Encryption - Revision history

Goldbolt at 15:06, 7 March 2020

2020-03-07T15:06:57Z

Goldbolt at 18:53, 30 October 2019

2019-10-30T18:53:18Z

Goldbolt: /* Other links */

2019-08-10T19:02:33Z

‎Other links

Goldbolt at 15:16, 3 January 2019

2019-01-03T15:16:22Z

Goldbolt at 00:06, 3 January 2019

2019-01-03T00:06:45Z

Show changes

Goldbolt: Blanked the page

2019-01-02T23:47:37Z

Blanked the page

Goldbolt: Created page with "Data destruction is the "art" and various methods to securely erase files on a Hard Drive. For data destruction, wiping the entire drive is preferable since most operating sys..."

2019-01-02T23:46:11Z

Created page with "Data destruction is the "art" and various methods to securely erase files on a Hard Drive. For data destruction, wiping the entire drive is preferable since most operating sys..."

New page

Data destruction is the "art" and various methods to securely erase files on a Hard Drive. For data destruction, wiping the entire drive is preferable since most operating systems will leak details of your files (e.g. temporary copies of your document, mentions of it in most recently used lists, log files, registry entries, command history, etc.).

=Full Drive Wiping=

[http://www.dban.org/ DBAN] (Darik's Boot and Nuke) is the goto tool for drive wiping. Burn the iso to a cd or write it to a usb thumbdrive, boot from it and then it's just a matter of selecting which drives to wipe and how thoroughly you want them wiped. Using the [code]dodshort[/code] option is fine, and is recommended by DBAN themselves.

One pass is fine. Three if you're paranoid. The Gutmann 35 pass wiping is overkill. Gutmann himself has said that it's unneccesary on modern drives and even when he invented it in the 90s, many of the wipes were for different types of storage medium and the full 35 was overkill for any one device.

You could also boot a live linux distro and use one of the following commands to wipe a drive:

* # shred -vn 3 /dev/sdX
* # dd if=/dev/urandom of=/dev/sdX

=Individual File Wiping=

For individual files, the linux command "shred" can be used:

* $ shred -vun 3 file
* * -v for verbose
* * -u to remove the file after shredding it
* * -n to specify the number of passes
* * -z to add a final wipe of all 0s

=SSD Drives=

SSD drives (and flash memory cards/thumb drives) are trickier to securely erase since they perform wear leveling to preserve the life of their flash memory. This means your operating system can never be certain where data is stored on the drive. To mitigate against this:

* Encrypt from day one, so that your raw data will never be stored on the drive.
* Fill the drive to capacity with innocuous data, to overwrite as much as you can (SSDs have reserved areas which you can't get to).
* Don't rely on the TRIM/sanitize functions of the SSD to securely erase anything. These are programmed differently by each manufacturer and [http://www.techrepublic.com/article/erasing-ssds-security-is-an-issue/ are not reliable].

=Physical Destruction=

Once you've logically sanitized your drive, you may still want to physically destroy it for paranoia's sake.

An easy way to do this is to buy yourself a set of TORX screwdrivers ($5 - $10) and open the drive casing where you can get at the platters. Be careful when handling the platters, as they may break surprisingly easily and send shrapnel flying and cut your hands. Don't try to snap them in half without thick protective gloves and something to contain the shrapnel (you might want to wear protective gloves and goggles even if you don't intend to snap them).

More expensive/industrial solutions are detailed in a fun little 31c3 talk titled [https://www.youtube.com/watch?v=dl2vPB8Gla8 Hard Drive Punch - Destroying data as a performative act].

=Android=

Factory resets [http://www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf aren't good enough] to sanitize a device.

← Older revision		Revision as of 15:06, 7 March 2020
Line 1:		Line 1:
		+	[[File:Encryption.png\|thumb]]
	Encryption is the art of encoding messages in a way that only the intended, authorized person may read it. According to Edward Snowden, strong, tested cryptographic encryption systems were said to be one of the few remaining things that work (i.e. haven't been compromised by the NSA), and that people can still rely on.		Encryption is the art of encoding messages in a way that only the intended, authorized person may read it. According to Edward Snowden, strong, tested cryptographic encryption systems were said to be one of the few remaining things that work (i.e. haven't been compromised by the NSA), and that people can still rely on.

