mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/blog-contributions.git
synced 2025-07-02 11:56:40 +00:00
anonproxy + sensitive vm finish
This commit is contained in:
nihilist
parent
d8f1c456ac
commit
0e8b0fcc59
23 changed files with 251 additions and 25 deletions
BIN
opsec/anonproxy/AccessAllowed.jpg
Normal file
BIN
opsec/anonproxy/AccessAllowed.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
BIN
opsec/anonproxy/AccessDenied.jpg
Normal file
BIN
opsec/anonproxy/AccessDenied.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
BIN
opsec/anonproxy/CheckIP.png
Normal file
BIN
opsec/anonproxy/CheckIP.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 50 KiB |
BIN
opsec/anonproxy/Deposit.png
Normal file
BIN
opsec/anonproxy/Deposit.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 71 KiB |
BIN
opsec/anonproxy/FoxyProxyAdd.png
Normal file
BIN
opsec/anonproxy/FoxyProxyAdd.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
BIN
opsec/anonproxy/FoxyProxyInstall.png
Normal file
BIN
opsec/anonproxy/FoxyProxyInstall.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 53 KiB |
BIN
opsec/anonproxy/FoxyProxyInstall2.png
Normal file
BIN
opsec/anonproxy/FoxyProxyInstall2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
BIN
opsec/anonproxy/FoxyProxyOptions.png
Normal file
BIN
opsec/anonproxy/FoxyProxyOptions.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
BIN
opsec/anonproxy/FoxyProxySearch.png
Normal file
BIN
opsec/anonproxy/FoxyProxySearch.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
BIN
opsec/anonproxy/FoxyProxySearch2.png
Normal file
BIN
opsec/anonproxy/FoxyProxySearch2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 58 KiB |
BIN
opsec/anonproxy/InstallAddon.png
Normal file
BIN
opsec/anonproxy/InstallAddon.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
BIN
opsec/anonproxy/Proxy.png
Normal file
BIN
opsec/anonproxy/Proxy.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 61 KiB |
BIN
opsec/anonproxy/ProxyData.png
Normal file
BIN
opsec/anonproxy/ProxyData.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
BIN
opsec/anonproxy/Reg.png
Normal file
BIN
opsec/anonproxy/Reg.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
BIN
opsec/anonproxy/WebsiteAccessed.png
Normal file
BIN
opsec/anonproxy/WebsiteAccessed.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 312 KiB |
BIN
opsec/anonproxy/WebsiteDenied.png
Normal file
BIN
opsec/anonproxy/WebsiteDenied.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
207
opsec/anonproxy/index.html
Normal file
207
opsec/anonproxy/index.html
Normal file
|
|
@ -0,0 +1,207 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<meta name="description" content="">
|
||||
<meta name="author" content="prism_breaker">
|
||||
<link rel="shortcut icon" href="../../../../../../assets/img/favicon.png">
|
||||
|
||||
<title>How to get and use residential proxies anonymously</title>
|
||||
|
||||
<!-- Bootstrap core CSS -->
|
||||
<link href="../../assets/css/bootstrap.css" rel="stylesheet">
|
||||
<link href="../../assets/css/xt256.css" rel="stylesheet">
|
||||
|
||||
|
||||
|
||||
<!-- Custom styles for this template -->
|
||||
<link href="../../assets/css/main.css" rel="stylesheet">
|
||||
|
||||
|
||||
|
||||
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
|
||||
<!--[if lt IE 9]>
|
||||
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
|
||||
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<!-- Static navbar -->
|
||||
<div class="navbar navbar-inverse-anon navbar-static-top">
|
||||
<div class="container">
|
||||
<div class="navbar-header">
|
||||
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
