How to hide from the NSA and CIA? Basic anonymity techniques to Black Hat

WARNING: The title is just for attention

Anonymity is important for you to avoid authoritarian laws in your country or even cybersecurity and opsec processes.

It is very important to understand that anonymity is not just for people who want to do wrong things, but a useful way to ensure data protection and spying. But well, I'll stop talking nonsense and go straight to what matters.

I am summarizing, it became an article with a reading of 40 minutes, I decided to reduce it and I will probably divide it into two parts, one more theoretical and the other more practical.

The Onion Router

The Tor Network, which stands for "The Onion Router", is an internet communication network aimed at user privacy and anonymity. Tor's purpose is to protect users from Internet surveillance by hiding a user's online activity and physical location.

Tor's operation is based on a network of servers, called "nodes" or "relays", which pass information from one to the other. When a user connects to the Tor network, internet traffic is encrypted and passes through several random nodes before reaching its final destination. Each node only knows the previous and subsequent nodes in the chain, but not the origin or final destination of the information.

Here's a simplified explanation of how this works:

1. When you start Tor, your computer connects to an entry node (or guard relay), which is chosen from a list of available public nodes.
2. The input node then passes its request to an intermediate node (middle relay).
3. The intermediate node passes the request to an exit node (exit relay).
4. The output node then connects to the website you want to visit. The site sees the traffic as coming from the exit node, not your computer.

This chain of nodes is known as a "circuit". Each step in this process is called a "hop". So, in a typical Tor connection, there are three "hops": from input node to intermediate node, from intermediate node to output node, and from output node to final destination.

The idea behind this design is that even if an observer is monitoring a portion of the network, it will be very difficult to trace the activity back to the original user. Furthermore, each connection through the Tor network uses a different circuit, making tracking even more difficult.

Browser security settings

Standard

• At this level, all Tor Browser and website features are enabled.

Safer

• This level disables website features that are often dangerous. This may cause some sites to lose functionality.
• JavaScript is disabled on all non-HTTPS?sites; some fonts and math symbols are disabled; audio and video (HTML5 media) are click-to-play.

Safest

• This level only allows website features required for static sites and basic services. These changes affect images, media, and scripts.
• Javascript is disabled by default on all sites; some fonts, icons, math symbols, and images are disabled; audio and video (HTML5 media) are click-to-play.

Installing on Linux

If you don't already have it, you can install it using your system's package manager. For example, on Ubuntu, you can install Tor with the following command:

sudo apt-get install tor        

Here are some examples of options you can set in the torrc file:

SOCKSPort: This option sets the port on which Tor accepts connections. The default value is 9050. You can change it as per your requirement.

For example:

SOCKSPort 9050         

Log: This option sets the log level and log file. For example, to log warning level information to the /var/log/tor/notices.log file, you could use:

Log notice file /var/log/tor/notices.log         

ExitNodes: This option can be used to specify the exit nodes you want to use. For example, to use US-only exit nodes, you can use:

ExitNodes {US}         

StrictNodes: If you set this option to 1, Tor will strictly respect your ExitNodes, ExcludeNodes, etc. For example:

StrictNodes 1         

After making your changes, save the file and restart the Tor service for the changes to take effect. On Ubuntu, you can restart Tor with the following command:

sudo service tor restart        

https://tb-manual.torproject.org/running-tor-browser/

https://www.wired.co.uk/article/what-is-the-dark-web-how-to-access

Mr. Robot Attacks

ChatGPT Info

The specific attack and technical details are not fully explained in the episode, but we can infer some details about how he might have carried out the attack based on our knowledge of hacking and cybersecurity.

It is important to note that the Tor network is designed to provide anonymity to users and servers that host hidden websites. To do this, it uses a series of intermediary servers, known as "nodes", to obfuscate the source and destination of traffic on the network. However, if a hidden site on the Tor network is misconfigured, it may be possible to trace traffic back to the original server.

Here is a possible way Elliot could have carried out the attack:

1. Server Discovery: Elliot could have discovered that the site was being hosted on a regular server rather than a hidden server by tracking the network traffic. This could have been done using a variety of techniques such as traffic analysis or packet inspection.
2. Exploiting Vulnerabilities: Once he knew the server's location, Elliot could have exploited a vulnerability in the server's software to gain access. For example, he could have used a command injection attack, which involves inserting malicious commands into a user interface or API that is poorly protected.
3. Evidence Acquisition: Once he gained access to the server, Elliot could have downloaded the files containing evidence from the site operator.

It's important to remember that this is just a hypothetical scenario based on how an attack on a Tor server could be carried out. The specific techniques used by Elliot are not explained in detail in the episode. It's also worth remembering that hacking activities are illegal and can have significant consequences.

https://tor.stackexchange.com/questions/8636/is-the-rons-coffee-tor-related-hack-technically-possible-in-episode-1x01-of-m

https://www.reddit.com/r/MrRobot/comments/8w9rfg/confused_about_the_tor_scene/

https://news.mit.edu/2015/tor-vulnerability-0729

Proxy

A proxy is a server that acts as an intermediary between the user and the internet. When a user connects to the internet through a proxy server, their connection requests are sent to the proxy server first, and then the proxy server connects to the internet on the user's behalf.