@@ Line 33: / Line 33: @@
 <strong>dm-crypt + LUKS</strong>
-dm-crypt + LUKS is the recommended encryption solution for GNU/Linux. It comes with the kernel. Since version 1.6, cryptsetup supports TrueCrypt containers natively, so there's no need to install TrueCrypt or tc-play.
+dm-crypt + LUKS is the recommended encryption solution for GNU/Linux. It usually comes with the kernel. Since version 1.6, cryptsetup supports TrueCrypt containers natively, so there's no need to install TrueCrypt or tc-play.
 Take note of the --iter-time parameter while creating a dm-crypt volume. This creates a time delay to guard against brute force attacks, which the FBI have [https://www.techdirt.com/articles/20160216/17393733617/no-judge-did-not-just-order-apple-to-break-encryption-san-bernardino-shooters-iphone-to-create-new-backdoor.shtml shown] [https://archive.is/uy14T archived] that they have [https://assets.documentcloud.org/documents/2714005/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf problems] attacking. [https://d2.maxfile.ro/xalhyummmc.pdf archived]

← Older revision		Revision as of 19:02, 10 August 2019
Line 186:		Line 186:
	[http://windows.microsoft.com/en-us/windows7/products/features/bitlocker Bitlocker] and [https://support.apple.com/en-us/HT204837 FileVault] links are here if you are absolutely fucking retarded and haven't read a single thing on this page. Cat photos only.		[http://windows.microsoft.com/en-us/windows7/products/features/bitlocker Bitlocker] and [https://support.apple.com/en-us/HT204837 FileVault] links are here if you are absolutely fucking retarded and haven't read a single thing on this page. Cat photos only.

−	Also check [https://wiki.~~tbpchan~~.cz/index.php?title=~~Fucko~~ Fucko] for other tips.	+	Also check [https://wiki.tbpindustries.com/index.php?title=Personal_Defense Fucko] for other tips.

@@ Line 79: / Line 79: @@
 As of 2016.03.21, The FBI thinks it can [http://arstechnica.com/tech-policy/2016/03/fbi-says-it-might-be-able-to-break-into-seized-iphone-wants-hearing-vacated/ break into the phone] with some [https://apple.slashdot.org/story/16/03/23/1853206/fbi-hires-cellebrite-to-crack-san-bernadino-iphone#comments Israeli forensics company]. This is a backstep from the real issue, which is about setting a precident of backdooring encryption.
-As of 2016.5.5, It has been released that the FBI paid [https://wiki.installgentoo.com/index.php/Tor/ Dark Net] hackers almost one million USD to hack into and unlock the phone. The FBI has been very vague about this, with some agents saying they bought a 0day to use, while some specifically say they paid hackers themselves to get into the iPhone. The 0day, which is specific to an iPhone 5C running iOS 9.2, has been patched already by a recent update, making it defunct to any phones with that update.
+As of 2016.5.5, It has been released that the FBI paid Dark Net Tor hackers almost one million USD to hack into and unlock the phone. The FBI has been very vague about this, with some agents saying they bought a 0day to use, while some specifically say they paid hackers themselves to get into the iPhone. The 0day, which is specific to an iPhone 5C running iOS 9.2, has been patched already by a recent update, making it defunct to any phones with that update.
 =Single file encryption=
@@ Line 89: / Line 89: @@
 Tomb, a script by Dyne, can be used to create PGP encrypted containers with ease. It can also hide keys in JPEGs using steghide, providing a layer of obfuscation. Tarballs can be obtained here, installation instructions if you don't know how to use make can be found here.
-* Creating a 10mb tomb named "installgentoo": $ sudo tomb dig -s 10 installgentoo.tomb
+* Creating a 10mb tomb named "tbp": $ sudo tomb dig -s 10 tbp.tomb
-* Creating a key for our new tomb: $ sudo tomb forge installgentoo.tomb.key
+* Creating a key for our new tomb: $ sudo tomb forge tbp.tomb.key
-* Locking our tomb with our newly created key: $ sudo tomb lock installgentoo.tomb -k installgentoo.tomb.key
+* Locking our tomb with our newly created key: $ sudo tomb lock tbp.tomb -k tbp.tomb.key
-* Opening our locked tomb with our new key (opens in /media/): $ sudo tomb open installgentoo.tomb -k installgentoo.tomb.key
+* Opening our locked tomb with our new key (opens in /media/): $ sudo tomb open tbp.tomb -k tbp.tomb.key
-* Hiding a key in a JPEG (original file is untouched): $ sudo tomb bury picture.jpg -k installgentoo.tomb.key
+* Hiding a key in a JPEG (original file is untouched): $ sudo tomb bury picture.jpg -k tbp.tomb.key
 <strong>GPG</strong>
@@ Line 129: / Line 129: @@
 HTTPS is dependant upon Certificate Authorities (CAs), such as Comodo and Verisign which cryptographically sign Certificates to confirm that the website you're connecting to is who it says it is, rather than some random hacker. Your operating system/browser has a number of certificates which it trusts, and those trusted certificates are compared against the website that you're accessing.
 If the website you're visiting gives an invalid certificate, your browser will complain.

