anyone the APT types want to get access to then YOU are a target as well. Pay heed to the awareness programs you are given on social engineering and phishing and KNOW that LinkedIN, Twitter, Facebook, ALL the social media platforms are used as well for this. I personally have created profiles on LinkedIN to target execs using pretty women to get them to give me access. In fact, ALL of this should sound familiar to you.

Does the name Robin Sage ring a bell?

Speaking of Robin….

Here are Elisabeth’s connections…


Do you see the irony there?…

I do…


Anyway, I have reached out to some and told them that I have some inside skinny that this may be APT but only one of them said they were removing her. C’est la vie I guess, but I never added her. You gentle reader need to understand once again that the Robin Sage effect is still possible. Some of these connections have inside connections that I for one would not want connecting to this rando account… Unless that is their plan, to lead them along..



Keep your eyes open kids and just don’t click accept on shit mmmkay?


PS.. Elisabeth if you are in fact real lemme know… Maybe I will acc…. NAH just fuckin wit ya!



Jayson, you are a first connection… I know you like going to China but you may want to not be the way in for these guys.


Written by Krypt3ia

2016/10/28 at 19:27

Posted in APT, CUTOUTS, OPSEC, Phishing

Darknet Numbers Pages Proof of Concept

leave a comment »



Numbers Station:

So with all the kerfuffle over crypto I decided to give everyone a big fuck you and do something low-tek just to mess with the narrative. Right, so you all know what numbers stations are right? Well, I decided that it was time that the internet have one all it’s own but not on the clearnet no sir-ee! I wanted a darknet spooky spooky impenetrable super scary numbers station! So I began to hatch a dastardly nation state level of fuckery that surely will have the gubment all  up in arms over my crypto darknet wizardry! I set up a site and I communicated with some people secretly and securely and no one was the wiser. Not one federal agency that I know of saw the site, no scripted scouring of the darknet cached my page that I am aware of (and I asked) and generally, I just pulled off the new age of tradecraft that the KGB should be jealous of!

Here’s how I did it.

Proof of Concept

The Plan

As I was thinking about a means of communication using the darknet to avoid prying eyes and to do so securely I came to the conclusion that I sure could use PGP and some email service out there but gee, lately those have been pwn3d too so fuck that. Instead I wanted to be more old skewl and opted for two way comms through OTP and a static page that could live on the darknet at periods of the day and night of my choosing with those I want to communicate with in the know as to timetables with, well, a timetable. Commonly on the air Numbers stations beacon at specific times of the day and week so this is kind of the same thing. So I set to making a highly portable TOR capable platform that I could take with me and connect to WIFI at hotels, bars, cafe’s, rando people’s houses etc. I could effectively have a transient site that would be hard to track and harder to narrow down where it lives because it is not in some rack somewhere stationary and waiting to be deanonymized and pwn3d.


I opted for a netbook that I had laying around after doing the math on a Raspberry Pi. It was far cheaper to use an old old netbook I had than go spend money on a pi and it was just as portable. Once I got the laptop up and running on backbox, I then installed the TOR system and configured it for having it’s own hidden site. I then installed lighthttpd and created a very small stripped down page of text and color which I then hid the encoded text in the black space. No need to be all fancy here and it was a flourish anyway. It doesn’t have to be pretty to work and yet this lightweight site and the server it was on allowed me to communicate well enough while the whole thing was secure from being hacked. I had testing run on it and the tester was unable to own the box nor the site.

Once the testing was over I let the site run. It was up and down per specific times and communication was made using a second site on the darknet where people could post to a pasteit where we could have coded signals (basically; understood and complying) so that the communications stream would be innocuous enough using code words. You could use images on chan’s or the old trope of putting up an ad for something and even having more code in the text of that if you wanna get fancy and all.

The Tools

  • Net top laptop
  • Backbox linux distro
  • TOR
  • Lighthttpd
  • One Time Pads (plenty of places on the net to create them)
  • Timetable for uptime and downtime for comms
  • Assets to communicate with

The Tradecraft

Using this method of secret communication one could plan out all kinds of badness if they wanted to. Having a stealth site that is transient too also allows for more security but as always the people are the weak point. If an asset is caught then the means of communication is blown. Just like the analog counterparts (AM/SW Numbers Stations) this type of communication could go on untouched and unbroken for a long time because of the frequency changes, the IP address changes, and mobility of the asset. Just imagine if the analog version of Numbers Stations were actually not just in some building but in a backpack eh?

The hardest part of all of this is that you have to train your assets to use OTP and to have proper OPSEC. It can be done though, so this is a viable means of secret communication that is low tek enough yet high tek enough for the average person to easily carry out if they are determined to. It would bypass all the email shenanigans as well as texts, calls, chats, that can be intercepted by warrants to companies like Apple and AT&T. After all, how hard is it today to get a distro of linux on a box, install TOR, set up a hidden site, and start using OTP?

Wait… Ok maybe it is a little hard.

Still doable though… I mean it worked for me and my “assets”

Enjoy kids!


Written by Krypt3ia

2016/10/25 at 20:41

Posted in 1984, Crypto, DARKNET