||||
<span class="icon-bar"></span>
|
||||
<span class="icon-bar"></span>
|
||||
<span class="icon-bar"></span>
|
||||
</button>
|
||||
<a class="navbar-brand-anon" href="\index.html">The Nihilism Blog</a>
|
||||
</div>
|
||||
<div class="navbar-collapse collapse">
|
||||
<ul class="nav navbar-nav navbar-right">
|
||||
|
||||
<li><a href="/about.html">About</a></li>
|
||||
<li><a href="/blog.html">Categories</a></li>
|
||||
<li><a href="https://blog.nowhere.moe/donate.html">Donate</a></li>
|
||||
<li><a href="/contact.html">Contact</a></li>
|
||||
</ul>
|
||||
</div><!--/.nav-collapse -->
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- +++++ Posts Lists +++++ -->
|
||||
<!-- +++++ First Post +++++ -->
|
||||
<div id="anon2">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<a href="../index.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>prism_breaker</ba></p>
|
||||
<h1>How to get and use residential proxies anonymously</h1>
|
||||
<p>While Tor is a requirement to protect your anonymity online, some services refuse to be accessed anonymously, and are intentionally blocking connections coming from Tor exits nodes. These services are against your anonymity, but there are still ways to access them anonymously:<p>
|
||||
<img src="AccessDenied.jpg" class="imgRz">
|
||||
<p>A residential proxy will reroute your access through a residential ip address, which makes your connection look like it is coming from your ISP or your mobile carrier.</p>
|
||||
<p><u>Serverside Context:</u> This setup is to be considered only in the case where the destination website also blocks your attempts at connecting there via a <a href="../whenTorisblocked/index.html">(you -> Tor -> VPN -> destination)</a> setup.</p>
|
||||
|
||||
<img src="../torthroughvpn/12.png" class="imgRz">
|
||||
<p> Under this setup you can access those websites that are blocking both Tor and VPN traffic, while still keeping your anonymity intact.</p>
|
||||
<img src="AccessAllowed.jpg" class="imgRz">
|
||||
|
||||
<p style="color: red;">Warning: This setup is not officialy supported by Tor project, it should be considered as experimental. It is still recommended to use the default setup of Whonix and Tor browser for the rest of your anonymous activities online.</p>
|
||||
|
||||
<p>For further details on how you can combine Tor and VPNs to protect your anonymity, refer to <a href="../torthroughvpn/index.html">this tutorial</a></p>
|
||||
|
||||
<p>Other useful reference: <a href="https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_proxy">https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_proxy</a> </p>
|
||||
<p><h2><u>OPSEC Recommendations:</u></h2></p>
|
||||
<ol>
|
||||
<li><p>Hardware : (Personal Computer / Laptop)</p></li>
|
||||
<li><p>Host OS: <a href="../linux/index.html">Linux</a> (Or Qubes OS)</p></li>
|
||||
<li><p>Hypervisor: <a href="../hypervisorsetup/index.html">libvirtd QEMU/KVM</a> (Or Qubes OS's Xen)</p></li>
|
||||
<li><p>Virtual Machine:<a href="../whonixqemuvms/index.html">Whonix</a> (that must be dedicated to the (you -> Tor -> residential proxy -> website) setup </p></li> </ol>
|
||||
</ol>
|
||||
|
||||
</div>
|
||||
</div><!-- /row -->
|
||||
</div> <!-- /container -->
|
||||
</div><!-- /grey -->
|
||||
|
||||
<!-- +++++ Second Post +++++ -->
|
||||
<div id="anon3">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<h2><b>Proxy Purchase</b></h2>
|
||||
<p><p style="color: red;"><u>Warning:</u> Everything below needs to be done inside the dedicated new whonix workstation VM!</p></p>
|
||||