← Older revision		Revision as of 23:47, 2 January 2019
Line 1:		Line 1:
−	Data destruction is the "art" and various methods to securely erase files on a Hard Drive. For data destruction, wiping the entire drive is preferable since most operating systems will leak details of your files (e.g. temporary copies of your document, mentions of it in most recently used lists, log files, registry entries, command history, etc.).

−	~~=Full Drive Wiping=~~
−
−	[http://www.dban.org/ DBAN] (Darik's Boot and Nuke) is the goto tool for drive wiping. Burn the iso to a cd or write it to a usb thumbdrive, boot from it and then it's just a matter of selecting which drives to wipe and how thoroughly you want them wiped. Using the [code]dodshort[/code] option is fine, and is recommended by DBAN themselves.
−
−	One pass is fine. Three if you're paranoid. The Gutmann 35 pass wiping is overkill. Gutmann himself has said that it's unneccesary on modern drives and even when he invented it in the 90s, many of the wipes were for different types of storage medium and the full 35 was overkill for any one device.
−
−	~~You could also boot a live linux distro and use one of the following commands to wipe a drive:~~
−
−	* # shred -vn 3 /dev/sdX
−	* # dd if=/dev/urandom of=/dev/sdX
−
−	~~=Individual File Wiping=~~
−
−	~~For individual files, the linux command "shred" can be used:~~
−
−	* $ shred -vun 3 file
−	* * -v for verbose
−	* * -u to remove the file after shredding it
−	* * -n to specify the number of passes
−	* * -z to add a final wipe of all 0s
−
−	~~=SSD Drives=~~
−
−	SSD drives (and flash memory cards/thumb drives) are trickier to securely erase since they perform wear leveling to preserve the life of their flash memory. This means your operating system can never be certain where data is stored on the drive. To mitigate against this:
−
−	* Encrypt from day one, so that your raw data will never be stored on the drive.
−	* Fill the drive to capacity with innocuous data, to overwrite as much as you can (SSDs have reserved areas which you can't get to).
−	* Don't rely on the TRIM/sanitize functions of the SSD to securely erase anything. These are programmed differently by each manufacturer and [http://www.techrepublic.com/article/erasing-ssds-security-is-an-issue/ are not reliable].
−
−	~~=Physical Destruction=~~
−
−	~~Once you've logically sanitized your drive, you may still want to physically destroy it for paranoia's sake.~~
−
−	An easy way to do this is to buy yourself a set of TORX screwdrivers ($5 - $10) and open the drive casing where you can get at the platters. Be careful when handling the platters, as they may break surprisingly easily and send shrapnel flying and cut your hands. Don't try to snap them in half without thick protective gloves and something to contain the shrapnel (you might want to wear protective gloves and goggles even if you don't intend to snap them).
−
−	~~More expensive/industrial solutions are detailed in a fun little 31c3 talk titled [https://www.youtube.com/watch?v=dl2vPB8Gla8 Hard Drive Punch - Destroying data as a performative act].~~
−
−	~~=Android=~~
−
−	~~Factory resets [http://www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf aren't good enough] to sanitize a device.~~