Bitcoin OPSEC Tips From Casa Keyfest: What Should James Bond Do?

During a Casa Keyfest league conference held connected January 6, Casa Head of Security Ron Stoner gave a rundown connected “operations security” (OPSEC), a word coined by the U.S. subject during the Vietnam war.

According to Wikipedia, OPSEC is “a process that identifies captious accusation to find if affable actions tin beryllium observed by force intelligence, determines if accusation obtained by adversaries could beryllium interpreted to beryllium utile to them, and past executes selected measures that destruct oregon trim adversary exploitation of affable captious information.”

OPSEC is besides communal parlance successful the Bitcoin world: The devices that are utilized for accessing your bitcoin funds are each onslaught surfaces that necessitate operations security. Stoner discussed OPSEC from a Bitcoin position and however to support yourself from these imaginable connect surfaces.

But portion watching Stoner’s session, my caput didn’t absorption connected subject operations oregon Bitcoin onslaught surfaces. I started reasoning astir Hollywood. Specifically, astir the present 25 James Bond movies and each the gadgets and methods that Bond uses to decision atrocious actors. And besides each of the ways James Bond lets his defender down and gets defeated himself.

So, let’s see however James Bond oregon Spectre (the fictional planetary violent enactment that Bond battles) mightiness get overconfident oregon lazy astir OPSEC for Bitcoin, oregon simply prioritize debased complexity implicit much information for their bitcoin funds.

Setting The Scene: MI6 And How It Got On Zero

Let’s ideate that British concealed quality services and Bond leader MI6 lone uses bitcoin and is self-sovereign now. The authorities was excessively entwined with corrupt money, therefore, MI6 took a monetary colony and divested from the government. MI6 invested successful bitcoin arsenic a store of worth that would admit and money its missions, arsenic good arsenic conscionable its needs for security, privateness and mobility. MI6 present uses bitcoin exclusively.

This alteration successful backing has forced Bond to commencement to budget. Bond had been spending extravagantly and operating successful a precocious clip penchant way. His boss, M, has enactment him connected a strict allowance for his idiosyncratic 007 blistery wallet. No excuses.

[SOMEWHERE IN THE MOUNTAINS OF MONTENEGRO]

Bond is driving his Aston Martin astatine a sprightly clip. His dashboard comes to beingness and a dependable begins to speak.

Car: [Incoming connection from M]

“Bond, M here. Listen, I'm connected vacation and conscionable had a run-in with immoderate bandits successful Barcelona. They've stolen the hired car and present the blasted bureau is insisting I marque good. Moneypenny is retired and I request idiosyncratic to ligament maine 100 cardinal sats from the MI6 wallet. Could you beryllium a bully chap and nonstop funds from your operations relationship to this rental company? QR codification attached.”

Car: [End message. Would you similar to respond?]

Bond considers a moment. The enactment sounds acquainted to him, but helium can't callback wherever from. No matter. He was owed astatine a gathering with a beauteous informant successful Podgorica successful 1 hour, and helium didn't person clip for whys and wherefores.

Bond: "Yes. Message him backmost that I'll spot to it."

Car: [Message sent.]

Bond: "Siri, I request to transportation funds to the QR codification successful the past message."

Car: [Accessing past message. There seems to beryllium a nexus embedded successful the message. Permission to access?]

Bond, impatiently: "Yes, yes. Go ahead."

Car: [Incoming file. Installing bundle update.]

Bond: "What, now? Can't it hold until I'm finished?"

Car: [Software updated. Source of funds?]

Bond: "I request to entree my Bitcoin operational wallet." [Editor’s note: No merchandise placement here].

Car: [Biometric authentication required. Please spot your manus connected the console to authorize.]

Bond does so. The surface turns green.

Car: [Authorization accepted. Money sent. Your operational relationship equilibrium is present zero. Your information is nary longer required for this transaction.]

Bond: "What?"

The Aston Martin's extortion retracts.

Car: [Good-bye, Mr. Bond.]

The malware present successful complaint of the conveyance triggers the ejection seat, Bond grabs his iPhone and is blasted skyward, telephone desperately held successful 1 hand, reaching for his pouch parachute with his different hand.

Bond has nary car, nary MI6 funds and precise small idiosyncratic blistery wallet funds.

Single Signing Or Multisignature Wallets

Numerous providers connection multi-signature wallets with two-of-three multisig and three-of-five multisig setups.