<p><a href="https://smspool.net/">smspool.net</a> is chosen to be the proxy provider for this demo, the author is not affiliated with this service. It is used because it is monero friendly, other service providers should work similarly.</p>
|
||||
<p>First you need to register:</p>
|
||||
<img src="Reg.png" style="width: 400px; height: auto;" class="small">
|
||||
<p>Choose "switch to hCaptcha" otherwise you might get stuck at the cloudflare verification.</p>
|
||||
<p>The next step is to deposit monero into the website and purchase the proxy.</p>
|
||||
<img src="Deposit.png" class="imgRz">
|
||||
<p>When your deposit get credited, purchase the proxy.</p>
|
||||
<img src="Proxy.png" class="imgRz">
|
||||
<p>Now your proxy is ready, check for the details inside "My Proxy" section.</p>
|
||||
<img src="ProxyData.png" class="imgRz">
|
||||
<p>Copy your proxy ip, port, username, password. It will be used later.</p>
|
||||
|
||||
</div>
|
||||
</div><!-- /row -->
|
||||
</div> <!-- /container -->
|
||||
</div><!-- /white -->
|
||||
|
||||
<div id="anon2">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<h2><b>Browser setup</b></h2> </br> </br>
|
||||
<p>Due to an upstream change, the proxy setup method mentioned in whonix tutorial is not working <a href="https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_proxy/Proxy_Settings_Method">https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_proxy/Proxy_Settings_Method</a></p>
|
||||
|
||||
<p>One of the other methods is to use the foxyproxy addon. <b>However please note that installing a plugin will change the Tor browser fingerprint, so it is highly recommended you keep the rest of your anonymous activities in a separate default Whonix Workstation VM.</b> Use this setup only when you are in this specific serverside context.</p>
|
||||
<img src="InstallAddon.png" style="width: 400px; height: auto;" class="imgRz">
|
||||
<p>Choose the "add-ons and themes" in the firefox menu and search for foxyproxy.</p>
|
||||
<img src="FoxyProxySearch.png" class="imgRz">
|
||||
<p></p>
|
||||
<img src="FoxyProxySearch2.png" class="imgRz">
|
||||
|
||||
<p>Install the plugin, pin the plugin and allow it to work in private windows.</p>
|
||||
<img src="FoxyProxyInstall.png" class="imgRz">
|
||||
<P></P>
|
||||
<img src="FoxyProxyInstall2.png" style="width: 400px; height: auto;" class="imgRz">
|
||||
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
</div><!-- /row -->
|
||||
</div> <!-- /container -->
|
||||
</div><!-- /white -->
|
||||
|
||||
|
||||
<!-- +++++ Second Post +++++ -->
|
||||
<div id="anon1">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<h2><b>Connect to Proxy</b></h2> </br> </br>
|
||||
<p>Finally, we will connect to the proxy we just purchased.</p>
|
||||
<p>First find foxyproxy in the menu bar and choose "options".</p>
|
||||
<img src="FoxyProxyOptions.png" style="width: 400px; height: auto;" class="imgRz">
|
||||
<p>Add the proxy information in the "proxy" tab.</p>
|
||||
<img src="FoxyProxyAdd.png" class="imgRz">
|
||||
<p>In this demo, the proxy is HTTP, if you use a different provider and it doesn't work, try to check the protocol. Fill all the info and save it.</p>
|
||||
<p>Now check the website you want to accessed, it is blocked because you are still using the Tor exit node.</p>
|
||||
<img src="WebsiteDenied.png" class="imgRz">
|
||||
<p>Choose the proxy you just added in FoxyProxy button, and reset your Tor browser identity.</p>
|
||||
<p>Now access <a href="https://check.Torproject.org">https://check.Torproject.org</a>, and you should see a warning says you are not using Tor, due to having the connection originating from the residential Proxy IP, <b>this means that you have successfully completed the (you -> Tor -> residential proxy -> website) Setup, effectively hiding that you're using Tor from the destination website.</b></p>
