The #OpNewblood Super Secret Security Handbook

If you have not completed the IRC chat client
setup for your operating system, we recommend
you go back and get started there.

Preface

NOTE: If at any time you need help with any topic found in this guide, feel free to join us at https://webchat.anonops.com and you'll be able to find someone to help you figure it out. It should be noted that this guide contains information that may be difficult to understand without an extensive technical and functional knowledge of information systems. While this guide does attempt to put it simply and in laymans terms, you the user are ultimately responsible for the security of your own systems.

Setting up Tor

Due to abuse in the past TOR exit nodes are not able to connect to the AnonOps IRC servers. You can however connect to our hidden service. More information on this is found on the tutorials page for your client. https://anonops.com/tutorials.html

Windows

  1. Download Tor here: https://www.torproject.org/
  2. Run the .exe
  3. Extract to the default folder. You should have a folder on the desktop called Tor Browser. In this folder is Start Tor Browser.exe. If you want you can right-click to create a shortcut and drag it to your desktop, making sure the original stays in the same folder.
  4. Click https://check.torproject.org/ to verify TOR is working. If your ISP blocks connections to TOR or you need further help feel free to ask about it in the #OpNewblood channel, which again you can access through your web browser at this link: http://webchat.anonops.com

Linux

  1. Download Tor here: https://www.torproject.org/
  2. Extract to destination of your choice. Default location is fine.
  3. You should now be able to just click Start Tor Browser to start.

Mac OSX

  1. Download Tor here https://www.torproject.org/
  2. Unzip the file and move TorBrowserBundle_en-US.app to your Applications folder. (_en-US is the language suffix)
  3. Double click the TorBrowserBundle_en-US.app
  4. If you are having problems go to https://www.torproject.org/docs/tor-doc-osx.html.en for further info.
  5. Once again for help with making a bridge if your ISP blocks Tor please ask in the #OpNewblood channel via your web browser here: https://webchat.anonops.com

A NOTE FOR ALL Operating Systems

There have been some changes in the structure of the Tor bundle and if you need to set up relays or other special options there are specific instructions at https://www.torproject.org/download/download.html.en.

Once again for help with making a bridge if your ISP blocks Tor please ask for help in #OpNewblood via your web browser here: https://webchat.anonops.com

To check anytime if TOR is working, you can go here: https://check.torproject.org/ to verify your TOR is working.

Troubleshooting: refer to www.torproject.org

Firefox Addons

Adblock Plus: This plugin blocks around 90% of internet services that attempt to track your web activity and then send you targeted ads. It's recommended to use this addon while browsing any websites. Information loaded from these ad servers leaks information about you thru your browser. This is a bad thing. Note that newer versions of this addon also blocks most social media images such as facebook 'like' buttons. Configure the addon to suit your needs. https://addons.mozilla.org
NoScript: A very useful plugin that will disable javascript on sites to protect your privacy and stop malicious activity. Rules can be set for individual sites or deny globally. http://noscript.net/
RequestPolicy: Be in control of which cross-site requests are allowed. Improve the privacy of your browsing by not letting other sites know your browsing habits. Secure yourself from Cross-Site Request Forgery (CSRF) and other attacks. Works alongside NoScript. https://addons.mozilla.org/en-US/firefox/addon/requestpolicy/
BetterPrivacy: This plugin is a tool to identify and remove cookies. It will also act as an "optout" from advertisement and other forms of web tracking. https://addons.mozilla.org
FoxyProxy: An Addon to the default way to handle connecting to proxies, the FoxyProxy addon will allow you to have easier access to enabling your proxy tunnels, also has advanced features, such as setting up a list of domains that you will always want to use a proxy to connect to, and to do so automatically, while still using another connection for non-listed sites. https://addons.mozilla.org
Ghostery: Another tool to help manage and mitigate tracking cookies, Ghostery features tools that will alert you when there are tracking cookies on the websites you visit. You can also view information about each tracker that is trying to harvest your browsing data, and even view the source code of said tracker and see exactly how the cookie is tracking you. Make sure you get Fanboy list and Easy list to stay updated (these can be selected during setup or in the options of the addon itself ) https://addons.mozilla.org
Greasemonkey: A great addon that allows you to edit the way websites show information to you, using bits of javascript code. This is more of an addon "engine" or development platform, allowing you to write and download scripts to do many different things using their addon. https://addons.mozilla.org
HTTPS Everywhere: A Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. Its purpose is to force a https connection to every website. https://www.eff.org/https-everywhere
Secret Agent: Continuously randomizes your Firefox/SeaMonkey HTTP User Agent, to suppress device fingerprinting and resist web tracking. Protip: use the Escape key to close the preferences window. https://www.dephormation.org.uk/?page=81

Advanced Defense Techniques

Using Virtual Machines

It is strongly recommended that you consider making a Virtual Machine (VM) to separate your personal OS instance with your anon activity OS instance. This ensures that personal data does not leak while viewing anon-related social media on such sites as Twitter or Facebook. It has several other advantages such as allowing you to quickly delete all anon activity off your computer by simply deleting the VM itself.

