Previous Page

nihilist@mainpc - 2024-10-29

Sensitive use VMs Setup (Whonix VMs in a Veracrypt Hidden Volume)

In this tutorial we're going to cover how to setup Whonix VMs for Sensitive use. This means that our OPSEC requirement is that we need to be able to deny the existance of the Sensitive Whonix VM if the adversary ever gets access to our laptop.

Now the advantage of this setup, is that it is not going to actually destroy the computer, nor any sensitive data, you can keep using it even after triggering an emergency shutdown.

CONTEXT WARNING: this setup is only suitable if you are not going to be thrown in jail for just using Veracrypt., and if an adversary were to bust down your front door, you need to have at least 5 seconds before he can see your laptop screen.

OPSEC Recommendations:

1. Hardware : (Personal Computer / Laptop)

2. Host OS: Linux, but in live mode

3. Hypervisor: libvirtd QEMU/KVM

4. Harddrive (HDD): 500GB and encrypted with Veracrypt (with a 250Gb Hidden Volume)

5. Virtual Machine:Whonix

Deniability Requirement

First of all as you have seen, the requirement is that we do this setup from the Host OS, in live mode. That is because we want to make sure that there is no forensic evidence to be saved on the system drive as we have explained previously.

While in Live mode we can't write anything new on the system disk (such as the system logs, kernel logs, non-standard logs) which can all be potential forensic evidence that the hidden volume exists. Instead, everything is written into RAM, and we can easily erase all of those contents with a simple reboot. While in live mode however, we can write to non-system drives, which is where we will setup a big enough veracrypt volume to store the Whonix VMs that we will use for long-term sensitive use.

How to setup the VMs inside the Hidden Volume

So before we start, make sure you reboot the Host OS to go into live mode:

Then, once in live mode we're going to setup our veracrypt volumes on our 500Gb harddrive:

Here we're using a non-system drive, as we want to be able to store our veracrypt hidden volume contents in a persistent manner, accross reboots. (if we were to have the veracrypt volume on the system drive, it would be wiped off upon rebooting since the Host OS is in live mode.)

And in our veracrypt outer (decoy) volume, we're going to setup the veracrypt inner (hidden) volume, and set it to be 250Gb big:

Now that the vercarypt volume has been setup, to highlight the mechanism, for the same harddrive, you have 2 passwords. Password A opens up the decoy volume, and Password B (which must remains secret, only to be known by you) opens up the hidden volume:

Setting up the Hidden Volume

So now let's setup the hidden volume, where we will put the Sensitive Whonix QEMU VMs:

Then, we're going to download the Whonix VMs and configure them to be used from inside the hidden veracrypt volume:

[ nowhere ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
→ mv ~/Downloads/Whonix-Xfce-17.2.3.7.Intel_AMD64.qcow2.libvirt.xz /mnt/veracrypt1/

[ nowhere ] [ /dev/pts/23 ] []
→ tar -xvf Whonix-Xfce-17.2.3.7.Intel_AMD64.qcow2.libvirt.xz
WHONIX_BINARY_LICENSE_AGREEMENT
WHONIX_DISCLAIMER
Whonix-Gateway-Xfce-17.2.3.7.xml
Whonix-Workstation-Xfce-17.2.3.7.xml
Whonix_external_network-17.2.3.7.xml
Whonix_internal_network-17.2.3.7.xml
Whonix-Gateway-Xfce-17.2.3.7.Intel_AMD64.qcow2
Whonix-Workstation-Xfce-17.2.3.7.Intel_AMD64.qcow2

[ nowhere ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
→ touch WHONIX_BINARY_LICENSE_AGREEMENT_accepted

next, we simplify the files names:

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ mv Whonix-Gateway-Xfce-17.2.3.7.xml Whonix-Gateway.xml

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ mv Whonix-Gateway-Xfce-17.2.3.7.Intel_AMD64.qcow2 Whonix-Gateway.qcow2

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ mv Whonix-Workstation-Xfce-17.2.3.7.xml Whonix-Workstation.xml

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ mv Whonix-Workstation-Xfce-17.2.3.7.Intel_AMD64.qcow2 Whonix-Workstation.qcow2

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ mv Whonix_external_network-17.2.3.7.xml Whonix-external.xml

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ mv Whonix_internal_network-17.2.3.7.xml Whonix-internal.xml