|
||||
<img src="CheckIP.png" class="imgRz">
|
||||
<p>Now try the website that blocks Tor, it should work now if you did everything correctly!</p>
|
||||
<img src="WebsiteAccessed.png" class="imgRz">
|
||||
|
||||
|
||||
</div>
|
||||
</div><!-- /row -->
|
||||
</div> <!-- /container -->
|
||||
</div><!-- /white -->
|
||||
|
||||
<!-- +++++ Footer Section +++++ -->
|
||||
|
||||
<div id="anonb">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-4">
|
||||
<h4>PrismBreaker</h4>
|
||||
<p>
|
||||
Shatter the big brother.</p></br></br><p>Creative Commons Zero: No Rights Reserved</br><img src="\CC0.png">
|
||||
|
||||
</p>
|
||||
</div><!-- /col-lg-4 -->
|
||||
|
||||
<div class="col-lg-4">
|
||||
<h4>My Links</h4>
|
||||
<p>
|
||||
|
||||
<a target="_blank" rel="noopener noreferrer" href="http://blog.nowhere.moe/rss/feed.xml">RSS Feed</a><br/><a target="_blank" rel="noopener noreferrer" href="https://simplex.chat/contact#/?v=2-7&smp=smp%3A%2F%2FL5jrGV2L_Bb20Oj0aE4Gn-m5AHet9XdpYDotiqpcpGc%3D%40nowhere.moe%2FH4g7zPbitSLV5tDQ51Yz-R6RgOkMEeCc%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEAkts5T5AMxHGrZCCg12aeKxWcpXaxbB_XqjrXmcFYlDQ%253D&data=%7B%22type%22%3A%22group%22%2C%22groupLinkId%22%3A%22c3Y-iDaoDCFm6RhptSDOaw%3D%3D%22%7D">SimpleX Chat</a><br/>
|
||||
|
||||
</p>
|
||||
</div><!-- /col-lg-4 -->
|
||||
|
||||
<div class="col-lg-4">
|
||||
<h4>About Prism Breaker</h4>
|
||||
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 87iB34vdFvNULrAjyfVAZ7jMXc8vbq9tLGMLjo6WC8N9Xo2JFaa8Vkp6dwXBt8rK12Xpz5z1rTa9jSfgyRbNNjswHKTzFVh</p></br><p><u>Contact:</u> prismbreaker@waifu.club (<a href="https://keys.openpgp.org/vks/v1/by-fingerprint/735816B2B9E6F4660ECE44D983E602C4B6EA6AEE">PGP</a>)</p>
|
||||
</div><!-- /col-lg-4 -->
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Bootstrap core JavaScript
|
||||
================================================== -->
|
||||
<!-- Placed at the end of the document so the pages load faster -->
|
||||
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -214,7 +214,7 @@
|
|||
<li><a href="anonemail/index.html">✅ How to Get an Email Account Anonymously (Emails as a Service)</a></li>
|
||||
<li><a href="anonsms/index.html">✅ How to Receive Anonymous SMSes (Remote SMSes as a Service)</a></li>
|
||||
<li><a href="https://git.nowhere.moe/nihilist/blog-contributions/issues/28">❌ How to get a credit card anonymously (Credit cards as a service)</a></li>
|
||||
<li><a href="https://git.nowhere.moe/nihilist/blog-contributions/issues/29">❌ How to get residential proxies anonymously</a></li>
|
||||
<li><a href="anonproxy/index.html">✅ How to get residential proxies anonymously</a></li>
|
||||
|
||||
</ol></br>
|
||||
</div>
|
||||
|
|
@ -289,7 +289,7 @@
|
|||
<ol>
|
||||
<li><a href="livemode/index.html">✅ Using the Host-OS in live-mode to enable Sensitive Use</a></li>
|
||||
<li><a href="veracrypt/index.html">✅ The main source of Plausible Deniability: Deniable Encryption</a></li>
|
||||
<li><a href="sensitivevm/index.html">🟠 Sensitive use VMs Setup (Whonix VMs in a Veracrypt Hidden Volume)⭐</a></li>
|
||||
<li><a href="sensitivevm/index.html">✅ Sensitive use VMs Setup (Whonix VMs in a Veracrypt Hidden Volume)⭐</a></li>
|
||||
<li><a href="plausiblydeniabledataprotection/index.html">🟠 Plausibly Deniable Critical Data Backups</a></li>
|
||||
<li><a href="tailsqemuvm/index.html">✅ Tails OS QEMU VM for Temporary Sensitive Use</a></li>
|
||||
</ol></br>
|
||||
|
|
|
|||
Binary file not shown.