Here is a simplified example of how this works:

1. You (the customer) submit a request to visit a website (eg www.example.com).
2. The request is sent to the proxy server.
3. The proxy server connects to www.example.com and requests content from the site.
4. www.example.com sends the content back to the proxy server.
5. The proxy server sends the content to you.

Proxy servers can be used for many reasons, including to improve privacy (by hiding the user's IP address), to improve performance (by caching web pages), or to circumvent access restrictions to certain websites.

A common type of proxy server is the SOCKS proxy. Unlike other types of proxies, a SOCKS proxy can handle any type of internet traffic, including email traffic, chat traffic, FTP traffic, etc.

Configuring a client to use a SOCKS proxy usually involves the following steps:

1. Find your client's network or internet settings (this varies depending on the client you are using).
2. Look for an option to configure a proxy or a SOCKS proxy.
3. Enter the IP address and port of the SOCKS proxy server.
4. Save the settings and restart the client if necessary.

For example, to configure Firefox to use a SOCKS proxy, you would do the following:

1. Go to Firefox's Preferences.
2. Click on the "Network Settings" section.
3. Select the "Manual proxy configuration" option.
4. In the "SOCKS Host" section, enter the IP address and port of your SOCKS proxy server.
5. Select "SOCKS v5" unless you know you need to use SOCKS v4.
6. Click "OK" to save the settings.

Keep in mind that while a proxy can improve your privacy, it is not as secure as a VPN or the Tor network, which encrypt all your internet traffic. A proxy server only protects the requests that are sent through it, and the operator of the proxy server can see all the traffic that passes through it.

On Linux, you can set environment variables to use a proxy server. These variables are used by most programs that connect to the internet.

Here are the steps to configure a proxy server using the terminal:

Open the terminal.

To configure an HTTP proxy server, use the export command to set the http_proxy environment variable.

For example:

export http_proxy=https://[username]:[password]@[proxy]:[port]         

Replace [username], [password], [proxy] and [port] with your proxy server details. If the proxy server does not require authentication, you can leave out the [username]:[password]@ part.

For an HTTPS proxy server, set the https_proxy variable:

export https_proxy=https://[username]:[password]@[proxy]:[port]         

To verify that the variable has been set correctly, you can use the echo command. For example:

echo $http_proxy        

This should show your proxy server address.

These settings are temporary and will be lost when you close the terminal. To make them permanent, you can add export commands to the shell's startup file (such as .bashrc or .bash_profile), which is run every time you open a new terminal.

To set up a SOCKS proxy, the process is a little different and depends on the specific program you are using. Many programs have their own SOCKS proxy settings that you need to configure separately.

Example:

To use Nmap over the Tor network and a SOCKS proxy, you will need a utility called proxychains. Proxychains is a program that forces any TCP connection to go through a proxy. It can be used to forward Nmap traffic over Tor.

Here are the general steps for configuring and using Nmap with Tor and Proxychains:

Install Tor and Proxychains: Depending on your Linux distribution, you can use the package manager for this.

On Ubuntu, you can use apt:

sudo apt-get install tor proxychains         

Configure Proxychains: The Proxychains configuration file is usually located in /etc/proxychains.conf. You must ensure this file is configured to use Tor. That is, there should be a line at the end of the file that says socks4 127.0.0.1 9050. This setting tells Proxychains to use Tor, which normally listens on IP address 127.0.0.1 and port 9050.

Start Tor: You can do this by running tor in a terminal. On some distributions it may be necessary to start Tor as a service, for example systemctl start tor or service tor start.

Use Nmap with Proxychains: You can now use Nmap with Proxychains. To do this, you simply prefix the nmap command with proxychains. For example:

proxychains nmap -sT -PN -n -sV -p 80 www.example.com        

Whonix

Whonix is a Debian-based Linux distribution that is designed to provide privacy, security and anonymity on the internet. It does this by utilizing the Tor network for all internet connections and isolating different tasks in different virtual machines to prevent IP leaks and other forms of deanonymization.

The Whonix setup consists of two parts: the Workstation and the Gateway. The Workstation is where the user performs all activities, such as surfing the internet, sending emails, etc. The Gateway is responsible for connecting to the Tor network and routing all Workstation traffic through the Tor network.

Here are some tips and tricks for using Whonix:

1. Regular updates: Whonix is based on Debian, so you can use apt-get to keep your system up to date. It is recommended to do this regularly to ensure you have the latest security patches.

2. Using Tor Browser: Whonix comes with Tor Browser, which is a modified web browser to protect your privacy and anonymity. It is recommended to use Tor Browser for all web browsing activities.

3. Task isolation: One of the key features of Whonix is task isolation. This means you can use different Workstations for different tasks to avoid correlation of activities. For example, you can use one Workstation to browse the web and another to send e-mails.

4. Be careful what you share: Remember that while Whonix can protect your anonymity, it cannot protect you from sharing personal information. Be careful when sharing information that could be used to identify you.

5. Using VPNs or Proxies with Whonix: While it is possible to use a VPN or proxy with Whonix, it is generally not recommended. The Tor network already provides anonymity, and using a VPN or proxy can introduce additional vulnerabilities.

6. Malware protection: Like any system, Whonix can be vulnerable to malware. Therefore, it is important to practice good security habits, such as not downloading files from unknown or untrusted sources.

7. Reading the Documentation: The Whonix documentation is extensive and covers many topics related to internet privacy and security. We highly recommend reading it to better understand how Whonix and the Tor network work.

