diff --git a/graphs/.$opsec-main-tutorials.drawio.bkp b/graphs/.$opsec-main-tutorials.drawio.bkp index 6e5f2cd..35f05dd 100644 --- a/graphs/.$opsec-main-tutorials.drawio.bkp +++ b/graphs/.$opsec-main-tutorials.drawio.bkp @@ -1,6 +1,6 @@ - + @@ -204,10 +204,10 @@ - + - + @@ -302,17 +302,10 @@ - - - - - - - - - - - + + + + @@ -322,6 +315,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/graphs/opsec-main-tutorials.drawio b/graphs/opsec-main-tutorials.drawio index 2710a6e..5084412 100644 --- a/graphs/opsec-main-tutorials.drawio +++ b/graphs/opsec-main-tutorials.drawio @@ -1,6 +1,6 @@ - + @@ -204,10 +204,10 @@ - + - + @@ -299,21 +299,14 @@ + + + + + - - - - - - - - - - - - @@ -322,6 +315,113 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/opsec/index.html b/opsec/index.html index 9dbee75..31cfe93 100644 --- a/opsec/index.html +++ b/opsec/index.html @@ -116,7 +116,7 @@

πŸ’» Getting started

    -
  1. βœ… How to have Privacy on your Computer (Kicksecure) ⭐
    2. +
  2. βœ… How to have Privacy on your Computer (Kicksecure) ⭐
  3. βœ… How to have Privacy on your Phone (GrapheneOS)
  4. ❌ How to have Privacy on your Router (Openwrt)
  5. 🚧 Easy Private Chats - SimpleX
    6. @@ -311,8 +311,8 @@

    πŸ’» Clientside - Getting Started

    1. βœ… Tails OS for Easy Temporary Sensitive Use
      2. -
    2. βœ… Using the Host-OS in live-mode to enable Sensitive Use
      3. -
    3. 🚧 The main source of Plausible Deniability: Deniable Encryption
      4. +
    4. βœ… Using the Host-OS in live-mode to enable Sensitive Use
      5. +
    5. βœ… The main source of Plausible Deniability: Deniable Encryption
    6. 🚧 Sensitive use VMs Setup (Whonix VMs in a Veracrypt Hidden Volume)⭐
    7. 🚧 Plausibly Deniable Critical Data Backups