|
Before Width: | Height: | Size: 172 KiB After Width: | Height: | Size: 86 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 112 KiB After Width: | Height: | Size: 183 KiB |
BIN
opsec/sensitivevm/40.png
Normal file
BIN
opsec/sensitivevm/40.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 93 KiB |
|
|
@ -70,13 +70,12 @@
|
|||
<p><h2><u>OPSEC Recommendations:</u></h2></p>
|
||||
<ol>
|
||||
<li><p>Hardware : (Personal Computer / Laptop)</p></li>
|
||||
<li><p>Host OS: <a href="../linux/index.html">Linux</a></p></li>
|
||||
<li><p>Host OS: <a href="../linux/index.html">Linux</a>, but in <a href="../livemode/index.html">live mode</a></p></li>
|
||||
<li><p>Hypervisor: <a href="../hypervisorsetup/index.html">libvirtd QEMU/KVM</a></p></li>
|
||||
<li><p>Harddrive (HDD): 500GB and encrypted with <a href="../veracrypt/index.html">Veracrypt (with a 250Gb Hidden Volume)</a></p></li>
|
||||
<li><p>Virtual Machine:<a href="../whonixqemuvms/index.html">Whonix</a></p></li>
|
||||
</ol>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div><!-- /row -->
|
||||
</div> <!-- /container -->
|
||||
</div><!-- /grey -->
|
||||
|
|
@ -86,8 +85,26 @@
|
|||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<h2><b>How to setup the VMs inside the Veracrypt volumes</b></h2> </br> </br>
|
||||
<p>First, we're going to setup our veracrypt volumes on our 500Gb harddrive:</p>
|
||||
<h2><b>Deniability Requirement</b></h2> </br> </br>
|
||||
<p>First of all as you have seen, the requirement is that we do this setup from the Host OS, in <a href="../livemode/index.html">live mode</a>. That is because we want to make sure that there is no forensic evidence to be saved on the system drive as we have explained <a href="../livemode/index.html">previously.</a> </p>
|
||||
|
||||
<img src="../livemode/4.png" class="imgRz">
|
||||
<p>While in Live mode we can't write anything new on the system disk (such as the system logs, kernel logs, non-standard logs) <b>which can all be potential forensic evidence that the hidden volume exists</b>. Instead, everything is written into RAM, and we can easily erase all of those contents with a simple reboot. While in live mode however, we can write to non-system drives, which is where we will setup a big enough veracrypt volume to store the Whonix VMs that we will use for long-term sensitive use.</p>
|
||||
</div>
|
||||
</div><!-- /row -->
|
||||
</div> <!-- /container -->
|
||||
</div><!-- /grey -->
|
||||
|
||||
<!-- +++++ Second Post +++++ -->
|
||||
<div id="anon2">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<h2><b>How to setup the VMs inside the Hidden Volume</b></h2> </br> </br>
|
||||
<p>So before we start, make sure you reboot the Host OS to go into live mode:</p>
|
||||
<img src="../deniability/7.png" class="imgRz">
|
||||
|
||||
<p>Then, once in live mode we're going to setup our veracrypt volumes on our 500Gb harddrive:</p>
|
||||
<img src="2.png" class="imgRz">
|
||||
<img src="3.png" class="imgRz">
|
||||
<p>Here we're using a non-system drive, as we want to be able to store our veracrypt hidden volume contents in a persistent manner, accross reboots. (if we were to have the veracrypt volume on the system drive, it would be wiped off upon rebooting since the Host OS is in live mode.)</p>
|
||||
|
|
@ -119,7 +136,7 @@
|
|||
</div> <!-- /container -->
|
||||
</div><!-- /white -->
|
||||
|
||||
<div id="anon2">
|
||||
<div id="anon3">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
|
|
@ -313,7 +330,7 @@ Network Whonix-Internal has been undefined
|
|||
</div> <!-- /container -->
|
||||
</div><!-- /white -->
|
||||
|
||||
<div id="anon1">
|
||||
<div id="anon2">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
|
|
@ -373,12 +390,12 @@ kill -9 $(pidof vlc)
|
|||
</div> <!-- /container -->
|
||||
