diff --git a/opsec/deniability/index.html b/opsec/deniability/index.html index 4ebb27c..3212642 100644 --- a/opsec/deniability/index.html +++ b/opsec/deniability/index.html @@ -121,6 +121,33 @@ The door is closed, the conversation remains between Alice and Bob, their conver
+

What if i destroy the evidence ?



+

One common arguement that is being brought up is "what if i destroy the data before the adversary can see it?" lets see the following scenario:

+

+-You started doing sensitive actions on your graphene OS phone
+-Somewhere you slipped up, and now the adversary is busting down your door and holding you at gunpoint, handcuffing you and taking you to the nearest station.
+-Now the adversary is telling you "by order of the judge, you are now going to unlock that phone."
+
+-But, you've got your ace up your sleeve, you configured a duress password on your graphene OS phone, meaning that once you type that special password, the contents of your phone are irreversibly deleted, with no possible recovery.
+
+-You type the password, and the phone contents are getting deleted, right in front of the adversary. What now ? 
+
+
+

Now you are in a situation where the adversary knows that you intentionally destroyed the contents of your phone, he knows that you do not intend to cooperate, and that on top of it you destroyed potential evidence. Where do you think that get you in court ?

+

If you were just pretending to have forgotten your password, you'd be found to be in Contempt of Court (approx 6 months jailtime), But here from the point of view of the adversary, he's perceiving it as you knowingly and intentionally tampering with evidence which is way worse, as the sentences for that can go up to 20 years in prison.

+

So in short, you need it to look like you are cooperating with the adversary, you must be able to give him a password, and when he unlocks the encrypted volume, he must find nothing incriminating about you, which is why we need deniable encryption.

+ +
+
+
+ + + + +
+
+
+

Why is Deniable Encryption Vital?



From a legal standpoint, the only way to be protected against that scenario where you're forced to decrypt your harddrive is to be able to deny the existence of said encrypted volume (Plausible Deniability) . If the encrypted volume does not exist, there is no password to be given for it.

So here we need a technology that can provide us Plausible Deniability. That is what Veracrypt can do for us.

@@ -135,7 +162,7 @@ The door is closed, the conversation remains between Alice and Bob, their conver
-
+
diff --git a/opsec/index.html b/opsec/index.html index ec387b0..eb23da5 100644 --- a/opsec/index.html +++ b/opsec/index.html @@ -317,9 +317,9 @@

🧅 Serverside - Plausible Deniability at Home (⚠️ Self Hosting = Risky!)

    -
  1. ✅ Open source router VM setup (pfsense on QEMU/KVM)
    2. +
  2. ❌ Open source router VM setup (OpnSense on QEMU/KVM)
  3. ✅ Electrical Failover (basic UPS setup)
    4. -
  4. ✅ Internet Failover (Dual WAN pfsense setup)
    5. +
  5. ❌ Internet Failover (Dual WAN OpnSense setup)
  6. ❌ Isolating on-premise hidden services (VM-based restrictive networking)
  7. ❌ Deniable Encryption Protection (emergency shutdown script, shortcut, + systemd service)
  8. 🟠 Automating Deniable Encryption Protection (USB Changes, detecting movements, and SSH bruteforce attempts)
    9. diff --git a/opsec/opnsense_router_vm/0.png b/opsec/opnsense_router_vm/0.png new file mode 100644 index 0000000..9f66dab Binary files /dev/null and b/opsec/opnsense_router_vm/0.png differ diff --git a/opsec/opnsense_router_vm/1.png b/opsec/opnsense_router_vm/1.png new file mode 100644 index 0000000..9a80a99 Binary files /dev/null and b/opsec/opnsense_router_vm/1.png differ diff --git a/opsec/opnsense_router_vm/2.png b/opsec/opnsense_router_vm/2.png new file mode 100644 index 0000000..b49028a Binary files /dev/null and b/opsec/opnsense_router_vm/2.png differ diff --git a/opsec/opnsense_router_vm/3.png b/opsec/opnsense_router_vm/3.png new file mode 100644 index 0000000..9b391ad Binary files /dev/null and b/opsec/opnsense_router_vm/3.png differ diff --git a/opsec/opnsense_router_vm/index.html b/opsec/opnsense_router_vm/index.html new file mode 100644 index 0000000..b5f8430 --- /dev/null +++ b/opsec/opnsense_router_vm/index.html @@ -0,0 +1,165 @@ + + + + + + + + + + + Open source router VM setup (OpnSense on QEMU/KVM) + + + + + + + + + + + + + + + + + + + +
    +
    +
    + + The Nihilism Blog +
    +
    + +
    + +
    +
    + + + +
    +
    +
    +
    + Previous Page

    nihilist@mainpc - 2024-11-24

    +

    Open source router VM setup (OpnSense on QEMU/KVM)

    + +

    In this tutorial we're going to take a look at how to setup OpnSense in a VM, in order to have the ability to do a dual-wan setup, while maintaining the FOSS requirement (which pfsense cannot provide).

    + +
    +
    +
    +
    + + +
    +
    +
    +
    +

    Setting up the VM

    +

    First let's create an isolated LAN network virt-manager:

    +

    Then, let's download the latest Opnsense iso:

    + + +
    
+nihilist@mainpc:/run/media/nihilist/VAULT/Isos$ bzip2 -d OPNsense-24.7-dvd-amd64.iso.bz2 	
+nihilist@mainpc:/run/media/nihilist/VAULT/Isos$ file OPNsense-24.7-dvd-amd64.iso 
+OPNsense-24.7-dvd-amd64.iso: ISO 9660 CD-ROM filesystem data 'OPNSENSE_INSTALL' (bootable)
+
+
    + +

    Next, we create the VM itself by using the iso we just downloaded:

    +

    Now before starting the VM, we make sure that it has 2 network adapters, one being the WAN, and the other being the LAN. (take note of the mac addresses of either network interface, as we'll need to identify which one is which.)

    +

    Then we begin installing the VM as follows:

    +

    And then, we make sure the opnsense router VM acts as a DHCP server for the LAN:

    +

    After that, we put a debian VM in the LAN to test if the network configuration works as intended:

    +

    Here we see that we can access the router VM from the LAN just fine, so we're good!

    +
    +
    +
    +
    + +
    +
    +
    +
    +

    Dual WAN Setup



    +

    Here we currently have the router VM using the

    + + +

    + +
    
+	
+
    + +

    + +
    
+	
+
    + +
    +
    +
    +
    + + + + +
    +
    +
    +
    +

    Nihilism

    +

    + Until there is Nothing left.



    Creative Commons Zero: No Rights Reserved
    + +

    +
    + +
    +

    My Links

    +

    + + RSS Feed
    SimpleX Chat
    + +

    +
    + +
    +

    About nihilist

    +

    Donate XMR: 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8


    Contact: nihilist@contact.nowhere.moe (PGP)

    +
    + +
    + +
    +
    + + + + + + +