    diff --git a/opsec/veracrypt/0.png b/opsec/veracrypt/0.png index 313735c..862866d 100644 Binary files a/opsec/veracrypt/0.png and b/opsec/veracrypt/0.png differ diff --git a/opsec/veracrypt/1.png b/opsec/veracrypt/1.png index 3913ecb..0a32859 100644 Binary files a/opsec/veracrypt/1.png and b/opsec/veracrypt/1.png differ diff --git a/opsec/veracrypt/10.png b/opsec/veracrypt/10.png index 23397ca..cb9f5f6 100644 Binary files a/opsec/veracrypt/10.png and b/opsec/veracrypt/10.png differ diff --git a/opsec/veracrypt/11.png b/opsec/veracrypt/11.png index 4b63381..c69fc9d 100644 Binary files a/opsec/veracrypt/11.png and b/opsec/veracrypt/11.png differ diff --git a/opsec/veracrypt/12.png b/opsec/veracrypt/12.png index af78f4f..8f38fdc 100644 Binary files a/opsec/veracrypt/12.png and b/opsec/veracrypt/12.png differ diff --git a/opsec/veracrypt/13.png b/opsec/veracrypt/13.png index 277e45f..7e4db51 100644 Binary files a/opsec/veracrypt/13.png and b/opsec/veracrypt/13.png differ diff --git a/opsec/veracrypt/14.png b/opsec/veracrypt/14.png index 8f0d1b0..2b2a50f 100644 Binary files a/opsec/veracrypt/14.png and b/opsec/veracrypt/14.png differ diff --git a/opsec/veracrypt/15.png b/opsec/veracrypt/15.png index 7f0220c..8090bba 100644 Binary files a/opsec/veracrypt/15.png and b/opsec/veracrypt/15.png differ diff --git a/opsec/veracrypt/16.png b/opsec/veracrypt/16.png index fe3f11b..5f7515b 100644 Binary files a/opsec/veracrypt/16.png and b/opsec/veracrypt/16.png differ diff --git a/opsec/veracrypt/17.png b/opsec/veracrypt/17.png index f92bf3a..d10fd6a 100644 Binary files a/opsec/veracrypt/17.png and b/opsec/veracrypt/17.png differ diff --git a/opsec/veracrypt/18.png b/opsec/veracrypt/18.png index 9440edd..7c465fb 100644 Binary files a/opsec/veracrypt/18.png and b/opsec/veracrypt/18.png differ diff --git a/opsec/veracrypt/19.png b/opsec/veracrypt/19.png index 910ab72..bfbb9d4 100644 Binary files a/opsec/veracrypt/19.png and b/opsec/veracrypt/19.png differ diff --git a/opsec/veracrypt/2.png b/opsec/veracrypt/2.png index 309d47e..54ac1a4 100644 Binary files a/opsec/veracrypt/2.png and b/opsec/veracrypt/2.png differ diff --git a/opsec/veracrypt/20.png b/opsec/veracrypt/20.png index 2f066f7..d82740c 100644 Binary files a/opsec/veracrypt/20.png and b/opsec/veracrypt/20.png differ diff --git a/opsec/veracrypt/21.png b/opsec/veracrypt/21.png index 73c1a7d..90e74a2 100644 Binary files a/opsec/veracrypt/21.png and b/opsec/veracrypt/21.png differ diff --git a/opsec/veracrypt/22.png b/opsec/veracrypt/22.png deleted file mode 100644 index 0ec3664..0000000 Binary files a/opsec/veracrypt/22.png and /dev/null differ diff --git a/opsec/veracrypt/3.png b/opsec/veracrypt/3.png index ab81a17..4a3fff6 100644 Binary files a/opsec/veracrypt/3.png and b/opsec/veracrypt/3.png differ diff --git a/opsec/veracrypt/31.png b/opsec/veracrypt/31.png new file mode 100644 index 0000000..4580a82 Binary files /dev/null and b/opsec/veracrypt/31.png differ diff --git a/opsec/veracrypt/32.png b/opsec/veracrypt/32.png new file mode 100644 index 0000000..7c1267a Binary files /dev/null and b/opsec/veracrypt/32.png differ diff --git a/opsec/veracrypt/33.png b/opsec/veracrypt/33.png new file mode 100644 index 0000000..906e166 Binary files /dev/null and b/opsec/veracrypt/33.png differ diff --git a/opsec/veracrypt/34.png b/opsec/veracrypt/34.png new file mode 100644 index 0000000..0f52827 Binary files /dev/null and b/opsec/veracrypt/34.png differ diff --git a/opsec/veracrypt/35.png b/opsec/veracrypt/35.png new file mode 100644 index 0000000..4c269a0 Binary files /dev/null and b/opsec/veracrypt/35.png differ diff --git a/opsec/veracrypt/36.png b/opsec/veracrypt/36.png new file mode 100644 index 0000000..67b9920 Binary files /dev/null and b/opsec/veracrypt/36.png differ diff --git a/opsec/veracrypt/37.png b/opsec/veracrypt/37.png new file mode 100644 index 0000000..70d82ba Binary files /dev/null and