diff --git a/opsec/sensitivevm/0.png b/opsec/sensitivevm/0.png index 0cb9d2c..beac70b 100644 Binary files a/opsec/sensitivevm/0.png and b/opsec/sensitivevm/0.png differ diff --git a/opsec/sensitivevm/40.png b/opsec/sensitivevm/40.png index 6014cfd..d876938 100644 Binary files a/opsec/sensitivevm/40.png and b/opsec/sensitivevm/40.png differ diff --git a/opsec/sensitivevm/43.png b/opsec/sensitivevm/43.png new file mode 100644 index 0000000..cb4acca Binary files /dev/null and b/opsec/sensitivevm/43.png differ diff --git a/opsec/sensitivevm/index.html b/opsec/sensitivevm/index.html index 43cf0b6..6178d0e 100644 --- a/opsec/sensitivevm/index.html +++ b/opsec/sensitivevm/index.html @@ -85,7 +85,7 @@
-

Deniability Requirement



+

Deniability Requirements



First of all as you have seen, the requirement is that we do this setup from the Host OS, in live mode. That is because we want to make sure that there is no forensic evidence to be saved on the system drive as we have explained previously.

@@ -101,10 +101,39 @@

How to setup the VMs inside the Hidden Volume



-

So before we start, make sure you reboot the Host OS to go into live mode:

- +

So before we start, make sure you reboot the Host OS to go into live mode

-

Then, once in live mode we're going to setup our veracrypt volumes on our 500Gb harddrive:

+ +

or boot from a usb stick that has a debian live image if you are in the usecase where the adversary can't be told you are using kicksecure packages:

+ + +

Then, once in live mode if you are in the usecase where you cannot reveal to the adversary that there is veracrypt installed on the host OS, make sure you install it everytime you boot into live mode. To do speed up the installation process we're going to use the VPS we showcased previously to install both veracrypt and the emergency shutdown script:

+ +

+nothing@debian:~$  scp root@65.109.30.253:/root/sensitive_scripts/vc.deb .
+root@65.109.30.253's password:
+vc.deb                                                                                                                                                                                                        100% 8995KB   1.9MB/s   00:04
+
+nothing@debian:~$  sudo dpkg -i vc.deb
+
+nothing@debian:~$  sudo apt install -f
+
+nothing@debian:~$  sudo dpkg -i vc.deb
+
+nothing@debian:~$  which veracrypt
+/usr/bin/veracrypt
+
+nothing@debian:~$  scp root@65.109.30.253:/root/sensitive_scripts/shutdown.sh .
+
+nothing@debian:~$  chmod +x shutdown.sh
+
+nothing@debian:~$  veracrypt
+
+

We briefly make sure that the shutdown.sh script is hooked up to the SUPER+R key to make sure we can quickly shutdown the computer in case if an adversary were to bust down our door:

+ + + +

And now that we did the post-live-boot initial setup, we can start to setup our veracrypt volumes on our 500Gb harddrive:

Here we're using a non-system drive, as we want to be able to store our veracrypt hidden volume contents in a persistent manner, accross reboots. (if we were to have the veracrypt volume on the system drive, it would be wiped off upon rebooting since the Host OS is in live mode.)

@@ -335,6 +364,7 @@ Network Whonix-Internal has been undefined

Setting up the Decoy volume



+

If you are in the usecase where you cannot reveal to the adversary that you have veracrypt installed (meaning veracrypt will only be installed in live mode) you can skip this entire section. As the adversary won't even be aware that the non-system drive is encrypted using veracrypt.

Now that we have setup the hidden volume, let's close it so that we can setup the decoy volume (dont forget to exit the drive from the commandline, otherwise veracrypt will complain that the drive is busy):


 [ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
@@ -581,6 +611,13 @@ kill $(pidof veracrypt)
 /sbin/shutdown -h now
+

before we continue, dont forget to update it on your VPS, so you can reuse it next time:

+ +

+nihilist@mainpc:~$ scp shutdown.sh root@65.109.30.253:/root/sensitive_scripts/shutdown.sh
+
+
+

Then, we need to make sure that the shutdown.sh script can be ran with the "Super+R" shortcut:

And we're now all setup! So let's try it out in both scenarios (from the decoy volume, and from the hidden volume):

@@ -591,11 +628,12 @@ kill $(pidof veracrypt) -
+

Decoy Volume Scenario (watching non-sensitive content)

+

As stated before, this part is relevant only if you are in the usecase where veracrypt remains installed on the host OS outside of live mode. You can skip that part if you are keeping veracrypt installed only in live mode.

So first we open the veracrypt, and open the decoy volume:

@@ -623,18 +661,22 @@ kill $(pidof veracrypt) -
+

In what context is there Deniability ?

With this setup, you have deniability the moment that the Host OS finishes shutting down, regarding the existance of the veracrypt hidden volume, and the whonix sensitive VMs that are in it. Meaning that it is impossible for an adversary that seizes your computer to prove the existance of the Whonix Sensitive VMs after the Host OS finished shutting down.

-

Below is all an adversary will be able to see, if he were to seize your laptop after you manage to shut it down:

+

If you leave veracrypt and shutdown.sh on the host OS, below is all an adversary will be able to see , if he were to seize your laptop after you manage to shut it down:

Of course, if you are ever forced to, ONLY give your decoy password to the adversary. The existance of the hidden volume, and of the secret password thats used to reveal it must remain a secret at all costs, it must remain known only by you.

If you are ever dragged into court, the judge will appreciate much more if you actually hand over your laptop, and show that you are willing to cooperate with the authorities by providing your password to unlock it, rather than starting to pretend you forgot your password (which can end badly like in this court case, where the defendant was found to be in contempt of court, and thrown in jail for 6 months for it).

If ever asked by the authorities on why you used veracrypt in your laptop, you can simply claim that it was to put your stash of adult content in it. Nothing incriminating about it, and it is plausible given that you dont want that laying around on your desktop, due to being of a private matter.

+

Now in the usecase where you are not leaving veracrypt and shutdown.sh on the host OS, below is what the adversary can see:

+ +

Since there is no emergency shutdown script, nor any Veracrypt to be found. The adversary can't figure out that the non-system drive has been encrypted with Veracrypt, nor that you are hiding anything in it, all that the adversary can see is that the drive is filled with random meaningless data.

+
diff --git a/opsec/veracrypt/index.html b/opsec/veracrypt/index.html index 054110e..9dcc284 100644 --- a/opsec/veracrypt/index.html +++ b/opsec/veracrypt/index.html @@ -103,7 +103,7 @@ regarding wear leveling: 

 [ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-→ wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-1.26.7-Debian-12-amd64.deb
+→ wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-1.26.7-Debian-12-amd64.deb -O vc.deb

If you are using a VPS to help speed up the initial setup everytime you boot into live mode like we have showcased previously, you can also use it to store the veracrypt .deb file for you, to make it easier to retrieve each time:

@@ -153,13 +153,13 @@ vc.deb: Debian binary package (format 2.0), with control.tar.gz, data compressio

And then to install it you can do it like so:


 [ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-→ sudo dpkg -i veracrypt-1.26.7-Debian-12-amd64.deb
+→ sudo dpkg -i vc.deb
 
 [ mainpc ] [ /dev/pts/1 ] [~/Downloads]
 → sudo apt install -f
 
 [ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-→ sudo dpkg -i veracrypt-1.26.7-Debian-12-amd64.deb
+→ sudo dpkg -i vc.deb
 	
 [ mainpc ] [ /dev/pts/1 ] [~/Downloads]
 → which veracrypt