However, Bond and different agents request to driblet into a azygous location, get funds from acold retention and determination on. Based connected those needs:

• MI6 does not acceptable up multisig and alternatively has galore single-sig hardware wallets
• MI6 keeps hardware wallets and backup seeds unafraid successful geographically-seperate locations
• MI6 besides has funds divided crossed each of these azygous signature acold retention hardware wallets

MI6 knows this isn’t the champion security, but for mobility and convenience needs, they judge it works for them.

Spectre wants to chopped disconnected MI6’s and Bond’s funds. Spectre agents simultaneously infiltrate respective of the retention locations adjacent Bond that incorporate backup seeds and hardware wallets.

Bond’s multi-location Ring information alerts him and Q that 2 of the hardware wallets and 1 effect backup for a 3rd wallet person been stolen from the 3 locations adjacent him. The wallets person a tiny Apple airtag-like instrumentality embedded successful each wallet’s Faraday bag. This instrumentality is capable to transmit extracurricular the Faraday container owed to Q’s technological handiwork. This enables Bond and Q to way the agents to their lair.

With multisig, these villains would person had a overmuch harder clip accessing immoderate of the MI6 bitcoin funds, arsenic they would request to person the due 2 oregon 3 devices oregon seeds successful bid to transportation the funds from a two-of-three oregon three-of-five multisig setup.

OPSEC Tip One: Use Faraday bags to support your devices from distant hacking, wiping/damage and surveillance.

OPSEC Tip Two: Stoner advises storing hardware wallets successful an access-controlled location. For example, a locked drawer (where lone you person the key) oregon a harmless oregon gathering with equipped defender and required ID access. In addition, usage a tamper-proof container truthful that erstwhile 1 does their quarterly oregon bi-yearly hardware and cardinal checks, they tin marque definite that nary 1 has accessed the devices.

James Bond And 007 PINs

The villains commencement by trying to entree the stolen hardware wallets.

After decades successful the busines, Bond’s quality to evade his ain execution and the continuing movie occurrence has made him apical feline astatine MI6 and a spot overconfident and attached to his numerical identity. Bond insisted that the PIN connected each the MI6 wallets beryllium 007007. The villains easy participate this pin, thereby accessing the hardware wallets.

OPSEC Tip Three: Casa recommends utilizing 1 PIN for each wallets, arsenic this makes it easier for the mean idiosyncratic to retrieve their funds. However, with abstracted PINs, 1 wallet’s compromise would not beryllium the aforesaid arsenic different hardware wallet’s compromise. This is simply a complexity versus much information tradeoff scenario. In addition, if 1 hardware wallet’s PIN is compromised, you would request to update each of the hardware wallets.

Firmware And OS Updates

The villains are present connected to the hardware wallet via their laptop. However, Q has accessed the hardware wallets’ website and temporarily implants a clever payload successful a firmware update.

The villains are asked to update the firmware and they bash so.

The firmware infiltrates the hardware wallet, but the villains don’t recognize this and truthful proceed to update the adjacent hardware wallet arsenic well. They are distracted — excited to spot the magnitude of bitcoin they person conscionable procured. They are virtually counting their bitcoin earlier it is stolen back.

Q volition aboriginal usage his malware to determination the funds to different hardware wallet. In addition, Bond could retrieve the backup effect and, erstwhile helium retrieves it, helium could inactive reconstruct the wallet and get the Bitcoin.

OPSEC Tip Four: When you spot a firmware update, bash immoderate manual checking. Type successful the URL, corroborate determination really is an update and what it contains. Stoner recommends instantly applying updates for captious information fixes. For different updates, cheque the merchandise day and possibly hold a fewer days to “let it bake” portion the caller accumulation firmware is being tested by the community. You whitethorn besides privation to update firmware to instrumentality vantage of caller protocol updates, specified arsenic Taproot enhancements. When it’s available, do usage immoderate bundle tools disposable to cheque the integer signature oregon MD5 checksum connected the firmware update file.

OPSEC Tip Five: During a firmware update, beryllium definite you person the cablegram plugged successful firmly and bash not disconnect during the update. Always usage the cablegram that came with the instrumentality arsenic determination tin beryllium shaper differences.

OPSEC Tip Six: For your mobile device, laptop oregon desktop, ever support up to day with each patches. However, it whitethorn beryllium champion to hold a mates days oregon a week to marque definite the updates bash not person immoderate issues.

OPSEC Tip Seven: Anything you link to is an onslaught aboveground — support it accordingly. Stoner does not urge air-gapped devices for the mean user. (That said, immoderate see hardware wallets to beryllium air-gapped). Bond is simply a high-risk plus who does usage air-gapped devices to execute offline signing, past aboriginal broadcast the transaction connected a network-connected machine. However, Bond’s impatience and “plans” caused him to beryllium lax.