b/opsec/veracrypt/37.png differ diff --git a/opsec/veracrypt/38.png b/opsec/veracrypt/38.png new file mode 100644 index 0000000..4dd42c7 Binary files /dev/null and b/opsec/veracrypt/38.png differ diff --git a/opsec/veracrypt/39.png b/opsec/veracrypt/39.png new file mode 100644 index 0000000..00ba60c Binary files /dev/null and b/opsec/veracrypt/39.png differ diff --git a/opsec/veracrypt/4.png b/opsec/veracrypt/4.png index 847b132..9ac0020 100644 Binary files a/opsec/veracrypt/4.png and b/opsec/veracrypt/4.png differ diff --git a/opsec/veracrypt/40.png b/opsec/veracrypt/40.png new file mode 100644 index 0000000..0182fa6 Binary files /dev/null and b/opsec/veracrypt/40.png differ diff --git a/opsec/veracrypt/41.png b/opsec/veracrypt/41.png new file mode 100644 index 0000000..fc9e98b Binary files /dev/null and b/opsec/veracrypt/41.png differ diff --git a/opsec/veracrypt/42.png b/opsec/veracrypt/42.png new file mode 100644 index 0000000..4c78ecc Binary files /dev/null and b/opsec/veracrypt/42.png differ diff --git a/opsec/veracrypt/43.png b/opsec/veracrypt/43.png new file mode 100644 index 0000000..9d38a9d Binary files /dev/null and b/opsec/veracrypt/43.png differ diff --git a/opsec/veracrypt/44.png b/opsec/veracrypt/44.png new file mode 100644 index 0000000..84c0368 Binary files /dev/null and b/opsec/veracrypt/44.png differ diff --git a/opsec/veracrypt/45.png b/opsec/veracrypt/45.png new file mode 100644 index 0000000..8d9178e Binary files /dev/null and b/opsec/veracrypt/45.png differ diff --git a/opsec/veracrypt/46.png b/opsec/veracrypt/46.png new file mode 100644 index 0000000..23cf56e Binary files /dev/null and b/opsec/veracrypt/46.png differ diff --git a/opsec/veracrypt/47.png b/opsec/veracrypt/47.png new file mode 100644 index 0000000..48f2125 Binary files /dev/null and b/opsec/veracrypt/47.png differ diff --git a/opsec/veracrypt/48.png b/opsec/veracrypt/48.png new file mode 100644 index 0000000..41ea46b Binary files /dev/null and b/opsec/veracrypt/48.png differ diff --git a/opsec/veracrypt/49.png b/opsec/veracrypt/49.png new file mode 100644 index 0000000..64a0470 Binary files /dev/null and b/opsec/veracrypt/49.png differ diff --git a/opsec/veracrypt/5.png b/opsec/veracrypt/5.png index a73b2a6..3f0fa37 100644 Binary files a/opsec/veracrypt/5.png and b/opsec/veracrypt/5.png differ diff --git a/opsec/veracrypt/50.png b/opsec/veracrypt/50.png new file mode 100644 index 0000000..6417805 Binary files /dev/null and b/opsec/veracrypt/50.png differ diff --git a/opsec/veracrypt/51.png b/opsec/veracrypt/51.png new file mode 100644 index 0000000..bdb890a Binary files /dev/null and b/opsec/veracrypt/51.png differ diff --git a/opsec/veracrypt/52.png b/opsec/veracrypt/52.png new file mode 100644 index 0000000..b1af2bc Binary files /dev/null and b/opsec/veracrypt/52.png differ diff --git a/opsec/veracrypt/53.png b/opsec/veracrypt/53.png new file mode 100644 index 0000000..87b17a6 Binary files /dev/null and b/opsec/veracrypt/53.png differ diff --git a/opsec/veracrypt/6.png b/opsec/veracrypt/6.png index 01a7140..a521277 100644 Binary files a/opsec/veracrypt/6.png and b/opsec/veracrypt/6.png differ diff --git a/opsec/veracrypt/7.png b/opsec/veracrypt/7.png index cc980b3..b5320cd 100644 Binary files a/opsec/veracrypt/7.png and b/opsec/veracrypt/7.png differ diff --git a/opsec/veracrypt/8.png b/opsec/veracrypt/8.png index 7a3717a..9a50b56 100644 Binary files a/opsec/veracrypt/8.png and b/opsec/veracrypt/8.png differ diff --git a/opsec/veracrypt/9.png b/opsec/veracrypt/9.png index e3cd1ae..3431304 100644 Binary files a/opsec/veracrypt/9.png and b/opsec/veracrypt/9.png differ diff --git a/opsec/veracrypt/index.html b/opsec/veracrypt/index.html index b1839a4..baaff13 100644 --- a/opsec/veracrypt/index.html +++ b/opsec/veracrypt/index.html @@ -46,7 +46,7 @@
  6. About
  7. Categories
    8. - +
  8. Donate
  9. Contact
    10. @@ -60,14 +60,22 @@
    - Previous Page

