Security by isolation: Using Whonix to achieve high levels of privacy and anonymity - notluther - Oct 18, 2017
I see a lot of people on this subforum asking for advice on what setup they should be using if they want to be anonymous on the world wide web. Today I am going to share here what I consider to be a pretty secure setup that will protect you from deanonymizing malware and only requires a normal amount of discipline to use without compromising your identity through cross-contamination.
Pre-requisites
- A decent machine – 8GB of RAM minimum, other specs matter less, but it helps if you have a powerful system
- An external storage device (e.g a 32GB flash drive)
- 1 to 1.5 hours of free time
Getting started
The first thing you will need to download is VeraCrypt. VeraCrypt is a fork of the last great version of TrueCrypt (7.1a), and has been updated to fix many vulnerabilities that existed in TrueCrypt, as well as the addition of new encryption and hashing schemes. The latest audit of the VeraCrypt code uncovered many bugs and vulnerabilities that have all since been patched.
Second, you will need to download and install the latest version of Oracle VirtualBox. You may also use another application like VMWare, but the instructions will differ from the ones you will find in this thread.
Finally, you will need to download Whonix. Whonix is an operating system that was designed around the idea of security by isolation. Whonix comes in two separate pieces, a gateway, and a workstation. Both systems will exist inside of virtual machines, and we will be storing the virtual hard disks for Whonix on an encrypted storage medium, that way it is not stored on any of your hard drives in the event of your machine being hacked, stolen, or confiscated during a raid by law enforcement.
I will not be covering the process of verifying the integrity of your Whonix download, as teaching people how to use GPG is a thread unto itself.
If you are upto the task, or know how to use GPG already, I would highly recommend that you take the extra few minutes to verify your installation hasn't been tampered with.
Those intersted in learning can read the Whonix documentation for verifying download integrity
Setting up encrypted storage
While you are waiting for Whonix to download, it's time to set up the encrypted storage volume that you will be storing your Whonix installation on. At this point you should have VeraCrypt installed and your external storage medium ready and waiting. I will put this section of the thread into a spoiler so those who already know how to do this can simply skip over it.
1. Open VeraCrypt and connect your external storage medium to your machine. Click on 'create volume' and select the second option – 'Create a volume within a partition/drive'. Screenshot
2. Leave things as is on this screen. A standard volume will suit us just fine, and there isn't much sense in making a hidden volume if the only thing you will be storing on it is a virtual machine (which by the way, it should be the only thing you store on this storage device) as VirtualBox will still show the existence of the two virtual machines. Screenshot
3. Click 'select device' and grant VeraCrypt administrative privileges. Select the partition you wish to encrypt on the storage medium you have connected to your machine. Screenshot
4. Here you will be presented with several choices for which encryption scheme and hashing algorithm will be used to encrypt your storage medium. For our purposes, the defaults of AES and SHA512 are fine. Screenshot
5. Enter a strong password. I suggest using something like Diceware to generate a password for this. Alternatively, you can use a local password manager like KeePassXC to generate and store the password to your volume. Screenshot
6. Pick the second option here, as the virtual hard disks for Whonix will be larger than 4GB. Screenshot
7. Pick the filesystem you would like your encrypted volume to use. I am using macOS, so the default is macOS extended, but it will be different if you are using a different operating system. Just keep it at the default and you should be fine. Screenshot
8. It's finally time to format and encrypt the volume. Make sure you read the notice on this screen. You are going to move your mouse as erratically and randomly as you can until the bar is FULL. This will increase the entropy of your encryption keys significantly. Screenshot
9. Wait.
10. Congratulations! If nothing went wrong, you now have an encrypted storage medium that you can use to store your Whonix installation.
Setting up Whonix
You might have noticed that the files you're downloading for Whonix end with the extension .ova. This is known as an open virtual appliance and is apart of the open virtualization format file standard used by VirtualBox. The Whonix team has graciously prepackaged everything you will need to use Whonix properly into these two files. Let's begin. I've gone ahead and put this section into a spoiler as well, for consistency.
1. Open VirtualBox.
2. From the toolbar at the top of the screen or at the window, go to File and then Import Appliance.
3. Navigate to wherever you downloaded the Whonix appliance files to and select one. This will bring you to a screen similar to this one – Screenshot
4. Click 'Import' and wait.
5. Repeat for the other appliance file.
I suggest editing the amount of RAM dedicated to each of these virtual machines. Whonix will automatically boot into a command line if it detects it is running with a low amount of RAM (196MB or less), so I suggest that you dedicate that much to the Gateway virtual machine as this system can be easily managed from the command line and should only be used during initial setup to secure the root and user account, as well to update the system periodically. The Workstation on the other hand should be given at least 2GB of RAM to be usable.