Install and Configurate using KVM

Connect to Host via SSH with tunneled ports:

ssh $USER@$HOST -L 5910:localhost:5910 -L 5911:localhost:5911        

Whonix Gateway

1. Download & Extract?Whonix Gateway:

cd /var/lib/libvirt/images
wget https://www.whonix.org/download/13.0.0.1.1/Whonix-Gateway-13.0.0.1.1.libvirt.xz
tar -xvf Whonix-Gateway*.libvirt.xz        

Create Network:

virsh define Whonix-Gateway*.xml
sed -i 's/virbr1/whonixbr1/g' Whonix_network-*.xml
virsh net-define Whonix_network*.xml
virsh net-autostart Whonix
virsh net-start Whonix        

Configure & Start Whonix VM:

virt-xml Whonix-Gateway --remove-device --graphics 
virt-xml Whonix-Gateway --edit --graphics 'vnc,password=test,port=5910,keymap=de'
virsh start Whonix-Gateway        

Connect VNC to?127.0.0.1:9510?& Finish Whonix Wizard.

Kali

1. Create Disk Image:

qemu-img create -f qcow2 /var/lib/libvirt/images/kali.qcow2 32G        

Download & Modify Preseed File:

wget -O preseed.cfg https://raw.githubusercontent.com/offensive-security/kali-linux-preseed/master/kali-linux-light-unattended.preseed
sed -i 's/\/dev\/sda/\/dev\/vda/g' preseed.cfg        

Install Kali Linux:

virt-install --name kali \
  --ram 2048 \
  --disk "bus=virtio,path=/var/lib/libvirt/images/kali.qcow2,format=qcow2" \
  --vcpus 2 \
  --accelerate \
  --os-type "linux" \
  --noautoconsole \
  --network "bridge=virbr0" \
  --location "https://http.kali.org/kali/dists/sana/main/installer-amd64/" \
  --graphics "vnc,port=5911,password=secret,keymap=de" \
  --initrd-inject "preseed.cfg" \
  --extra-args "keymap=de"        

Start Kali:

virsh start kali        

1. Connect VNC to?127.0.0.1:9511?& Login with?root:toor
2. Install Kali Packages:

apt-get install kali-linux-full        

Change Network to the Whonix Gateway's internal Network:

virsh detach-interface kali --type bridge
virsh attach-interface kali --type=bridge --source=whonixbr1        

Configure Kali Network:

• IP:?IP
• Netmask:?255.255.192.0
• Gateway:?10.152.152.10
• Nameserver:?10.152.152.10

Reboot:

virsh destroy kali
virsh start kali        

https://gist.github.com/jkullick/1d41972fc12c777f56bb88c9ca0c937f

https://www.whonix.org/wiki/Manually_Create_Whonix_VM_Settings

https://securityonline.info/anonymity-whonix-kali-linux/

Tails

Tails, which stands for The Amnesic Incognito Live System, is a Debian-based Linux distribution that is designed to provide privacy and anonymity. Like Whonix, Tails uses the Tor network to anonymize all Internet connections.

Tails is a live operating system, which means that it runs from a removable device, such as a DVD or USB stick, and does not need to be installed on your computer's hard drive. One of the main features of Tails is that it leaves no trace on the computer it runs on. It is designed not to use your computer's hard drive or memory unless specifically instructed to do so.

Here are the general steps for configuring Tails:

1. Download Tails: Go to the official Tails website (https://tails.boum.org/) and download the latest Tails ISO image.
2. Create a bootable USB stick or DVD with Tails: You can use a program like Etcher or Rufus to create a bootable USB stick with the Tails ISO image you downloaded. If you prefer, you can also burn the ISO image to a DVD.
3. Launch Tails: Restart your computer and boot from the Tails USB stick or DVD. You may need to change the boot order in your computer's BIOS or UEFI to do this.
4. Configure Tails: The first time you launch Tails, you will go through a configuration process. This includes things like setting your language and keyboard layout, and setting an administrator (root) password. Tails also has an option to create "Persistent Storage", which is an encrypted portion of the USB stick that can be used to store files between different Tails sessions.
5. Use Tails: Now you can start using Tails. Tails comes with a variety of pre-installed programs for browsing the web, sending emails, editing documents and much more. All these programs are configured to use the Tor network and respect your privacy.

Here are some notable examples of how Tails has been used historically:

1. Human Rights Activists: Activists in countries with repressive regimes have used Tails to communicate securely and access blocked or censored information. Tails allows them to use the internet without fear of being monitored by the government.
2. Investigative Journalism: Journalists, especially those working with confidential sources or dealing with sensitive information, have used Tails to protect their communications and their work. Tails was used by journalists involved in reporting Edward Snowden's revelations about the US National Security Agency in 2013.
3. Surveillance Protection: People who want to protect their privacy from corporate and government surveillance have been using Tails. With increasing awareness of privacy issues, more people are turning to tools like Tails to protect their personal information.
4. Cybersecurity Research: Security researchers and IT professionals also use Tails. For example, they might use Tails when working on malware or when conducting security investigations to avoid contaminating their core systems.