    nihilist@mainpc - 2024-01-31

    -

    The main source of Plausible Deniability: Deniable Encryption

    + Previous Page

    nihilist & Oxeo0 - 2025-04-01

    +

    The main source of Plausible Deniability: Deniable Encryption (April 2025 update)

    -

    VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. It is based on Truecrypt, This tool will be used for Plausible Deniability.

    -

    But why is Plausible Deniability important first of all ? From a legal perspective, depending on jurisdictions, you may be forced to type your password into an encrypted drive if requested. All it takes is for an adversary to be able to prove the existence of an encrypted drive to be able to force you to reveal the password to unlock it. Hence for example the regular LUKS encryption is not enough, because you need to be able to deny the existence of the encrypted volume. If that is the case, we have to use Veracrypt, which is an encryption tool used to provide protection (which is Plausible Deniability) against that scenario where you're forced to provide a password.

    - +

    zuluCrypt is a free and open-source tool for encrypting files and volumes in a secure way. We already used it for hiding data in video files using steganography.
    -DISCLAIMER: we're using only harddrives (HDDs) here, because using SSDs are not a secure way to have Plausible Deniability, that is due to hidden Volumes being detectable on devices that utilize wear-leveling +Today, we'll use it as a replacement for VeraCrypt - a free open source disk encryption software for Windows, Mac OSX and Linux. Being based on TrueCrypt, VeraCrypt offers a unique feature called Hidden Volumes which can give us Plausible Deniability. + +zuluCrypt supports both TrueCrypt and VeraCrypt volumes while being better integrated in Linux ecosystem. It also comes preinstalled with kicksecure OS. +

    + +

    But why is Plausible Deniability important first of all?
    +From a legal perspective, depending on jurisdictions, you may be forced to type your password into an encrypted drive if requested. All it takes is for an adversary to be able to prove the existence of an encrypted drive to be able to force you to reveal the password to unlock it. Hence for example the regular LUKS encryption is not enough, because you need to be able to deny the existence of the encrypted volume. If that is the case, we have to use veracrypt encrypted volumes, which is an encryption tool used to provide deniable encryption (which is what gives you Plausible Deniability) against that scenario where you're forced to provide a password.

    + +

    Using Veracrypt encrypted volumes, you have a decoy volume which is there by default (that spans the entire encrypted volume) and you CAN have a hidden volume if you choose to, which is hidden in the decoy volume, it's also known as the "inner volume", and the only way to reveal that the hidden volume exists, is to use the correct secret password to both unlock it. If the encrypted volume doesn't exist, legally speaking you cannot be forced to unlock it, because it doesn't exist to begin with, as far as the adversary's concerned.

    + +

    DISCLAIMER: we're using only harddrives (HDDs) here, because using SSDs are not a secure way to have Plausible Deniability, that is due to hidden Volumes being detectable on devices that utilize wear-leveling

    
 source: https://anonymousplanet.org/guide.html#understanding-hdd-vs-ssd
 
@@ -79,11 +87,14 @@ regarding wear leveling:
 
      
     
    1. Hardware : (Personal Computer / Laptop)
      2. 
     
    2. System Harddrive: not LUKS encrypted [1]
      3. 
-    
    3. Non-System Harddrive: 500Gb (used to contain our Veracrypt encrypted volumes)
      4. 
-    
    4. Host OS: Linux 
      5. 
+    
    5. Non-System Harddrive: 500Gb (used to contain our VeraCrypt encrypted volumes)
      6. 
+    
    6. Host OS: KickSecure 
      7. 
     
    7. Hypervisor: QEMU/KVM
      8. 
-    
    8. Packages: grub-live and ram-wipe
      9. 
+    
    9. Packages: grub-live and ram-wipe
      10. 
 