Physical Security

The villains present crook to the backup effect operation to retrieve it to a caller hardware wallet.

These Spectre villains are cocky and endure from the monolithic overconfidence bias that these evil guys thin to person successful the movies. (Note: evil radical are not similar this successful existent life. They are damn smart).

An evil feline reads the effect words to idiosyncratic utilizing the keys to reconstruct to a caller hardware wallet. In the meantime, Bond has hacked into their Alexa adjunct and tin perceive them work disconnected the effect words.

Bond gets the effect words and is past capable to reconstruct to a spare caller hardware wallet and transportation his funds elsewhere earlier the villains person finished fumbling around. To the villains, it conscionable looks similar determination are zero sats near connected the device.

OPSEC Tip Eight: Before utilizing immoderate devices, Stoner talked astir scanning your carnal perimeter for radical oregon for different devices that mightiness beryllium listening oregon watching oregon recording. Historically, we were isolated successful our homes and lone disposable to different radical oregon exertion erstwhile extracurricular of our homes. That’s changed — we each person devices with cameras and microphones successful our homes oregon successful watches connected our wrist. Stoner does not urge bug detectors, arsenic they are hard to usage and tin make a batch of mendacious positives. Remove immoderate further devices (that mightiness beryllium listening oregon watching) from the room.

OPSEC Tip Nine: Prior to usage, inspect devices for immoderate signs of tampering.

Hardware Weapons

While the villains are wondering what went wrong, Bond breaks into their car and plugs an OMG cablegram into their car’s iPhone charger. This cablegram injects malware into the iPhone.

Bond purchases a clump of bitcoin with their iPhone app, and transfers it to his idiosyncratic blistery wallet. He has present replenished his blistery wallet truthful helium tin observe successful his customary manner.

OPSEC Tip Ten: As acold arsenic cables, Stoner recommends being cautious wherever you bargain them and not to usage random cables oregon USB devices. Your champion stake is to usage the cablegram that came with the instrumentality erstwhile you bought it.

Digital Security

The villains persist, arsenic they usually do. There is simply a huge, immense imaginable payoff. Bitcoin has conscionable skyrocketed to $500,000. This time, Spectre sends a pistillate to bash the job.

Bond asks for her interaction details and she texts him the info on with an Instagram nexus to immoderate pictures of her. Bond clicks connected the nexus connected his phone, and his telephone unknowingly connects to a nefarious tract and downloads malware. Bond past wants to spot the pictures connected his laptop screen, and again, Bond has present carelessly infected some his devices.

Didn’t Q archer Bond to never click links?!

OPSEC Tip Eleven: Stoner has the aforesaid mantra that I do: Do not click links. Type URLs into the browser yourself. Or, you tin find the links via a hunt engine. If you indispensable click a link, browser backstage modes, virtual machines and different information tools tin assistance supply amended security.

Checking Your Backups And Plan

With immoderate integer assets you have, you should periodically cheque your backups to marque definite the backups inactive beryllium and you tin reconstruct from them. This is besides existent for your hardware wallets and immoderate seeds you keep.

Not each of america person alerts connected our acold retention locations, to cognize whether they’ve been compromised. Think done a program of enactment before thing is compromised.

Bitcoin OPSEC

It’s important to beryllium hypervigilant for threats and to the task astatine manus erstwhile dealing with your money. You should beryllium paranoid. You should beryllium careful. And, if it’s not obvious, you should ne'er ever usage nationalist Wifi for immoderate operations you attraction about.

Just arsenic Bond plays feline and rodent with villians, truthful bash achromatic chapeau hackers and achromatic chapeau information researchers. Hackers are perpetually exploiting portion information engineers are perpetually issuing patches.

People emotion playing video games for the excitement and challenge. And yet, erstwhile you request to instrumentality instrumentality information — carnal information and spot updates, hardware wallets and firmware updates, and hardware cardinal checks, these actions go tedious and rote. Or forgotten.

The satellite is nary longer astir locking yourself determination safely oregon feeling unafraid arsenic you determination astir successful immoderate area. Technology tin get astatine you wherever you are — astatine home, anyplace you go, and via immoderate you are watching oregon utilizing for convenience.

Convenience is the force of security. Ease and comfortableness are the force of security. Don’t marque your information convenient oregon casual for atrocious actors to infiltrate. If you do, astatine immoderate point, carelessness oregon villains volition get you, and that volition beryllium your loss… of precious bitcoin funds.

This is simply a impermanent station by Heidi Porter. Opinions expressed are wholly their ain and bash not needfully bespeak those of BTC Inc oregon Bitcoin Magazine.