Deniability - When the Adversary is the cloud provider himself #36

New Issue

nihilist · 2024-09-17T21:05:33+02:00

nihilist commented

2024-09-17 21:05:33 +02:00

No description provided.

nihilist added this to the OPSEC Tutorials (paid contributions) project 2024-09-17 21:05:33 +02:00

nihilist added the

Doable

label 2024-09-23 10:40:43 +02:00

nihilist commented

2024-09-28 16:01:31 +02:00

the idea is what to consider when you have a VPS, and a dedicated server, what can the cloud provider actually see and do ?

on a VPS and on a dedicated server: dedicated server is potentially safer as you have lower access to the server (meaning the cloud provider has less software capability to spy on what you do inside the machine, than on he did on the VPS
With and without custom host OS (malicious kernel modules allowing the cloud provider to spy on what users do
the cloud provider has physical access to the server so:

so he can pull the plug on it, plug and unplug usb devices, monitors, he can pull out the harddrives to try and read whats been stored into it (Host OS and other
and do a cold boot attack to read the contents of the RAM >>> need a way to encrypt everything that is in the contents of the ram, without physical access to the hardware

TLDR the ideal setup is :
-dedicated server
-custom host OS with integrity checks (kernel modules, physical changes monitoring, etc)
-encrypted harddrives

the idea is what to consider when you have a VPS, and a dedicated server, what can the cloud provider actually see and do ? 1) on a VPS and on a dedicated server: dedicated server is potentially safer as you have lower access to the server (meaning the cloud provider has less software capability to spy on what you do inside the machine, than on he did on the VPS 2) With and without custom host OS (malicious kernel modules allowing the cloud provider to spy on what users do 3) the cloud provider has physical access to the server so: - so he can pull the plug on it, plug and unplug usb devices, monitors, he can pull out the harddrives to try and read whats been stored into it (Host OS and other - and do a cold boot attack to read the contents of the RAM >>> need a way to encrypt everything that is in the contents of the ram, without physical access to the hardware TLDR the ideal setup is : -dedicated server -custom host OS with integrity checks (kernel modules, physical changes monitoring, etc) -encrypted harddrives

nihilist referenced this issue

2024-09-28 16:02:32 +02:00

Deniability - Protecting against cold boot attacks, with RAM encryption (no hardware access!) #37

nihilist referenced this issue

2024-09-28 16:04:33 +02:00

Deniability - System Intrusion / Integrity monitoring (kernel modules, binary files, unwanted processes, hardwre changes) #38

nihilist referenced this issue

2024-09-28 16:05:23 +02:00

Deniability - Custom Linux OS making (debian-based) #39

nihilist referenced this issue

2024-09-28 16:06:17 +02:00

Deniability - Obtaining a non-KYC dedicated server, with a custom OS #40