    
+
    In this tutorial requires you to have implemented the following setup:
    
+
+
    As we have explained previously the Host OS being in live mode is a crucial requirement to be able to maintain deniability, on top of erasing the contents of the RAM upon rebooting the Host OS, because we need to make sure that the adversary is not able to see what we were doing on the computer before they manage to get their hands on it. The Veracrypt encrypted volumes are now going to enable us to store sensitive data that can be accessed again after rebooting. To do so, we need to save the veracrypt encrypted volume on a non-system drive, because if we were to store it on the system drive, it'd disappear when we reboot the computer to exit live mode !
    
 
 
     Sidenote: Help us improve this tutorial by letting us know if there's anything missing or incorrect on this git issue directly!
    
  
@@ -98,118 +109,53 @@ regarding wear leveling:
 			
    
 				
    
           
    Deniability Context 
    
+
    Since we are using Kicksecure as a Host OS, zulucrypt is installed by default, so we can open it:
    
+
    
 
-
    ⚠️ Deniability Disclaimer: If the adversary cannot be told that you are using veracrypt, do not install Veracrypt on the host OS outside of live mode, but rather install it manually each time you boot into live mode That way everytime you reboot, there is no veracrypt program to be found at all. ⚠️
    
-
    Let's install the .deb package for veracrypt (you can install it safely from non-live mode), so that the software is available whenever you want to use it while the host OS is in live mode: 
    
-
-
    
-[ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-β†’ wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-1.26.7-Debian-12-amd64.deb -O vc.deb
-
-
    
-
    If you are using a VPS to help speed up the initial setup everytime you boot into live mode like we have showcased previously, you can also use it to store the veracrypt .deb file for you, to make it easier to retrieve each time:
    
-
    
-[ mainpc ] [ /dev/pts/4 ] [/tmp]
-β†’ ssh root@65.109.30.253
-root@65.109.30.253's password:
-Linux Datura 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64
-
-The programs included with the Debian GNU/Linux system are free software;
-the exact distribution terms for each program are described in the
-individual files in /usr/share/doc/*/copyright.
-
-Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
-permitted by applicable law.
-Web console: https://localhost.localdomain:9090/ or https://65.109.30.253:9090/
-
-You have mail.
-Last login: Sat Nov 30 14:42:15 2024 from 91.90.40.175
-
-[ Datura ] [ /dev/pts/0 ] [~]
-β†’ cd sensitive_scripts
-
-[ Datura ] [ /dev/pts/0 ] [~/sensitive_scripts]
-β†’ wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-1.26.7-Debian-12-amd64.deb -O vc.deb
-
-2024-11-30 16:43:58 (20.1 MB/s) - β€˜vc.deb’ saved [9211094/9211094]
-
-[ Datura ] [ /dev/pts/0 ] [~/sensitive_scripts]
-β†’ exit
-Connection to 65.109.30.253 closed.
-
-
    
-
    That way, everytime you boot into live mode, all you need is to download the vc.deb file from the VPS:
    
-
-
    
-[ mainpc ] [ /dev/pts/4 ] [/tmp]
-β†’ scp root@65.109.30.253:/root/sensitive_scripts/vc.deb .
-root@65.109.30.253's password:
-vc.deb                                                                                                                                                                                                        100% 8995KB   1.9MB/s   00:04
-
-[ mainpc ] [ /dev/pts/4 ] [/tmp]
-β†’ file vc.deb
-vc.deb: Debian binary package (format 2.0), with control.tar.gz, data compression gz
-
-
    
-
    And then to install it you can do it like so:
    
-
    
-[ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-β†’ sudo dpkg -i vc.deb
-
-[ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-β†’ sudo apt install -f
-
-[ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-β†’ sudo dpkg -i vc.deb
-	
-[ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-β†’ which veracrypt
-/usr/bin/veracrypt
-
-[ mainpc ] [ /dev/pts/1 ] [~/Downloads]
-β†’ veracrypt
-
-
    
-
-
-
    So now that you have veracrypt installed, before you start to use it, you need to be aware of the lack of deniability you have when using the Host OS in regular mode:
    
+
    So now you have zuluCrypt on your system. However before you start to use it, make sure that your Host OS is in live mode, as otherwise you wouldn't be able to maintain your deniability regarding the existence of the veracrypt hidden volume
    
 
-
    By default, your host OS directly writes into the system drive all sorts of potential forensic evidence that an adversary may use against you, such as system logs, kernel logs, non-standard logs, etc, and unless if you remove each of those manually, you're never sure of wether or not the Host OS saved proof of the existence of the hidden volume onto the system drive. That's why you need to use the Host OS in live mode, to be able to use veracrypt, and to install it aswell if you cannot tell the adversary that you are using veracrypt.
    
