-
nothing@debian-tests:~$ lsblk
@@ -257,6 +256,49 @@ this is a test file written from live mode, into a non-system drive!
+
+
+
+
+ Emergency Shutdown Script
+Now in order to make sure we can shutdown the Host OS quickly, we need to have an emergency shutdown script, that can be ran by a non-root user in order to immediately shutdown the Host OS whenever we need it.
+
+First we need to make sure the user is able to run the shutdown command:
+
+nothing@debian:~$ su -
+Password:
+root@debian:~# visudo
+
+
+[...]
+
+nothing ALL=NOPASSWD:/sbin/shutdown
+nothing ALL=NOPASSWD:/sbin/reboot
+
+[...]
+
+
+Then we create a simple shutdown.sh script:
+
+nothing@debian:~$ vim shutdown.sh
+nothing@debian:~$ cat shutdown.sh
+#!/bin/bash
+
+/sbin/shutdown -h now
+
+nothing@debian:~$ chmod +x shutdown.sh
+
+
+Then, you need to hook it up to a shortcut, such as Super+R, i'm going to do it in Cinnamon as this is the Desktop Environment i use:
+
+
+And thats it! you now you have a shortcut that you can use to immediately shutdown the Host OS.
+
+
+
+
+
+
diff --git a/opsec/sensitivevm/0.png b/opsec/sensitivevm/0.png
index 6b695d2..0cb9d2c 100644
Binary files a/opsec/sensitivevm/0.png and b/opsec/sensitivevm/0.png differ
diff --git a/opsec/sensitivevm/41.png b/opsec/sensitivevm/41.png
new file mode 100644
index 0000000..d080a53
Binary files /dev/null and b/opsec/sensitivevm/41.png differ
diff --git a/opsec/sensitivevm/42.png b/opsec/sensitivevm/42.png
new file mode 100644
index 0000000..8fa570b
Binary files /dev/null and b/opsec/sensitivevm/42.png differ
diff --git a/opsec/sensitivevm/index.html b/opsec/sensitivevm/index.html
index e2a756b..43cf0b6 100644
--- a/opsec/sensitivevm/index.html
+++ b/opsec/sensitivevm/index.html
@@ -539,8 +539,50 @@ stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f
So basically from here, if you are not in a QEMU VM, you simply need to hit the shortcut "SUPER+R".
If you are focused in a QEMU VM, you need to do "Ctrl+Alt" (to focus out of the QEMU VM), and then "SUPER+R" to run the wipe.sh script from the Host OS.
-->
-Now we're setting up the shortcut "Super+V" to run the /mnt/veracrypt1/script.sh script just so it is quicker to setup the whonix VMs when inside the veracrypt hidden volume. Now to shut down the Host OS, there is already a default cinnamon shortcut which is "Ctrl+Alt+End".
+Now we're setting up the shortcut "Super+V" to run the /mnt/veracrypt1/script.sh script just so it is quicker to setup the whonix VMs when inside the veracrypt hidden volume.
+
+ Now in order to shut down the Host OS, as we have explained previously, we need to have the emergency shutdown bashscript script:
+
+nihilist@mainpc:~$ su -
+Password:
+root@mainpc:~# visudo
+
+[...]
+
+nihilist ALL=NOPASSWD:/sbin/shutdown
+
+[...]
+
+nihilist@mainpc:~$ vim shutdown.sh
+nihilist@mainpc:~$ cat shutdown.sh
+#!/bin/bash
+
+/sbin/shutdown -h now
+
+nihilist@mainpc:~$ chmod +x shutdown.sh
+
+
+However we're going to edit it a bit to run the script.sh, along with closing down the veracrypt volumes before shutting down the Host OS, so we need to edit the shutdown.sh script as follows:
+
+nihilist@mainpc:~$ cat shutdown.sh
+#!/bin/bash
+
+# run script.sh
+/mnt/veracrypt1/script.sh
+
+# unmount veracrypt volumes
+/usr/bin/veracrypt -d -f
+
+# kill veracrypt after unmounting
+kill $(pidof veracrypt)
+
+# shutdown the host OS
+/sbin/shutdown -h now
+
+
+Then, we need to make sure that the shutdown.sh script can be ran with the "Super+R" shortcut:
+
And we're now all setup! So let's try it out in both scenarios (from the decoy volume, and from the hidden volume):
@@ -560,7 +602,7 @@ stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f
Then we open VLC, and we hit "Open file" and browse to our non-sensitive files:
-Then suddenly someone busts your front door, and you quickly press "Super+V" the VLC window immediately closes, and then "Ctrl+Alt+End" and in a few seconds you have the Host OS shutting down. And as the Host OS shuts down, all the RAM contents are erased (even though there was nothing sensitive in it this time).
+Then suddenly someone busts your front door, and you quickly press "Super+R" the VLC window immediately closes, followed by the closure of the veracrypt volume, and in a few seconds you have the Host OS shutting down. And as the Host OS shuts down, all the RAM contents are erased (even though there was nothing sensitive in it this time).
![]()
And that's it ! if the adversary didnt get to your desk by the time you pressed the shortcut, he didnt get to see the content you were playing on your monitor.
@@ -570,9 +612,9 @@ stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f
Once the hidden volume is mounted, we hit "Super+V" to quickly setup the whonix VMs:
-And after a while of doing some actual sensitive stuff on the whonix VM you hear your front door being busted down, so you quickly hit "Ctrl+Alt" to focus out of the VM, and then you hit "Ctrl+Alt+End" to trigger the emergency shutdown:
-
-Here it also only takes approximately 4 seconds after pressing "Ctrl+Alt+End" to have your Host OS shutdown, erasing all the forensic evidence regarding the existence of the veracrypt hidden volume and the Sensitive Whonix VM it contains.
+And after a while of doing some actual sensitive stuff on the whonix VM you hear your front door being busted down, so you quickly hit "Ctrl+Alt" to focus out of the VM, and then you hit "Super+R" to trigger the emergency shutdown:
+
+Here it also only takes approximately 4 seconds after pressing "Super+R" to have the VMs removed, the veracrypt volume closed, and your Host OS shutdown, erasing all the forensic evidence regarding the existence of the veracrypt hidden volume and the Sensitive Whonix VM that it contains.
And that's it ! You now have a Sensitive VM ready to be used, and you have implemented the necessary measures to protect the deniability of it's existance, from an adversary.
diff --git a/opsec/veracrypt/index.html b/opsec/veracrypt/index.html
index 11a11f6..bacfbbb 100644
--- a/opsec/veracrypt/index.html
+++ b/opsec/veracrypt/index.html
@@ -65,6 +65,7 @@
VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. It is based on Truecrypt, This tool will be used for Plausible Deniability.
But why is Plausible Deniability important first of all ? From a legal perspective, depending on jurisdictions, you may be forced to type your password into an encrypted drive if requested. All it takes is for an adversary to be able to prove the existence of an encrypted drive to be able to force you to reveal the password to unlock it. Hence for example the regular LUKS encryption is not enough, because you need to be able to deny the existence of the encrypted volume. If that is the case, we have to use Veracrypt, which is an encryption tool used to provide protection (which is Plausible Deniability) against that scenario where you're forced to provide a password.
+
DISCLAIMER: we're using only harddrives (HDDs) here, because using SSDs are not a secure way to have Plausible Deniability, that is due to hidden Volumes being detectable on devices that utilize wear-leveling