Traffic monitoring and better control

[zrtqee]

Will help solve or at least reduce the risk of issues discussed in:

walled garden, firewall whitelisting, application whitelisting, sudo lockdown, superuser mode, protected mode

Using Empire, I generated a bash launcher and saved it on the target (Whonix workstation 13). Added +x and ran it. This launcher runs a base64 encoded python script. The steps above require some convincing aka social engineering (or just being naive about security of this or that system). The rest doesn’t. Seconds after the script silently runs (and deletes itself) I have a shell into Whonix Workstation. I use a ruby keylogger module, and hey, I’m lucky today, the user runs sudo apt-get updat…

Simple clearnet connection proof of concept for Tails

Unlike in Whonix, it’s very easy to start a clearnet connection in Tails - one can use the "Unsafe browser’ (included for the purpose of connecting to captive networks). https://tails.boum.org/contribute/design/Unsafe_Browser/ This browser comes with many warnings though to prevent the user from gaining a false sense of safely. The browser runs with the clearnet user. Code for that is at the above link. I am looking for a simple proof of concept though, demonstrating that a simple bash scrip…

TransPort = privacy issue

Why does whonix Gateway allows TransPort by default? For convenience? It is security and privacy issue. If you use botnet OS like Windows for Whonix-Workstation, it can communicate with NSA or Microsoft easily, since all traffic will just be sent through Tor by TransPort. However, TransPort allows to use socks proxies in TBB, so not sure if to disable it.