As an operating system focused on privacy and security, Tails has been an important tool for many individuals and organizations working in sensitive areas or facing powerful adversaries such as governments and corporations.

https://blogs.halodoc.io/using-tails-for-a-secure-private-browsing-experience/

https://medium.com/geekculture/become-anonymous-and-untraceable-with-tails-os-9823ceee4770

VPN (Virtual Private Network)

VPN, or Virtual Private Network, is a technology that allows you to create a secure connection between two devices on a network, usually the internet. When using a VPN, all data traffic is encrypted and sent through a virtual "tunnel", protecting your information from being intercepted or seen by others.

VPNs are used for several purposes:

1. Privacy: When using a VPN, your real IP address is hidden and your internet traffic appears to come from the VPN server, which can help protect your online privacy.
2. Security: A VPN encrypts all of your internet traffic, which can protect you from eavesdropping such as "man-in-the-middle" attacks, especially when using public Wi-Fi networks.
3. Avoiding censorship and geo-blocking: VPNs can allow you to access content that is blocked by your geographic location or by government censorship, making it appear as if you are browsing from a different location.

OVPN is a configuration file format used by OpenVPN which is open source VPN software. An .ovpn file contains all the information needed to connect to a VPN, including the VPN server address, encryption keys, and any specific configuration options.

To use an .ovpn file, you usually need a VPN client that supports OpenVPN, such as the OpenVPN client itself. You import the .ovpn file into the VPN client, and it can then use the information in the file to connect to the VPN.

Tor + VPN?

Yes, it is technically possible to use a VPN in conjunction with the Tor network, but how effective this combination is depends very much on what you are trying to achieve and the specific threat model you are facing. Here are two common configurations:

1. VPN over Tor: In this setup, you connect first to the Tor network and then to your VPN. This can be useful if you want to access services that block connections from the Tor network, as the traffic will appear as coming from the VPN and not Tor. However, this means that the VPN provider can see your real internet traffic, which may not be ideal from a privacy point of view.
2. Keep in mind that both configurations have pros and cons, and neither is a perfect solution for all scenarios. Also, using a VPN with Tor can significantly slow down your connection.

Configurando sua VPN

https://github.com/KhetaguriDimitri/TORvpn

HINT:

Create your own VPN?

1. VPN providers: There are many providers that offer server infrastructure for you to set up your own VPN. Some of the most popular ones include DigitalOcean, Linode, and Amazon Web Services (AWS). These providers provide a wide range of options to choose from depending on your budget and infrastructure needs.
2. Proxy Sources: There are several sources of proxies, both free and paid. However, free proxies may not be as secure or reliable as paid ones. Some reliable paid proxy providers include ProxyRack, Oxylabs and Smartproxy.
3. Starting a VPN Service: If you are thinking about starting your own VPN service, here are some things to consider:

• Technical knowledge: You need to have a good understanding of networking and security.
• Legality: Ensure that you comply with all local and international laws and regulations.
• Security: Use strong encryption protocols to protect users' privacy and data.
• Transparency: Be transparent about your policies, especially with regard to the retention and handling of user data.

4. Ensuring Users' Security and Privacy: Here are some ways to ensure users' security and privacy on a VPN service:

• Use strong encryption: This will ensure that data transmitted over the VPN is secure.
• Implement a no-logs policy: This means that you do not log any information about users' VPN usage.
• Keep your servers secure: This includes keeping all your software up to date and patching any security vulnerabilities that may arise.
• Provide two-factor authentication (2FA): This will add an extra layer of security by preventing unauthorized access.

Keep in mind that operating a VPN service can be a technical and legal challenge. It is important to research and understand all the implications before proceeding.

VPN Solutions

https://mullvad.net/pt

https://www.privateinternetaccess.com/

https://airvpn.org/

https://hidemy.name/en/

https://alerdium.io/ (No Tested)

https://surfshark.com/pt-br/

"The main detail to be looked at in the VPN is how the activity logs are stored."

"Wireguard or OpenVPN?"

"Double-Connection or VPN Chaining?"

Torbox

What’s this all about?

TorBox is an easy to use, anonymizing router based on a Raspberry Pi. TorBox creates a separate WiFi that routes the encrypted network data over the Tor network. Additionally, TorBox helps to publish data easily and safely through Onion Services. The type of client (desktop, laptop, tablet, mobile, etc.) and operating system on the client don’t matter.

Tor, on which TorBox is based, encrypts your network data from your client to the Tor exit node, overcomes censorship, and anonymizes your data stream. Commonly, Tor is used by the?Tor Browser, which facilitates surfing the web or accessing?onion services?(.onion – Websites). However, there are also other programs using Tor, like the peer-to-peer messenger app?Ricochet Refresh,?TorBirdy?(an extension for Mozilla Thunderbird) and?OnionShare. Though wouldn’t it convenient to route?all your data?through the Tor network, independently from the client, the service, and the program be used?

TorBox accomplishes this by creating a separate WiFi and routing all network data over the Tor network. Also, clients can be connected to a TorBox using an Ethernet cable. The TorBox image file,?available here?(~1.1 GB), can be run on a low-priced?Raspberry Pi.