Virtual Machine Software

VirtualBox - x86 and x64
VMWare Workstation 7 - x86 and x64
Windows Virtual PC - x86
Parallels Desktop - x86 and x64

Disk encryption

Disk encryption is another way to protect yourself. Disk encryption software will make it pretty much impossible for any one but yourself to access the data on any physical disk.

Disk Encryption Software

TrueCrypt - http://www.truecrypt.org/
Bitlocker - (Win 7 Ultimate only)

File and Email encryption and validation

(added by cred)

More on this subject is also found here at this securemail link.

Using the openPGP standard, the following software creates a "keyring" for you, bound to your name and email address (neither of which needs to be real, I have two, one for my real life identity and another as cred) The private key is a password-protected key you keep on any system on which you will be DECRYPTING information; your home computer and, if you're brave, your Android phone. The public key is used to ENCRYPT information or files and is available to anyone. If you wanted to encrypt information to send to me, you'd have to search for my public key, (cred(@)mail.i2p will find it for you) encrypt the data with it, and send it to me. The only way to recover that data is with my private key and password. PGP is the industry standard for high level encrypted email. GPG is the open source version of PGP, which is now a commercial product.


GPG (Windows) http://gpg4win.org/download.html
GPG (Mac) https://gpgtools.org/
GPG (Linux) http://www.gnupg.org/
APG (Android) https://market.android.com/details?id=org.thialfihar.android.apg

Email Encryption Basics

Linux TOR VM

It's possible to use Tor as a VPN using some prepackaged linux VMs. Once these VMs are started it's possible to create a VPN connection to the Tor VM. These VMs include additional privacy goodies such as Squid and Privoxy.

Linux Tor Software

WHONIX - https://www.whonix.org/wiki/Main_Page - Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network, Debian GNU/Linux and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP.

TAILS - https://tails.boum.org/

JanusVM - http://janusvm.com/ (not actively maintained, documentation minimal)

guyfawkesmask

Portable Solutions

Portable refers to self-contained OS and software packages that can be run from CD, DVD or USB device. This allows you to carry your anon OS instance in your pocket, plug it into or insert into another computer and be ready to access anon resources in a secure way.

The Amnesic Incognito Live System (TAILS): https://tails.boum.org/download/index.en.html

A bootable, live, Linux distribution focusing on security and privacy. Basically this entire document in a single download.

Kali: http://www.kali.org/

The successor to backtrack. A sort of Swiss army knife for pentesting.

Ubuntu Privacy Remix: https://www.privacy-cd.org/

Intended solely for Live booting. No installation on the local system is required and none of the data on it is touched.

Advanced Guide

by Denizen

Preface:

Information in this section can be extremely confusing for new users and those without the necessary technical knowledge. Always be cautious when tinkering with systems you don't fully understand as this may lead to undesirable results, detection, or in extreme cases, system failure or legal trouble. Guide By: Denizen
As the ultimate denizen, you must be able to enter systems at will in various ways. There are many ways to reach a website, and to add protection for yourself in terms of anonimity and minimized vulnerability.

Table of Contents

Using PuTTY

http://oldsite.precedence.co.uk/nc/putty.html
Normal connections to the internet, unless using SSL, are cleartext unencrypted transmissions divided into data packets. Using a packetsniffer, it is possible to capture most packets, and look at their payload in plain text. This can include usernames, emails, IM's, and sometimes even passwords and sensitive information. When you set up a tunnel securely, you are connecting to a secure, encrypted connection to the machine you are connecting to, helping to prevent the use of packetsniffers to steal your information. Not only is this useful for keeping your local connection to the internet secure, it is also one of the basic ways you can hide which IP address you are connecting to the internet from at home. When using the tunnel for your transmissions, all of your packets will have that machine's IP address on the source address section instead of your own. Again, as covered above, you cannot trust a VPN (SSH) provided at no cost. It is in your best interests to use a paid hosting provider.