[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ ls -l
total 209745392
drwx------ 2 root     root           16384 Sep  1 21:24 lost+found
-rwxrwx--x 1 nihilist libvirt         1202 Jan  2  2024 refreshvms.sh
-rwxrwx--- 1 nihilist libvirt        39649 Oct 21  2015 WHONIX_BINARY_LICENSE_AGREEMENT
-rwxrwx--- 1 nihilist libvirt         4185 Oct 21  2015 WHONIX_DISCLAIMER
-rwxrwx--- 1 nihilist libvirt          172 Oct 21  2015 Whonix_external_network-17.2.3.7.xml
-rwxrwx--- 1 nihilist libvirt 107389386752 Nov  1 14:13 Whonix-Gateway.qcow2
-rwxrwx--- 1 nihilist libvirt         3577 Sep  1 22:31 Whonix-Gateway.xml
-rwxrwx--- 1 nihilist libvirt           97 Oct 21  2015 Whonix_internal_network-17.2.3.7.xml
-rwxrwx--- 1 nihilist libvirt 107389386752 Nov  1 14:13 Whonix-Workstation.qcow2
-rwxrwx--- 1 nihilist libvirt         3466 Sep  1 22:30 Whonix-Workstation.xml

And then we edit the .xml file of the gateway VM to give it 1GB of RAM and mentionning the correct .qcow2 path:

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ vim Whonix-Gateway.xml 

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ cat Whonix-Gateway.xml | grep emory
  <memory dumpCore="off" unit="GiB">1</memory>
  <currentMemory unit="GiB">1</currentMemory>

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ cat Whonix-Gateway.xml | grep qcow2
      <driver name="qemu" type="qcow2"/>
      <source file="/mnt/veracrypt1/Whonix-Gateway.qcow2"/>

And then we do the same for the .xml file of the workstation VM to give it 8GB of RAM and mentionning the correct .qcow2 path aswell:

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ vim Whonix-Workstation.xml 

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ cat Whonix-Workstation.xml | grep emory
  <memory dumpCore="off" unit="GiB">8</memory>
  <currentMemory unit="GiB">8</currentMemory>

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ cat Whonix-Workstation.xml | grep qcow2
      <driver name="qemu" type="qcow2"/>
      <source file="/mnt/veracrypt1/Whonix-Workstation.qcow2"/>

and from here we create script.sh that we put inside the veracrypt hidden volume, we will use it to automatically either import or remove both VMs into virt-manager depending on wether they are already imported or not.

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ vim script.sh

[ nowhere ] [ /dev/pts/0 ] [~]
→ cat /mnt/veracrypt1/script.sh
#!/bin/bash

if [ $(virsh -c qemu:///system list --all | grep Whonix | wc -l) -ne 0 ];
then

	# if the VMs are imported, remove them:

	virsh -c qemu:///system destroy Whonix-Gateway
	virsh -c qemu:///system destroy Whonix-Workstation
	virsh -c qemu:///system undefine Whonix-Gateway
	virsh -c qemu:///system undefine Whonix-Workstation
	virsh -c qemu:///system net-destroy Whonix-External
	virsh -c qemu:///system net-destroy Whonix-Internal
	virsh -c qemu:///system net-undefine Whonix-External
	virsh -c qemu:///system net-undefine Whonix-Internal
else


	# if the VMs are not imported, import them:

	virsh -c qemu:///system net-define /mnt/veracrypt1/Whonix-external.xml
	virsh -c qemu:///system net-define /mnt/veracrypt1/Whonix-internal.xml
	virsh -c qemu:///system net-autostart Whonix-External
	virsh -c qemu:///system net-start Whonix-External
	virsh -c qemu:///system net-autostart Whonix-Internal
	virsh -c qemu:///system net-start Whonix-Internal
	virsh -c qemu:///system define /mnt/veracrypt1/Whonix-Gateway.xml
	virsh -c qemu:///system define /mnt/veracrypt1/Whonix-Workstation.xml
fi

So by default you have your QEMU VMs like so:

And to run the script to import the VMs you do as follows:

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ chmod +x script.sh 

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ ./script.sh 
Network Whonix-External defined from Whonix-external.xml

Network Whonix-Internal defined from Whonix-internal.xml

Network Whonix-External marked as autostarted

Network Whonix-External started

Network Whonix-Internal marked as autostarted

Network Whonix-Internal started

Domain 'Whonix-Gateway' defined from Whonix-Gateway.xml

Domain 'Whonix-Workstation' defined from Whonix-Workstation.xml

From there you'll see that the Whonix VMs are imported:

And now to remove them you can just run the same script again:

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ ./script.sh
error: Failed to destroy domain 'Whonix-Gateway'
error: Requested operation is not valid: domain is not running

error: Failed to destroy domain 'Whonix-Workstation'
error: Requested operation is not valid: domain is not running

Domain 'Whonix-Gateway' has been undefined

Domain 'Whonix-Workstation' has been undefined

Network Whonix-External destroyed

Network Whonix-Internal destroyed

Network Whonix-External has been undefined

Network Whonix-Internal has been undefined

And you'll see that the VMs are no longer there:

Setting up the Decoy volume

Now that we have setup the hidden volume, let's close it so that we can setup the decoy volume (dont forget to exit the drive from the commandline, otherwise veracrypt will complain that the drive is busy):

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ cd ..