TorBox can be connected to an Internet router through an Ethernet cable, but it can also be used in connection with another (unsecured) WiFi, even if it has a?captive portal.

https://www.torbox.ch/

VPS (Virtual Private Server)

VPS is the acronym for Virtual Private Server, or Virtual Private Server. It is a type of web hosting service that provides users with a dedicated server environment on one machine that is shared by multiple users. This is accomplished through the use of virtualization technology, which divides a physical server into several separate virtual "machines".How to set up a VPS:

1. Choose a VPS Provider: There are many VPS providers available such as DigitalOcean, Linode, AWS, Google Cloud, etc. The choice of provider can depend on many factors such as cost, performance, customer support, server location and others.
2. Select the right package: VPS providers often offer multiple packages with different resource levels (CPU, memory, storage). Select the package that best suits your needs.
3. Configure the VPS: After purchase, you will have to configure the VPS. This may involve installing the operating system, configuring the web server (eg Apache, Nginx), installing the database (eg MySQL, PostgreSQL) and installing any other necessary software.
4. Manage the VPS: Once the VPS is set up, you will need to manage it regularly. This may include maintaining the software (eg updates), monitoring performance and responding to any issues that may arise.

Benefits of a VPS:

Dedicated Resources: Unlike shared hosting where server resources (CPU, memory, storage) are shared among many users, in a VPS you have a specific amount of resources reserved just for you.

Full control: You have full control over the server environment, which means you can install any software you want and configure the server the way you see fit.

Scalability: As your needs grow, it's easy to upgrade your VPS package for more features.

Isolation: As each VPS is a separate environment, your processes are not affected by what other users are doing on the server.

Cost-effectiveness: VPS tend to be more affordable than physical dedicated servers and can offer many of the same benefits

Solutions:

https://privatealps.net/en

https://www.racknerd.com/

https://www.ovhcloud.com/

https://psb-hosting.pro/

Sock Puppet

The term "sock puppet" is used to refer to a false or alternate online identity created by a person or organization. Typically, sock puppets are used to influence online discussions, manipulate public opinion, or spread misinformation. In some cases, they can also be used for spying or intelligence gathering purposes.

In the context of Open Source Intelligence (OSINT), a sock puppet can be used to collect information without revealing the real identity of the collector. For example, a sock puppet can be used to infiltrate an online group, participate in discussions, ask questions, and gather information without arousing suspicion.

https://github.com/CScorza/OSINTAnonymous

https://osintcurio.us/2020/08/17/creating-research-accounts-for-osint-investigations/

https://osintteam.blog/create-sock-puppet-profile-for-osint-investigation-9235d8503814

https://osintcurio.us/2022/05/17/corporate-osint-for-social-engineering/

Secure Mailer

A criptografia de e-mails é um método para proteger a privacidade e a seguran?a das mensagens de e-mail, codificando-as de tal forma que somente o destinatário pretendido possa lê-las. Isso é feito usando uma chave de criptografia que pode ser usada para codificar e decodificar as mensagens.

There are two main types of email encryption:

1. End-to-End Encryption (E2EE): This is the most secure type of email encryption. With E2EE, the message is encrypted on the sender's device and can only be decrypted on the recipient's device. This means that no one, not even your email provider, can read the message while it's in transit.
2. Transport Layer Encryption (TLE): In this type of encryption, the message is encrypted while it is being transmitted between the email server and the recipient's device. However, the message is readable by the email server, which means that the email provider or anyone with access to the server could potentially read your messages.

Advantages of email encryption include:

Privacy: Email encryption ensures your messages remain private and can only be read by the intended recipient.

Security: Email encryption protects your messages from being intercepted and read by malicious third parties.

Data Integrity: Email encryption can also help ensure the integrity of your messages, ensuring they haven't been altered in transit.

Authentication: Some email encryption systems also provide authentication, which means you can be sure the message really came from the person it says it came from.

There are several secure mail solutions available that prioritize encryption and privacy. Here are a few examples:

1. ProtonMail: Based in Switzerland, ProtonMail offers end-to-end encryption and does not log IP addresses, making it a popular choice for secure, private email. It has a user-friendly interface and also provides a free account tier with limited features.
2. Tutanota: A German-based email service that offers end-to-end encryption. Like ProtonMail, Tutanota has a free account tier and also offers premium tiers for additional storage and features.
3. Hushmail: This is a paid email service that offers encryption and added security features. It's been around for a long time and is popular in the healthcare industry because its services are compliant with the Health Insurance Portability and Accountability Act (HIPAA) in the United States.
4. Mailfence: Based in Belgium, Mailfence offers end-to-end encrypted email and has a strong commitment to privacy. They also provide digital signing as part of their service.
5. Zoho Mail: Zoho offers a suite of online productivity tools including a secure email solution. While it may not have the same privacy focus as some of the others on this list, it does provide SSL/TLS encryption and is compliant with several international security standards.
6. CounterMail: This is a Swedish email service with a strong focus on security and privacy, offering end-to-end encryption and a diskless server design for added security.
7. Fastmail: An Australian-based email service that does not use ads and offers several layers of security including two-step verification and secure SSL connections.