</div><!-- /white -->
|
||||
|
||||
<div id="anon2">
|
||||
<div id="anon3">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<h2><b>Emergency shutdown script setup</b></h2> </br> </br>
|
||||
<p>Now that we're done setting up both the hidden and the decoy volumes, we're going to setup the script that will launch either of the 2 script.sh scripts we just wrote, on top of also erasing all potential proof that the sensitive VM exists (meaning we erase all logs, all kernel logs, we fill the ram with random content 3 times, and we erase the command history): </p>
|
||||
<h2><b>Emergency shutdown shortcut</b></h2> </br> </br>
|
||||
<!--<p>Now that we're done setting up both the hidden and the decoy volumes, we're going to setup the script that will launch either of the 2 script.sh scripts we just wrote, on top of also erasing all potential proof that the sensitive VM exists (meaning we erase all logs, all kernel logs, we fill the ram with random content 3 times, and we erase the command history): </p>
|
||||
<p>First we need to make sure we can run veracrypt commands without requiring to be a sudo user:</p>
|
||||
<pre><code class="nim">
|
||||
[ nowhere ] [ /dev/pts/1 ] [/mnt]
|
||||
|
|
@ -514,15 +531,15 @@ stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f
|
|||
[ nowhere ] [ /dev/pts/1 ] [~]
|
||||
→ chmod +x wipe.sh
|
||||
|
||||
</pre></code>
|
||||
</pre></code>-->
|
||||
<p>Now that we're setup, we need to be able to run that script using a shortcut to be ran from our desktop environment, I am currently using Cinnamon, therefore to create a shortcut for cinnamon you do as follows:</p>
|
||||
<img src="30.png" class="imgRz">
|
||||
<img src="31.png" class="imgRz">
|
||||
<!--<img src="31.png" class="imgRz">
|
||||
<img src="32.png" class="imgRz">
|
||||
<p>So basically from here, if you are not in a QEMU VM, you simply need to hit the shortcut <b>"SUPER+R"</b>.</p>
|
||||
<p>If you are focused in a QEMU VM, you need to do <b>"CTRL+ALT"</b> (to focus out of the QEMU VM), and then <b>"SUPER+R"</b> to run the wipe.sh script from the Host OS.</p>
|
||||
<p>If you are focused in a QEMU VM, you need to do <b>"Ctrl+Alt"</b> (to focus out of the QEMU VM), and then <b>"SUPER+R"</b> to run the wipe.sh script from the Host OS.</p>-->
|
||||
<img src="37.png" class="imgRz">
|
||||
<p>Now i'm also going to setup an optional shortcut <b>"Super+V"</b> to only run the /mnt/veracrypt1/script.sh script just so it is easier to setup the whonix VMs when inside the veracrypt hidden volume.</p>
|
||||
<p>Now we're setting up the shortcut <b>"Super+V"</b> to run the <b>/mnt/veracrypt1/script.sh</b> script just so it is quicker to setup the whonix VMs when inside the veracrypt hidden volume. Now to shut down the Host OS, there is already a default cinnamon shortcut which is <b>"Ctrl+Alt+End"</b>.</p>
|
||||
<img src="36.png" class="imgRz">
|
||||
<p>And we're now all setup! So let's try it out in both scenarios (from the decoy volume, and from the hidden volume):</p>
|
||||
</div>
|
||||
|
|
@ -543,19 +560,19 @@ stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f
|
|||
<p>Then we open VLC, and we hit "Open file" and browse to our non-sensitive files:</p>
|
||||
<img src="33.png" class="imgRz">
|
||||
<img src="34.png" class="imgRz">
|
||||
<p>Then suddenly someone busts your front door, and you quickly press <b>"Super+R"</b>, the VLC window immediately closes, and in 4 seconds you have the Veracrypt volume unmounted and the veracrypt window closed. Meanwhile the wipe.sh script is doing the remaining cleaning up operations in the background, which it will complete under 30 seconds.</p>
|
||||