OpenVPN GNU/Linux

Information on how to set up a GNU/Linux system to use openVPN can be found here: http://openvpn.net/howto.html (openvpn only secures you between your server and you, not between your server and the internet. your server will be the middle man and is identifieable unless augmented with additional obfuscation techniques)

Using SOCKS4/5 Proxys

If you're interested in using SOCKS 4/5 proxies with the Firefox browser, you can find instructions here: http://uniqueinternetservices.com/configure-proxy-for-firefox.html

Configuring DNS

This section explains how to change the nameserver that resolves domain names into IP adresses that is sometimes used as an ideal way to trace you by your ISP, even if the data you used is encrypted via RSA or a strong triple des encryption the request to the domain name to an ip still is carried out by someone, make sure it's you, or someone friendly. DNS requests in an ideal situation should be encrypted, if you're super paranoid, and some proxies offer this. I can't list which ones off the top of my head, sorry.http://dnscurve.org/in-benefits.html ?

Changing Windows Hostnames

This hacker's trick is a good way to associate a permanent IP mirror for your favourite social networking site like facebook, twitter, etc etc. If this is something you're interested in, more information can be found here: http://www.ehow.com/how_5225562_edit-windows-hosts-file.html
If you want cannabis.com to goto 4.2.2.1 then you can enter it just like the localhost 127.0.0.1 entry you'll find in your windows setup. This bypasses nameserver requests to most browsers (check to be sure with a packet sniffer)

Packet Capturing

All of these need PCap drivers installed and are included in the downloads of each...
Understanding packets takes time and practice. To get started install a copy of wireshark (http://www.wireshark.org/) or MS Network Monitor 3.4, both are free. If you don't see any capture interfaces listed then you may need to run it as administrator. To identify which interface is seeing your traffic click the first (top-left) icon "list available interfaces" and look for the one with the numbers counting up; it's the active one. Start it and watch all the packets flow. You might see lots of traffic, start closing shit that's downloading or streaming stuff. You'll get down to a slower scroll of ARP and NetBios traffic, the occasional UPNP burst and other stuff. If you're on a secure VPN or something you'll see just about ALL SSL/TLS grey colored packets or all UDP blue packets in some cases. Try another active interface (like a TAP interface) to see the goods. Get on your home network and play around; see what DHCP handshakes look like, DNS requests/responses, navigate a shared folder and see what it shows you, stuff like that. If you know how, do an nmap scan and see how obvious and loud it is and learn techniques to use it in a more covert manner.http://www.wireshark.org/docs/ <- read and watch the videos. There's a lot to it but once you catch on it's quite simple to grasp.TCPDump(linux)/WinDump(windows) - Command line packet capture for gathering to analyze later. http://www.tcpdump.org/ and http://www.winpcap.org/windump/NetworkMiner (http://networkminer.sourceforge.net/) is an alternative that allows you to sort collected packets however you want (by host for example) for easy digging around.7. TCP/IP AND THE WIDER INTERNET
(DNS/HTTP Port 80/Logging/Secure ways to connect to your 'crack' machine).. PROXY CHAINING, SSH CLI Chaining maybe? http://www.mediacollege.com/computer/network/dns.htmlNetwork Layers & OSI ModelIn order for a security expert to truly understand a software or hardwares running on a network or security system, they must be able to relate to and fully conceive the implications of changes that are made to an existing setup.No matter what you do at any level of the network layer, you will be interacting at other levels also. E.g. The data link layer (Layer 2 OSI) must make use of the physical layer (Layer 1 OSI), and so on.Layer 1 : Physical layerThis is the electrical and physical specification of the devices. In particular it will refer to pins, voltages, repeaters, hubs, network adapters, host bus adapters and SANs (Storage Area NEtworks). Standards such as the RS-232C Com port standard popularised in the 90's uses such physical wires to access medium.One such popular medium would be the internet. To which the early modems connected.Layer 2 : Data Link LayerThe Data Link Layer provides functional and procedural means to transfer data between network entities using physical layers (or cabling/adapters/routers/repeaters) so on and so forth. Originally Layer 2 was intended for point 2 point transfer only. LAN and multi-broadcast media (multicast et al) were developed independant of the ISO standard (IEEE 802).WAN and LAN are services on the data link layer that arrange bits, from physical layer into logical fram sequences. These frames contain important information that is relative to your Transmission Control Protocol, and includes information such as your IP (Internet Protocol) address.This address is binded through service levels by the TCP (Transmission Control Protocol) transport layer.8. Hack in a sack:The Metasploit Framework
Metasploit is a software suite created for penetration testing, and is included in both Backtrack and Gnacktrack LiveCDs listed in the mobile solutions section. It has a command line interface, a GUI interface, and a Web interface, creating what is, in a real way, the world's first point-and-click hacking software. It has a massive, constantly updated Database of usable exploits, which you can use to gain access to vulnerable remote systems. http://www.metasploit.com/

Sign off

Thanks for reading this whole doc, you did right? Please ask questions in #OpNewblood (Again, you can reach us via your web browser at https://webchat.anonops.com) and refer back to this document and remember to stay safe. Protecting your anonmity is the most important part of being Anonymous.
In our world a good defense is the best offense.