https://riseup.net/pt/email

https://www.gmx.com/consentpage

Encrypted Messaging Apps

1. Signal: Signal is a free, open-source messaging service developed by the Signal Foundation and Signal Messenger LLC. It uses end-to-end encryption to secure all communications to other Signal users. Signal can allow you to send text messages, voice messages, pictures, videos, files, and even make voice and video calls. Moreover, Signal doesn't store metadata and you can set messages to delete after a certain period of time, enhancing privacy.
2. Threema: Threema is a paid app that provides end-to-end encryption for messages, voice calls, photos, and even status updates. It's based in Switzerland, which has strong privacy laws, and it doesn't require a phone number to sign up, which can help protect your identity.
3. Telegram: Telegram offers end-to-end encryption in its "Secret Chats" feature, which also includes a self-destruct feature for messages. However, note that regular chats are not end-to-end encrypted. Telegram requires a phone number to sign up, but it allows you to use a pseudonym.
4. Session: Session is an open-source messaging application that is designed to protect your privacy. It doesn't require any sort of personal information (like a phone number or email) to create an account. Instead, it generates a Session ID that you can share with others. All messages sent over Session are end-to-end encrypted, and it uses onion routing for added privacy.
5. Wire: Wire is another open-source encrypted messaging app that provides end-to-end encryption for text messages, voice and video calls, and file sharing. It's based in Switzerland and complies with Swiss data protection laws. Wire offers a free version for personal use, as well as paid versions for businesses.
6. Wickr: Wickr is a secure, private, and compliant messaging platform that's trusted by world leaders, executives, journalists, human rights activists, and your friends.

Other Encrypted Messaging

• Keybase
• Briar – Darknet Messenger
• Onionshare

Disk Encryption

Disk encryption is a technology that protects information by converting it into unreadable code that cannot be deciphered easily by unauthorized people. It uses disk encryption software or hardware to encrypt every bit of data that goes on a disk or disk volume.

Two types of disk encryption include:

1. Full Disk Encryption (FDE): This is a technique where everything on a hard drive is encrypted, including the operating system and all your files. This means that when the system is off, the data is secure. However, when you boot up the system and decrypt the data to use it, you're relying on other security measures to protect your data, such as OS-level permissions.
2. File-Level Encryption (FLE): This is where individual files or directories are encrypted by the file system itself. This can be more flexible than full disk encryption, as it allows you to only decrypt what you need to access, and the rest of your files remain encrypted and thus secure.

Techniques of Disk Encryption:

1. Symmetric Key Encryption: In this form of encryption, a single key is used to both encrypt and decrypt data. The security of symmetric key encryption is ensured by keeping the key a secret. Advanced Encryption Standard (AES) is a commonly used form of symmetric key encryption.
2. Asymmetric Key Encryption: Also known as public-key cryptography, it uses two keys – a public key and a private key. The public key is used to encrypt data, and the corresponding private key is used to decrypt it. This is considered more secure than symmetric key encryption but is also more resource-intensive. RSA (Rivest-Shamir-Adleman) is a widely used asymmetric encryption algorithm.
3. On-the-Fly Encryption (OTFE): This technique encrypts and decrypts files quickly as they are written or read from the disk. The encryption is transparent to the user and does not interfere with usage.

Some of the most popular disk encryption software includes:

1. BitLocker: A full disk encryption feature included with Windows.
2. FileVault 2: A disk encryption program available in Mac OS X 10.7 and later.
3. VeraCrypt: An open-source disk encryption software for Windows, Mac OS X and Linux.
4. LUKS: The standard for Linux hard disk encryption.

Hints:

On Linux hosts, it may be possible to obtain plausible deniability using different methods than those listed below, but this topic is a rabbit hole. Plausible deniability and full disk encryption (FDE) are also useless if physically coerced by the hijacker. A safer option is to leave no trace of detectable data on the personal computer. Whonix? grub-live package provides amnesic functionality on Debian hosts and the Whonix? virtual environment. When used exclusively within a virtual machine, it can provide adequate legal protection if several precautions are taken.

To protect against theft of information or personal data on the host, FDE should be used, and the computer should be turned off during high-risk situations such as travel. In the case of laptops, the battery should be temporarily removed after powering down. This ensures that RAM chips are completely deactivated and all encryption keys in memory are wiped. Hibernation is also a safe alternative, as the swap partition is encrypted in the default FDE setup for several platforms (e.g., Debian), provided that no changes have been made.

Additional

Removing the Luks Headers

Removing the LUKS header is a security measure that can be taken to ensure that data on an encrypted hard drive cannot be recovered. The LUKS header contains the necessary information to decrypt the disk, so by removing it, you effectively make the data inaccessible.

To remove the LUKS header from a disk, you can use the cryptsetup command in the Linux terminal. Replace /dev/sdXY with the encrypted partition. Respond YES to the prompt:

sudo cryptsetup luksErase /dev/sdXY         

Alternatively, to achieve the same goal without prompting, run:

sudo dd if=/dev/zero of=/dev/sdXY bs=1M count=2         

This will overwrite the first two megabytes of the /dev/sdXY partition, which should cover the entire LUKS encryption header for version 1. If you're using LUKS2 with cryptsetup version 2.1.0 (Debian Buster default), the default header size is now 16 MB. Earlier cryptsetup versions used a 4MiB LUKS2 header. In this case, just adjust the dd command: dd if=/dev/zero of=/dev/sdXY bs=1M count=16 (or count=4). Determine the header size using the command cryptsetup luksDump --debug <device>.

https://sleeplessbeastie.eu/2019/04/10/how-to-erase-luks-header/

Nuke Patch for cryptsetup

The Nuke Patch for cryptsetup is a feature implemented by the Kali Linux distribution's penetration testing team. It adds an option to cryptsetup that allows all key slots to be erased upon entering a specific password, essentially rendering the encrypted data on the drive inaccessible, hence the name "nuke".