+
    By default, your host OS directly writes into the system drive all sorts of potential forensic evidence that an adversary may use against you, such as system logs, kernel logs, non-standard logs, etc, and unless if you remove each of those manually, you're never sure of wether or not the Host OS saved proof of the existence of the hidden volume onto the system drive. That's why when you use zulucrypt to handle veracrypt hidden volumes (creating them or opening them) you absolutely need to use the Host OS in live mode ONLY! 
    
 
-
    That way, as you're loading the entire host OS in the RAM due to being in live mode, you are not writing anything on the system drive anymore, but rather only writing all that potential forensic evidence of the veracrypt hidden volume in RAM alone, which can be easily erased with a simple shutdown.
    
-
    So now that we have installed veracrypt, let's reboot the Host OS into live mode:
    
-
+
    When the Host OS is in live mode, you're loading the entire host OS in the RAM, meaning that you are not writing anything on the system drive anymore, but rather you are only writing all that potential forensic evidence of the veracrypt hidden volume in RAM alone, which can be easily erased with a simple shutdown thanks to both live mode and ram-wipe.
    
+
    So if you didn't do it already, reboot the Host OS into live mode:
    
+
 
 
-
    And only now once we are in live mode, we can use veracrypt to create hidden encrypted volumes and unlock them. But be aware that everything you write into the system drive will be wiped upon shutting down, if you want to store something persistent accross reboots from live mode, you need to save it in a non-system drive.
    
-
     So now from there we can create the encrypted volumes (either as files or as entire drives). In this example we'll create an encrypted file: 
    
-
-
    Here we select that we want a Hidden veracrypt volume as well (which will be able to deny it's existence).
    
-
-
    Then we want it to be a simple file in my home directory for testing purposes (so be aware that upon rebooting it will be erased due to being in the system drive). If you want it to not be erased upon rebooting, you'll need to put it in a non-system drive like in this tutorial.
    
-
-
    Leave the default settings for the encryption
    
-
-
    As a test we'll make a 1Gb volume, can be smaller or as big as all the available space.
    
-
-
    Now here we want to remember our first password A, for the decoy volume, This is the password you'll type when you're forced to give out your password.
    
-
-
    Here we can select the FAT filesystem
    
-
-
    Then move your mouse to make sure the randomness of the encryption is best, then let it complete the formatting. If you are creating a large encrypted volume, it will take time to overwrite all the data. DO NOT SELECT QUICK FORMAT, or you risk having the hidden volume being discoverable by an adversary. 
    
-
-
-
    Now that's completed, we then create the Hidden Volume, which we'll open only when we are all alone, the existence of this volume must never be revealed to anyone, only you should know about it. then we repeat the previous steps:
    
-
-
-
    Here we select the size we need for the hidden volume. 
    
-
-
    And here we use the second password, this is the one you must remember in order to access the data you want to hide from an adversary. Then we repeat the previous steps to create the volume:
    
-
-
-
-
-
+
    And only now once we are in live mode, we can use zuluCrypt to create hidden encrypted volumes and unlock them. But be aware that everything you write into the system drive will be wiped upon shutting down, if you want to store something persistent accross reboots from live mode, you need to save it in a non-system drive.
    