<p>Then suddenly someone busts your front door, and you quickly press <b>"Super+V"</b> the VLC window immediately closes, and then <b>"Ctrl+Alt+End"</b> and in a few seconds you have the Host OS shutting down. And as the Host OS shuts down, all the RAM contents are erased (even though there was nothing sensitive in it this time).</p>
|
||||
<img src="" class="imgRz">
|
||||
<p>And that's it ! if the adversary didnt get to your desk by the time you pressed the shortcut, he didnt get to see the content you were playing on your monitor. </p>
|
||||
|
||||
<h2><b>Hidden Volume Scenario (using the sensitive VM)</b></h2>
|
||||
<p></p>
|
||||
<p>Now to test emergency shutdown on the hidden volume side, we first open the hidden volume:</p>
|
||||
<img src="23.png" class="imgRz">
|
||||
<img src="24.png" class="imgRz">
|
||||
<p>Once the hidden volume is mounted, we hit <b>"Super+V"</b> to quickly setup the whonix VMs:</p>
|
||||
<img src="38.png" class="imgRz">
|
||||
<p>And after a while of doing some actual sensitive stuff on the whonix VM you hear your front door being busted down, so you quickly hit <b>"CTRL+ALT"</b> to focus out of the VM, and then you hit <b>"Super+R"</b> to trigger the emergency shutdown procedure:</p>
|
||||
<p>And after a while of doing some actual sensitive stuff on the whonix VM you hear your front door being busted down, so you quickly hit <b>"Ctrl+Alt"</b> to focus out of the VM, and then you hit <b>"Ctrl+Alt+End"</b> to trigger the emergency shutdown:</p>
|
||||
<img src="39.png" class="imgRz">
|
||||
<p>Here it also only takes 4 seconds after pressing <b>"Super+R"</b> to have your whonix VMs shutdown, and the veracrypt hidden volume closed, with the veracrypt window closed. And in the background, the script doing the remaining cleaning steps which will take 30 seconds to complete.</p>
|
||||
<p>Here it also only takes approximately 4 seconds after pressing <b>"Ctrl+Alt+End"</b> to have your Host OS shutdown, erasing all the forensic evidence regarding the existence of the veracrypt hidden volume and the Sensitive Whonix VM it contains.</p>
|
||||
<p>And that's it ! You now have a Sensitive VM ready to be used, and you have implemented the necessary measures to protect the deniability of it's existance, from an adversary.</p>
|
||||
</div>
|
||||
</div><!-- /row -->
|
||||
|
|
@ -569,7 +586,9 @@ stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f
|
|||
<div class="row">
|
||||
<div class="col-lg-8 col-lg-offset-2">
|
||||
<h2><b>In what context is there Deniability ?</b></h2>
|
||||
<p>With this setup, you have deniability the moment that the script finishes running, regarding the existance of the veracrypt hidden volume, and the whonix sensitive VMs. <b>Meaning that it is impossible for an adversary that seizes your computer to prove the existance of the Whonix Sensitive VMs after the wipe.sh script finished running.</b></p>
|
||||
<p>With this setup, you have deniability the moment that the script finishes running, regarding the existance of the veracrypt hidden volume, and the whonix sensitive VMs. <b>Meaning that it is impossible for an adversary that seizes your computer to prove the existance of the Whonix Sensitive VMs after shutting down the Host OS.</b></p>
|
||||
<p>Below is all an adversary will be able to see, if he were to seize your laptop after you manage to shut it down:</p>
|
||||
<img src="40.png" class="imgRz">
|
||||
<p>Of course, if you are ever forced to, <b>ONLY give your decoy password to the adversary.</b> The existance of the hidden volume, and of the secret password thats used to reveal it must remain a secret at all costs, it must remain known only by you.</p>
|
||||