The concept behind this patch is that in a situation where someone is forced to reveal their encryption password, they could instead provide the "nuke" password. This would effectively delete all encryption keys, making the data on the hard drive unreadable.

Here's how to implement the Nuke Patch on cryptsetup:

1. First, you'd need to download and apply the Nuke Patch to your existing cryptsetup installation. This process may vary depending on your Linux distribution.
2. Once the patch is applied, you can create a new LUKS partition with a nuke password. During the LUKS partition setup, you'd enter a regular unlock password and a separate nuke password.
3. In the future, if you're forced to unlock your encrypted hard drive, you can enter the nuke password instead of the regular password. This will erase all key slots, making the data on the drive unreadable.

https://github.com/roema/cryptsetup-nuke

https://gitlab.com/kalilinux/packages/cryptsetup-nuke-keys

Separate / boot partition

When using Full Disk Encryption (FDE) on a host, it's often recommended to keep the /boot partition separate from the rest of the encrypted system. This is because the /boot partition contains the initial boot loader and kernel image, which need to be accessible for the system to start up. However, if these files are stored unencrypted, they could potentially be tampered with, compromising the security of the rest of the system.

Here's how you might set up a separate /boot partition:

1. During the installation process of your Linux distribution, you'll usually have the option to manually partition your hard drive. Choose this option.
2. Create a small partition for /boot. The size depends on your distribution and how many kernel images you plan on keeping, but typically, 500MB to 1GB should be sufficient.
3. Set the rest of the disk (or the part you want to encrypt) as your root (/) partition. During the setup, choose to encrypt this partition.
4. The installer will set up the boot loader to unlock the encrypted root partition using a passphrase that you provide during boot.
5. Once the installation is complete, the /boot partition will remain unencrypted, and the rest of the system will be encrypted.

Remember that an attacker with physical access to the system could still potentially tamper with the /boot partition. Some users choose to mitigate this risk by storing the /boot partition on a USB stick that they can keep separate from the computer when not in use.

TRESOR Kernel Patch

The TRESOR Kernel Patch is a Linux security feature that is used to mitigate the risk of cold boot attacks, which involve an attacker obtaining encryption keys from a machine's RAM.

Traditional full-disk encryption systems store the encryption keys in RAM while the system is running. This exposes the keys to potential threats, since RAM can be read by any process with administrative privileges, and the data in RAM can also persist for a short period of time even after power loss, making it possible to physically extract the keys.

TRESOR aims to solve this problem by storing the encryption keys inside the CPU, specifically in the debug registers used by the CPU's built-in debugging facilities. This makes the keys much more difficult to access, and they are also immediately lost when the system is powered down, preventing cold boot attacks.

However, there are some limitations to TRESOR:

1. It only works on certain CPUs. The CPU must have support for the AES-NI instruction set and the x86 architecture.
2. It disables software debugging facilities, as it uses the debug registers to store the encryption keys.
3. It's not a part of the standard Linux kernel, so it has to be patched in. This can make system updates more complex.
4. It may not protect against attackers with physical access to the machine who can use hardware attacks to read the CPU registers directly.

https://www.cs1.tf.fau.de/research/system-security-group/tresor-trevisor-armored/

USB Killer

USBKill is an anti-forensic script written after the end of the SilkRoad process.?Its purpose is to trigger security events that prevent attackers from downloading files, installing malware, or running a mouse jigger.?The script creates a whitelist of valid USB devices.?If anything else is connected to the machine, the RAM is erased and the computer shuts down immediately.

USBKill can also be configured to exclude all devices from being connected.?In another high security configuration, the whitelisted flash drive serves as the key and must be permanently in the USB port.?If the flash drive was forcibly removed, the program will run the necessary procedures

https://github.com/GoldenSwordLLC/Killer

https://usbkill.com/

https://github.com/hephaest0s/usbkill

https://null-byte.wonderhowto.com/news/cheap-usb-kill-stick-destroys-any-computer-you-want-0173841/

Clear hard disk table and sectors

If you want to completely clear your hard disk drive, meaning that you want to erase all the data on it, you can do this with the dd command in Linux. This command will overwrite all data on your hard drive with zeros, making it very difficult (but not impossible) to recover any data.

Before proceeding, please be aware that this will permanently delete all data on the drive. Make sure you have backed up any important data before you do this.

Here is the command:

sudo dd if=/dev/zero of=/dev/sdX bs=4096         

Replace sdX with the correct identifier for your hard drive. For example, it might be sda for the first hard drive. You can check the identifiers for your drives with the lsblk or fdisk -l command.

The dd command works as follows:

• if=/dev/zero specifies the input file. In this case, it's /dev/zero, a special file that produces null bytes when read.
• of=/dev/sdX specifies the output file. This should be your hard drive.
• bs=4096 specifies the block size. This is set to 4096 bytes, or 4 KiB, which is a common block size for many modern hard drives.

Please note that this operation can take a long time, depending on the size and speed of your hard drive.

After running this command, your hard drive will be completely empty, and you will need to create a new file system on it before you can use it again.

If you want to make the data even harder to recover, you could overwrite the drive with random data instead of zeros. To do this, you can use /dev/urandom as the input file:

sudo dd if=/dev/urandom of=/dev/sdX bs=4096         

This will take much longer than overwriting with zeros, but it provides a higher level of security.