+
    
+[user /run/media/private/user]% lsblk
+NAME                                          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
+sr0                                            11:0    1 1024M  0 rom   
+vda                                           253:0    0  200G  0 disk  
+β”œβ”€vda1                                        253:1    0    4G  0 part  /boot
+└─vda2                                        253:2    0  196G  0 part  
+  └─luks-24351c83-3657-4142-82d2-8f8a5787f406 254:0    0  196G  0 crypt /live/image
+vdb                                           253:16   0   20G  0 disk  
+└─vdb1                                        253:17   0   20G  0 part  
+
+
    
+
    Here as you can see we have a non-system drive called /dev/vdb1, which, for our current testing purposes is only 20 GB big. Before we start encrypting it, let's format the harddrive using gparted to make sure the vdb1 partition is available for us to use:
    
+
+
+
+
+
+
+
+
+
     Now that the /dev/vdb1 partition is available for us to use, let's create the veracrypt encrypted volume which will span the entire non-system drive:
    
+
+
+
+
+
+
    Here is the important part: you need to mention Password A for the decoy volume (which is the outer volume, it will span the entire disk), and you need to mention Password B for the hidden volume (which is the hidden veracrypt volume where we'll be able to store our sensitive files)
    
+
+
    Here you may need to click create twice as zulucrypt recommends you to use another format that it can't use, so click create a second time and then wait for it to create the volume:
    
+
+
+
    And that's it! We have successfully created the veracrypt volume, so now let's mount each one:
    
+
    @@ -219,16 +165,24 @@ vc.deb: Debian binary package (format 2.0), with control.tar.gz, data compressio
    -

    Mounting the Volumes



    -

    Now let's mount both volumes to see the difference:

    - -

    Here when we type the first password we see that the volume is mounted as normal type:

    - -

    Then dismount the volume, and mount the hidden volume next with the second password:

    - -

    And here you see that the volume mounted is now of the "hidden" type

    - -

    And that's it! We now have setup a test veracrypt volume with a hidden volume, into which we can store some sensitive files.

    +

    Mounting the Decoy and Hidden Volumes



    +

    First let's mount the decoy volume (which we'll later use to store non-sensitive files, that would make sense for an adversary to keep in an encrypted drive):

    + + + + + +

    Here as you can see, the decoy volume once mounted spans the entire non-system drive (in this case 20GB). So if you were forced to open it for an adversary, they would only find non-sensitive files (for example pirated movies or adult content) that are stored in it. And since the volume spans the entire drive, you can deny the existance of any other encrypted volume in there, and the adversary would be unable to prove otherwise. This means that our deniability is maintained.

    + +

    Next we'll unmount the decoy volume to mount the hidden volume instead:

    + +

    At this step you need to make sure that noone is watching you type this second password, as this second volume needs to remain a secret at all costs, it's existance is only to be known by you.

    + + +

    And now after unlocking the hidden volume (and revealing it at the same time), we see that it is 10GB big, as intended. And it is only in that hidden volume, that you can safely store your sensitive files which are meant to remain secret at all costs.

    + + +

    if there were to be any emergency where someone would be close to discovering that there is a hidden volume (meaning the adversary is busting down your door and is almost next to your monitor) all you need is to press Right Control to immediately reboot the host OS, to be able to erase all forensic proof that the hidden volume exists.

    @@ -250,7 +204,7 @@ vc.deb: Debian binary package (format 2.0), with control.tar.gz, data compressio

    My Links

    - RSS Feed
    SimpleX Chatrooms
    + RSS Feed
    SimpleX Chat

    @@ -258,6 +212,9 @@ vc.deb: Debian binary package (format 2.0), with control.tar.gz, data compressio

    About nihilist

    Donate XMR: 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8


    + +

    About oxeo0

    +

    Donate XMR: 862Sp3N5Y8NByFmPVLTPrJYzwdiiVxkhQgAdt65mpYKJLdVDHyYQ8swLgnVr8D3jKphDUcWUCVK1vZv9u8cvtRJCUBFb8MQ


    diff --git a/rss/feed.xml b/rss/feed.xml index 84e5270..e9b8b66 100644 --- a/rss/feed.xml +++ b/rss/feed.xml @@ -9,6 +9,14 @@ Nihilist`s Technical Blog + + The main source of Plausible Deniability: Deniable Encryption (April 2025 update) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/veracrypt/index.html + 2024040100 + In this tutorial we're going to cover how to use zulucrypt to create hidden veracrypt volumes to enable long-term sensitive use. + + + Using the Host-OS in live-mode to enable Sensitive Use http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/livemode/index.html @@ -910,6 +918,7 @@ +