Emergency shutdown script setup
Now that we're done setting up both the hidden and the decoy volumes, we're going to setup the script that will launch either of the 2 script.sh scripts we just wrote, on top of also erasing all potential proof that the sensitive VM exists (meaning we erase all logs, all kernel logs, we fill the ram with random content 3 times, and we erase the command history):
First we need to make sure we can run veracrypt commands without requiring to be a sudo user:
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ ls -lash /usr/bin/veracrypt
4.3M -rwxr-xr-x 1 root root 4.3M Sep 8 22:37 /usr/bin/veracrypt
[ nowhere ] [ /dev/pts/1 ] [~]
→ sudo chown root:nihilist /usr/bin/veracrypt
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo groupadd veracrypt
[sudo] password for nihilist:
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo usermod -aG veracrypt $(whoami)
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ zsh
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo visudo -f /etc/sudoers.d/veracrypt
%veracrypt ALL=(root) NOPASSWD:/usr/bin/veracrypt, /usr/bin/mount, /usr/bin/umount, /usr/bin/uptime
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ whoami
nihilist
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ veracrypt -d -f
Now from there (after a reboot) you wont require sudo passwords to use veracrypt anymore. Next we need to be able to remove all logs without being the root user:
[ nowhere ] [ /dev/pts/1 ] [~]
→ sudo setfacl -Rm u:$(whoami):rwX /var/log
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ rm /var/log/*.log /var/log/*/*.log /var/log/*/*/*.log -rf
[ nowhere ] [ /dev/pts/1 ] [~]
→ sudo setfacl -Rm u:$(whoami):rwX /dev/shm
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ rm /dev/shm/*.log /dev/shm/*/*.log /dev/shm/*/*/*.log -rf
Then we need to do the same but to remove all kernel logs:
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo sysctl -w kernel.dmesg_restrict=0
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo vim /etc/sysctl.d/01-dmesg.conf.txt
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ cat /etc/sysctl.d/01-dmesg.conf.txt
kernel.dmesg_restrict = 0
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo chown root:nihilist /usr/bin/dmesg
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo chmod 750 /usr/bin/dmesg
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo setcap cap_syslog=ep /usr/bin/dmesg
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ dmesg -c
then we kill veracrypt's process to avoid having the veracrypt window display which drive/volume was selected:
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ kill $(pidof veracrypt)
and then we overwrite the ram contents like so:
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ sudo apt install stress -y
#find how many GBs of ram you have:
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f 1
125
#do a stress test to fill those 125GBs of ram:
[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f 1)G -t 10
stress: info: [2659012] dispatching hogs: 0 cpu, 0 io, 1 vm, 0 hdd
stress: info: [2659012] successful run completed in 11s
so now we write the wipe.sh script, that we place at the home directory of our user:
[ nowhere ] [ /dev/pts/1 ] [~]
→ cd
[ nowhere ] [ /dev/pts/1 ] [~]
→ vim wipe.sh
[ nowhere ] [ /dev/pts/1 ] [~]
→ cat wipe.sh
#!/bin/bash
# run script.sh from inside the veracrypt volume:
/mnt/veracrypt1/script.sh
# close down the veracrypt volume:
/usr/bin/veracrypt -d -f
# remove all system logs:
rm /var/log/*.log /var/log/*/*.log /var/log/*/*/*.log -rf
rm /dev/shm/*.log /dev/shm/*/*.log /dev/shm/*/*/*.log -rf
# remove all kernel logs:
/usr/bin/dmesg -c >/dev/null 2>/dev/null
# kill the veracrypt process:
kill $(pidof veracrypt)
# erase the commandline history:
echo '' > ~/.zsh_history
echo '' > ~/.bash_history
# overwrite the ram contents 3 times:
stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f 1)G -t 10
stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f 1)G -t 10
stress -m 1 --vm-bytes $(free -ght | grep Mem | cut -d ' ' -f 12 | cut -d 'G' -f 1)G -t 10
[ nowhere ] [ /dev/pts/1 ] [~]
→ chmod +x wipe.sh
Now that we're setup, we need to be able to run that script using a shortcut to be ran from our desktop environment, I am currently using Cinnamon, therefore to create a shortcut for cinnamon you do as follows:
So basically from here, if you are not in a QEMU VM, you simply need to hit the shortcut "SUPER+R".
If you are focused in a QEMU VM, you need to do "CTRL+ALT" (to focus out of the QEMU VM), and then "SUPER+R" to run the wipe.sh script from the Host OS.
Now i'm also going to setup an optional shortcut "Super+V" to only run the /mnt/veracrypt1/script.sh script just so it is easier to setup the whonix VMs when inside the veracrypt hidden volume.
And we're now all setup! So let's try it out in both scenarios (from the decoy volume, and from the hidden volume):