[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ 

Now first dismount the hidden volume:

And then mount the decoy volume:

In the decoy volume, we want content that makes sense to be kept hidden in an encrypted volume while still not being considered as sensitive (meaning nothing that can get you into trouble like adult content, or movies that you pirated):

[ nowhere ] [ /dev/pts/1 ] [/mnt]
→ cd /mnt/veracrypt1 

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ ls
lost+found

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ sudo apt install yt-dlp vlc -y

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ yt-dlp https://www.youtube.com/watch\?v\=16efRG5H_Vc
	
[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ yt-dlp https://www.youtube.com/watch\?v\=HmZm8vNHBSU 

So in this example we're going to pretend we have pirated some movies and got some adult content, that way we have an excuse as to why we have an encrypted veracrypt volume if ever forced by an adversary. We then create the script.sh which will basically be used to kill the media player window:

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ vim script.sh 

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ chmod +x script.sh 

[ nowhere ] [ /dev/pts/1 ] [/mnt/veracrypt1]
→ cat script.sh 
#!/bin/bash

kill -9 $(pidof vlc)

If ever asked to by an adversary, we'll basically pretend that this script is there to quickly kill the media player window in case if someone were to enter the room while you were watching that not-sensitive-but-private content.

Emergency shutdown shortcut

Now that we're setup, we need to be able to run that script using a shortcut to be ran from our desktop environment, I am currently using Cinnamon, therefore to create a shortcut for cinnamon you do as follows:

Now we're setting up the shortcut "Super+V" to run the /mnt/veracrypt1/script.sh script just so it is quicker to setup the whonix VMs when inside the veracrypt hidden volume. Now to shut down the Host OS, there is already a default cinnamon shortcut which is "Ctrl+Alt+End".

And we're now all setup! So let's try it out in both scenarios (from the decoy volume, and from the hidden volume):

Decoy Volume Scenario (watching non-sensitive content)

So first we open the veracrypt, and open the decoy volume:

Then we open VLC, and we hit "Open file" and browse to our non-sensitive files:

Then suddenly someone busts your front door, and you quickly press "Super+V" the VLC window immediately closes, and then "Ctrl+Alt+End" and in a few seconds you have the Host OS shutting down. And as the Host OS shuts down, all the RAM contents are erased (even though there was nothing sensitive in it this time).

And that's it ! if the adversary didnt get to your desk by the time you pressed the shortcut, he didnt get to see the content you were playing on your monitor.

Hidden Volume Scenario (using the sensitive VM)

Now to test emergency shutdown on the hidden volume side, we first open the hidden volume:

Once the hidden volume is mounted, we hit "Super+V" to quickly setup the whonix VMs:

And after a while of doing some actual sensitive stuff on the whonix VM you hear your front door being busted down, so you quickly hit "Ctrl+Alt" to focus out of the VM, and then you hit "Ctrl+Alt+End" to trigger the emergency shutdown:

Here it also only takes approximately 4 seconds after pressing "Ctrl+Alt+End" to have your Host OS shutdown, erasing all the forensic evidence regarding the existence of the veracrypt hidden volume and the Sensitive Whonix VM it contains.

And that's it ! You now have a Sensitive VM ready to be used, and you have implemented the necessary measures to protect the deniability of it's existance, from an adversary.

In what context is there Deniability ?

With this setup, you have deniability the moment that the Host OS finishes shutting down, regarding the existance of the veracrypt hidden volume, and the whonix sensitive VMs that are in it. Meaning that it is impossible for an adversary that seizes your computer to prove the existance of the Whonix Sensitive VMs after the Host OS finished shutting down.

Below is all an adversary will be able to see, if he were to seize your laptop after you manage to shut it down:

Of course, if you are ever forced to, ONLY give your decoy password to the adversary. The existance of the hidden volume, and of the secret password thats used to reveal it must remain a secret at all costs, it must remain known only by you.

If you are ever dragged into court, the judge will appreciate much more if you actually hand over your laptop, and show that you are willing to cooperate with the authorities by providing your password to unlock it, rather than starting to pretend you forgot your password (which can end badly like in this court case, where the defendant was found to be in contempt of court, and thrown in jail for 6 months for it).

If ever asked by the authorities on why you used veracrypt in your laptop, you can simply claim that it was to put your stash of adult content in it. Nothing incriminating about it, and it is plausible given that you dont want that laying around on your desktop, due to being of a private matter.