oxeo0/blog-contributions
1
0
Fork 0
mirror of http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/blog-contributions.git synced 2025-07-02 06:46:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

context and assumptions section

Browse source
This commit is contained in:
midas 2025-01-22 16:46:29 +01:00
parent 1a5daa1371
commit 71c08752af
1 changed files with 25 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

35
opsec/cloud_provider_adversary/index.html
View file

@ -93,20 +93,35 @@ in this post we are going to do a threat modelling exercise:<br><br>
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<p>
<h2> <b>Attack Scenario</b> </h2>
<h1>Context and assumptions</h1>
The adversary has identified a probable city of residence for the administrator of a hidden service. In order to narrow down their search perimeter they will do the following:
<h2>Setting up the scene</h2>
<br>
Alice wishes to start hosting a coordination platform for her activist group, but she doesn't want to host the platform herself for the following reasons:
<ol>
<li>Target 1 group of city block and send someone to the internet backbone for this city block to cut it off from the internet</li>
<li>Check whether the onion service <b>is still up</b></li>
<li>If it goes down, add it to the suspect pool</li>
</ol>
<ul>
<li>Shes does not want to have incriminating data in her house</li>
<li>She is unable to provide the required level if high availability for her group's safety and operational standards</li>
<li>She has limited bandwidth/electricity to devote to her cause</li>
</ul>
<br>
<br>
She gets in touch with Bob, owner and operator of Bob's friendly datacenter, and orders from him a VPS (Virtual Private Server). Bob's pretty open-minded so Alice is free to use whatever OS she wants, gets a public IP.
<br><br>
<h2>Enters Leo</h2>
One day Bob's phone rings, it's Leo calling! Leo asks Bob to confirm that he indeed has Alice as a customer. Without further ado, Leo pays Bob a visit! After entering the premises and showing a government agency badge, Leo asks for complete access to Bob's infrastructure and binds him with a gag order to make sure no one hears about his investigation. Even if Bob is sympathetic to Alice or wishes to protect his customers he would now run afoul of his country's laws if he were to warn them. Leo might have been nice to him but he is not to be trifled with...
<h2> Leo sets up shop </h2>
Commandeering an office in Bob's datacenter, Leo gets to work. He has plenty of options:
<ol>
<li>Network sniffing: Leo can capture and log ALL trafic related to Alice's activity inside Bob's datacenter, so he will know the IP of everyone interacting with her platform</li>
<li>Firmware/hardware attacks: during maintenance windows, Leo could tamper with the BIOS/UEFI of Alice's server (if she had chosen a bare-metal option), or with her server's storage devices in order to deactivate encryption</li>
<li>Memory attacks: Leo is able to take snapshots of Alice's VPS RAM to gather information about her activities. If she had chosen a bare-metal server he could cut the power, extract and refrigerate the RAM sticks in order to retrieve the data, but such an attack would be very conspicuous</li>
</ol>
</p>
</div>
</div><!-- /row -->