Data destruction by Mr. Robot (No recommended)

Elliot drilled holes in the hard drives to expose the platters to air and dust. The metal shavings would have also scratched the surface of the platters and the holes themselves would have either prevented the platters from spinning altogether or would have screwed up the read/write head if anyone tried to recover the data. Personally, when I destroy a hard drive, I prefer to go over each side of the platters with a belt sander just to be sure. But when in a pinch, drilling holes is probably good enough. Even just removing the cover would make data recovery very difficult.

For the motherboards, he removed the DRAM, BIOS ROM, and CMOS RAM chips, which may have contained identifying information. Crushing them would have probably done the trick, but throwing them in the microwave was faster. He did the same for his MicroSD and SIM cards.

The rest of the PC he just threw in the trash, which again, is fine in a pinch. But a lot of the other chips on the motherboard and hard drive controller could have contained persistent writable memory and should have been destroyed, as well. But maybe he did that and we just didn't see

https://www.reddit.com/r/MrRobot/comments/44lyuj/method_of_destruction_used_in_mrrobot_no_spoilers/

Don't do this at home, I recommend looking at reddit above for more details and there are better methods with electrical discharges and such

General OpSec Techniques

Operational Security (OpSec) techniques for maintaining anonymity often involve obscuring your identity, encrypting your communications, and using secure systems. Here are ten such techniques and example tools:

1. Anonymity Networks: Tools such as the Tor network can be used to anonymize your online activity. Tor helps to protect your privacy by bouncing your communications around a distributed network of relays run by volunteers all around the world.
2. Virtual Private Networks (VPNs): VPNs such as NordVPN or ExpressVPN can be used to create a secure, encrypted connection, effectively hiding your IP address and protecting your online identity.
3. Secure and Private Browsers: Browsers like Tor Browser or Brave provide features that prevent tracking and help maintain user anonymity.
4. Secure Email Services: Use email providers that emphasize privacy and security, like ProtonMail or Tutanota.
5. Secure Messaging Apps: Applications like Signal or Wire offer encrypted messaging services, ensuring that only you and the person you're communicating with can read what is sent.
6. Anonymous Payment Methods: Cryptocurrencies like Bitcoin, Monero, or Zcash can be used for anonymous transactions. Prepaid gift cards can also offer a degree of anonymity.
7. Privacy-focused Search Engines: Rather than using a search engine that tracks your activity, use one that respects your privacy like DuckDuckGo or Startpage.
8. Data Encryption Tools: Tools like VeraCrypt can be used to encrypt your data, preventing unauthorized access.
9. Disposable Virtual Machines: Tools like Tails, a live operating system that you can start on almost any computer from a USB stick or a DVD, leaves no trace unless you explicitly ask it to.
10. Pseudonyms: Use pseudonyms when possible to avoid using your real name online, which can be tied back to your identity. Be consistent in using these across services to maintain your alter ego.

Anti-Forensic and Hardware Solutions

https://github.com/shadawck/awesome-anti-forensic

https://pwnieexpres.com/collections/all

https://shop.hak5.org/

Conclusion

Anti-forensics, anonymity and opsec methods go far beyond what has been shown, whether you use alternate phone numbers, wipe metadata from files and photos, use encrypted USB drives and others without write permission read-only to store information, in addition to being encrypted. Use P2P forms of communication or that use cryptographic keys and secure communication tunnel. Using OSINT techniques to map your tracks on the internet, famous digital footprinting and even investing in equipment. That's why it requires expenses and costs that depending on your reality, it's better to do the minimum. Being a Black Hat is not something simple as shown in the movies, you can take half of what I've shown here and use it in your day to day as a Red Teamer and White Hat to carry out campaigns and test your internal team.

Another thing is the way you make monetary transactions, verify currencies that use more sophisticated security technologies and that make it difficult to track and detect abuse.

Also, other unspoken methods are encryption and the techniques of hiding a file or message in a photo, audio and even inside another file. Example:

https://www.youtube.com/watch?v=teShYhts2So&ab_channel=ShaketheFuture

https://medium.com/analytics-vidhya/get-secret-message-from-audio-file-8769421205c3

https://www.youtube.com/watch?v=EVsx0pE8uPI&ab_channel=zips.exe

https://www.youtube.com/watch?v=TWEXCYQKyDc&ab_channel=Computerphile

https://www.youtube.com/watch?v=2sKENpzPt6w&ab_channel=KiltsandComputers

https://www.youtube.com/watch?v=BQPkRlbVFEs&ab_channel=BlackHat

https://www.youtube.com/watch?v=sLkdtjJc6mc&ab_channel=NetworkChuck

https://www.youtube.com/watch?v=9UZh-4Er7BQ&ab_channel=NullByte

Other Content about Anonymit

https://www.youtube.com/watch?v=5bcbmef4I3I&ab_channel=AltiumStories

https://www.youtube.com/watch?v=rMSgnOYcEVE&ab_channel=DoingFedTime

https://www.youtube.com/watch?v=eSoOUvpb2HU&ab_channel=BlackHat

https://www.youtube.com/watch?v=E4SYtCOYzQM&ab_channel=CATx003_

https://www.youtube.com/watch?v=qsvMhGXBdg8&ab_channel=CATx003

_