Simply scroll down a bit before importing and double click 'RAM' and you should be able to edit the default value. Alternatively, once the appliance has been imported you can select the VM and click on 'Settings' -> 'System' and edit the amount of RAM your VM will use from there.
Moving virtual machine to encrypted storage
It might sound pretty straightforward, but when I was first figuring out this set up on my own this came up as a hurdle, so I'd like to make sure you understand how to do this without issue. Spoilers for consistency.
In order to properly use Whonix from your external storage medium, we need to copy the .vdmk files over to encrypted storage and then change the UUID associated with each of these files. So let's begin
1. Open the terminal/command prompt and navigate to the directory on your machine where your Virtual Machines are stored (for all systems it should be under a folder called 'VirtualBox VMs' in the user's home directory, i.e the default location you should be at when the terminal opens).
2. Since you have two virtual machines, you will have two folders here, one for the Gateway and another for the Workstation. You can either navigate into those directories or follow these steps from the current directory, either will work.
3. Run this command against both Whonix .vmdk files
Code VBoxManage internalcommands sethduuid /path/to/file.vmdk
Example: VBoxManage internalcommands sethduuid Whonix-Gateway/Whonix-Gateway-13.0.0.1.4.vmdk
Once you have done this for both .vmdk files, it's time to move those and only those onto your encrypted medium. You can put them in a folder if you'd like but it's important that the only thing you move from your machine to your encrypted storage medium is the .vmdk files and none of the .vbox or .vbox-prev files you may find inside your VirtualBox directory.
Finally, we need VirtualBox to know that we've moved the .vmdk files, so open that back up if you closed it or focus the window if you haven't and follow these steps to change the location of your Virtual Hard Disk
1. Open the 'settings' menu for one of your Whonix virtual machines
2. Navigate to 'Storage'
3. Select the disk currently attached to your Virtual Machines SAS controller and then click on the disk icon next to the dropdown that says 'SAS Port 0' - Screenshot
4. 'Choose virtual hard disk file' and then navigate to your encrypted storage and choose the appropriate .vmdk for the virtual machine you are editing
5. Repeat for the other virtual machine
Congratulations! If nothing went wrong you should now be able to boot the virtual machines without any issue. From here, all that's left to do is change the default passwords on both machines to something more secure, and then finally update and upgrade the system's installed packages.
Housekeeping
By default, the passwords for both the Whonix Gateway and Workstation will be "changeme". Clearly, this isn't secure, and it's something small you can do to secure the system in the event of malware getting onto the machine. Something else you certainly need to take care of is will be updating and upgrading the software installed on the system
Changing the passwords is simple:
1. Open 'Konsole' if you are looking at a desktop environment inside your VM. If not, you are probably in low memory usage mode, so you should be looking at a command line already.
2. Switch to the root user by running 'sudo su' and entering the default password of 'changeme'
3. Run 'passwd' to update the root password, followed by 'passwd user' to change the user account password. Make sure you enter a strong password, as anything else would be counterproductive.
Make sure you do this for both the Gateway and Workstation.
Once you have the passwords changed on both machines, you should then update and upgrade both of them to ensure all packages on the system are up to date.
1. Open 'Konsole' if you are looking at a desktop environment inside your VM. If not, you are probably in low memory usage mode, so you should be looking at a command line already.
2. Run 'sudo apt-get update && sudo apt-get dist-upgrade -y' to pull down the latest repository information from various network mirrors and then upgrade all available packages, including the system kernel. Enter your new password if asked for it.
Simple, right?
Congratulations! If you were able to follow this guide successfully then you should now have a working Whonix installation stored securely on an encrypted storage device. Users who are interested in learning more about Whonix are encouraged to read their documentation thoroughly, as there is a LOT of stuff I didn't cover here as well as plenty of new information including more ways to secure your Whonix installation.
Again, if you have any questions, feel free to PM me or post in the thread and I'll do my best to answer them quickly.
* - /wrists - Oct 18, 2017
I enjoyed reading your thread. Thank you for sharing.
RE: Security by isolation: Using Whonix to achieve high levels of privacy and anonymity - HiddenEyE - Aug 14, 2018
HQ Post mate. always High quality.
|