<p>If you are ever dragged into court, <b>the judge will appreciate much more if you actually hand over your laptop, and show that you are willing to cooperate with the authorities by providing your password to unlock it</b>, rather than starting to pretend you forgot your password (which can end badly like in <a href="https://lawblog.legalmatch.com/2018/07/23/florida-man-jailed-allegedly-forgetting-password-on-cell-phones/">this court case</a>, where the defendant was found to be in contempt of court, and thrown in jail for 6 months for it). </p>
|
||||
<p>If ever asked by the authorities on why you used veracrypt in your laptop, you can simply claim that it was to put your stash of adult content in it. Nothing incriminating about it, and it is plausible given that you dont want that laying around on your desktop, due to being of a private matter.</p>
|
||||
|
|
|
|||
|
|
@ -119,16 +119,16 @@ regarding wear leveling:
|
|||
→ veracrypt
|
||||
|
||||
</code></pre>
|
||||
<p>So now that you have veracrypt installed, before you start to use veracrypt, you need to be aware of the lack of deniability you have when using the Host OS in regular mode:</p>
|
||||
<p>So now that you have veracrypt installed, before you start to use it, you need to be aware of the lack of deniability you have when using the Host OS in regular mode:</p>
|
||||
<img src="../livemode/3.png" class="imgRz">
|
||||
<p>By default, your host OS directly writes into the system drive all sorts of potential forensic evidence that an adversary may use against you, such as system logs, kernel logs, non-standard logs, etc, and unless if you manually remove each of those manually, you're never sure of wether or not Host OS saved proof of the existence of the hidden volume onto the system drive. <b>That's why you need to use the Host OS in <a href="../livemode/index.html">live mode</a>, to be able to use veracrypt.</b></p>
|
||||
<p>By default, your host OS directly writes into the system drive all sorts of potential forensic evidence that an adversary may use against you, such as system logs, kernel logs, non-standard logs, etc, and unless if you remove each of those manually, you're never sure of wether or not the Host OS saved proof of the existence of the hidden volume onto the system drive. <b>That's why you need to use the Host OS in <a href="../livemode/index.html">live mode</a>, to be able to use veracrypt.</b></p>
|
||||
<img src="../livemode/4.png" class="imgRz">
|
||||
<p>That way, as you're loading the entire host OS in the RAM due to being in live mode, you are not writing anything on the system drive anymore, <b>but rather only writing all that potential forensic evidence of the veracrypt hidden volume <u>in RAM alone</u>, which can be easily erased with a simple shutdown</b>.</p>
|
||||
<p>So now that we have installed veracrypt, let's reboot the Host OS into live mode:</p>
|
||||
<img src="../livemode/2.png" class="imgRz">
|
||||
<img src="../deniability/7.png" class="imgRz">
|
||||
|
||||
|
||||
<p><b>And only now once we are in live mode, we can use veracrypt to create drives.</b> But be aware that everything you write into the system drive will be wiped upon shutting down, <b>if you want to store something persistent accross reboots from live mode, you need to save it in a non-system drive.</b></p>
|
||||
<p><b>And only now once we are in live mode, we can use veracrypt to create hidden encrypted volumes and unlock them.</b> But be aware that everything you write into the system drive will be wiped upon shutting down, <b>if you want to store something persistent accross reboots from live mode, you need to save it in a non-system drive.</b></p>
|
||||
<p> So now from there we can create the encrypted volumes (either as files or as entire drives). In this example we'll create an encrypted file: </p>
|
||||
<img src="2.png" class="imgRz">
|
||||
<p>Here we select that we want a Hidden veracrypt volume as well (which will be able to deny it's existence).</p>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue