In an earlier posting I’d been looking at how to make computing a bit more secure. One approach was to use a virtual machine on existing hardware. This has two security exposures (that I know of).
1) A software key logger on the host O/S will still log your keystrokes.
2) Network monitoring will still see the network traffic.
To fix #2, one can use any of several anonymizing systems. I’ve been using TOR (The Onion Router) Browser and it seems to work fairly well. Couple that with the use of a network “dongle” that can be disposed (taking the MAC Address with it) and using a public access point (such as your local Starbucks or library) ought to give fairly secure, and relatively anonymous, network connections.
To fix #1, I’ve proposed a ‘disposable host OS’. Build the host environment on CD, DVD, or Flash drive. Now every boot is a clean, new, boot. Any “wares” that get shoved onto the box have a very limited lifetime. Any moment of worry is solved with a simple reboot.
To fix the unstated #3 of “A Tallbloke and the Constable Moment” where they steal your hardware, I’ve proposed a cheap Single Board Computer base platform that is essentially disposable anyway.
I’d done the download of VirtualBox and found it worked fairly well, if a bit slow on some things / some OS types.
I’d done the download of TrueCrypt and like it very much. At this point, I’ve had most of my working files living inside TrueCrypt volumes for many months. No problems (other than forgetting the password to one testing image that, thanks to paranoia on my part, had nothing of importance in it… So I don’t make a dozen images with a variety of passwords for ‘testing’ without keeping notes… For “production”, you want a password memory key, but not a written note near the computer…)
Putting a VirtualBox machine inside a TrueCrypt volume also was tested and worked fairly well (modulo the potential for slowness).
The two packages are quick to install, the instructions are pretty clear, and not all that complicated. They generally “work as advertized” and while it helps to be ‘technical’ it likely is not necessary.
Then I hit the “testing OS versions” wall.
I wanted to try several variations of Linux / Unix and see which ones gave a good, fast email and browsing experience. Only after that point would it be ‘worth it’ to do the work to integrate even more security inside that basic system image. (So, for example, one might want to have an encrypted volume from a USB drive mounted inside that image or have the TOR browser installed, or have it configured to have any swap on an encrypted partition, or… you get the idea.)
Installing Ubuntu took ‘way long’ (in part as it insists on doing a long “play with fonts from the internet” step… and when you are trying to build a reasonably provably secure image, doing a ‘download a bunch of stuff from the internet to the target location’ puts you at risk of a ‘man in the middle’ type attack where what you download is not what you expected…) So after a few hours doing “download and install” just to find out you want a different browser: it gets old.
Wouldn’t it be nice to be able to try a new / different OS in 10 or 20 minutes instead of 5 or 10 hours?
Well, I ran into an interesting web page that informed me someone else had that issue too.
If you have read my other articles such as the VirtualBox Beginners Tutorial, you would know that vboxVirtualBox is my favorite tool for desktop visualization. Aside from being cross platform and open source, it has opened up many creative solutions to problems that I could not tackle any other way. My only gripe getting started with VirtualBox is the time that it used to take to get a new operating system running.
Fortunately, the guys over at VirtualBoxes.org have created a set of pre-rolled Linux, OpenSolaris, FreeBSD, and BSD distributions that are (you guessed it) specifically designed to work with VirtualBox. By using VirtualBoxes.org, I am now able to spin up a new virtual machine in minutes.
So I immediately ran off to virtualboxs.org and checked them out. The download page for images is here:
As of this posting, the list of OS images is fairly large.
On their site each line is a link to the image:
GNU/Linux (GNU userland tools running on top of the Linux kernel)
CentOS (website): the installation is done from the DVD, with default parameters set
Damn Small Linux (website): the installation is done from the CD, with default parameters set.
Debian (website): the installation has been done from the netinstall ISO image for the x86 architecture.
DeLi Linux (website).
Dreamlinux (website): the installation has been done from the CD, with default parameters set.
Fluxbuntu (website): the installation is done from the CD, with default parameters set.
Gentoo (website): the installation is done from the ISO image, then customized .
gNewSense (website): the installation is done from the CD, with default parameters set.
Kubuntu (website): the installation is done from the CD, with default parameters set.
LinuxMint (website): the installation is done from the CD, with default parameter set.
Mandriva (website): the installation is done from the CD, with default parameters set.
Moblin 2 (website): the installation is done from the .img/.iso file provided by the project.
Puppy Linux (website).
Slackware (website): the installation has been done from the first CD, selecting the bare minimum disk sets.
Tiny Core Linux (website)
Ubuntu (website): the installation is done from the CD, with default parameters set.
Ubuntu Server (website): the installation is done from the CD.
Ubuntu Studio (website): the installation is done from the CD, with default parameters set
Xubuntu (website): the installation is done from the CD, with default parameters set.
VectorLinux (website):the installation is done from the CD, with default parameters set.
Zenwalk (website): the installation is done from the Standard Edition CD, with default parameters set.
GNU/OpenSolaris (GNU userland tools running on top of the OpenSolaris kernel)
Nexenta (website): the installation is done from the CD.
MILAX (website): the installation has been done from the official ISO image.
GNU/FreeBSD (GNU userland tools running on top of the FreeBSD kernel)
Debian GNU/kFreeBSD (website): the installation has been done from the daily mini.iso.
FreeBSD (website):the installation is done from the bootonly iso
AROS (website): the installation has been done from the nightly build ISO image.
FreeDOS (website): the installation has been done from the official ISO image.
Haiku (website): the image has been done from the nightly build HDD raw image.
MINIX (website): the installation has been done from the official ISO image (MINIX 3).
ReactOS (website): the installation has been done from the official ISO image.
SYLLABLE (website): the installation has been done from the official ISO image.
Android-x86 (website): the installation has been done from the daily ISO image.
Plan 9 (website): the installation has been done from the ISO image.
On the one hand, I’m thrilled that I can just do a “grab and go” on several images for much more rapid performance testing.
On the other hand, my list of “targets” is now about 5 times as large ;-)
I don’t know if net that is a time savings or not. But the end result will likely be much better.
Once I’ve figured out “what I like”, then I can get on with the job of building the basic system “from scratch” on a secure machine (download sources, preen them, build on a box built from a CD set…) and customizing the OS (hardening some parts, installing TOR and / or similar, making a mounted Truecrypt volume be a default option, etc.) That, then, gives the “inner software” layer.
Yes, a lot of work.
But the end point ought to be a reasonably good performing and very secure environment for doing day to day things like email, browsing, and even financial transactions. As each boot is ‘new’, the OS can not be infected with a virus that then compromises your login / password. Using an encrypted https type page ought to be strong enough for everything except a TLA Three Letter Agency attack on you. (The TLA can just have the ‘institution’ hand over the transaction at their end…)
Putting that OS on a CD / DVD / locked Flash Drive lets it stay secure from change. Booting it into a Virtual Machine that lives inside an encrypted ‘container’ file system keeps forensics out of the bits of dross the OS leaves laying about. Putting your “stuff” on an encrypted USB drive lets you have persistent state and information, but it only becomes ‘available’ after decryption (after the OS is up and running).
But none of those steps can happen until I’ve settled on an OS that is “fast enough and good enough”… which is where I’d stopped.
Yes, I’d tested a few, but the process was very slow as each one could required a few installs to ‘get it right’. Using virtualboxs.org gets me past that “issue” ( I think…)
FWIW, I’d been thinking I needed to write up a rough “how to get VirtualBox and install inside Truecrypt”, but found that the same site has already done a pretty good job of it. Not fully ‘hand holding’ but gives the basic order of attack on the process:
So anyone wanting to join in can just “do what they describe” (which is roughly what I did too) and then try out some of the various pre-made system images and report back on what worked well and which were just painful to use or molasses slow.
The Other Path
It is worth mentioning that I’m not seeing a virtual machine inside TrueCrypt as a replacement for the “SBC with OS on Flash” disposable system. The two are related and interoperating. So on the one hand just having a basic Linux on an SBC booted from flash lets you have a ‘secure enough’ platform for things like general random browsing. The whole thing can fit into a “dongle” that just needs a USB / wireless keyboard / mouse and a video display plugged in. Doorbell rings, you hit “reboot” and go answer it. History is gone. RAM is re-written. Viruses that try to creep in get scrubbed on reboot too.
While that doesn’t prevent things like network monitoring and doesn’t have an encrypted file container for your ‘persistent’ stuff; it does work fast and is nice for casual things.
Having a VirtualBox with an entirely encapsulated OS (but without a lot of tweaks) inside a TrueCrypt volume will not prevent TLAs from putting keyloggers into your system nor protect you from all attacks, but is “nice” for things like keeping your private stuff private on an offline system. So an “R&D” box that doesn’t connect to the internet (so no keylogger things matter) is always left in a secure state just by shutting down the virtual machine / dismounting the encrypted volume.
Those two steps, and nothing else, give a nice mix of ‘private browsing’ with a virus free / reasonably secure internet presence along with a very secure and very private “work room” environment.
Those are the two bits I’m building first.
Then comes the long harder slog of making a fully “rolled together” SBC with full encryption and OS from Flash, that also has all the mounted encrypted removable personal volumes and anonymous browsing software pre-installed. That step will ‘take a while’ and depends on playing with / selecting from, many of those OS types listed above, then trying them on selected hardware.
So that’s where I am at the moment. VirtualBox and Truecrypt installed and working well. OS testing in progress. General “layout” of the approach defined. Steps to completion roughed out.
I’ve not made a formal ‘project’ of this, but did do a few different searches for TrueCrypt enabled Linux releases or other evidence that someone had already “gone there”. Didn’t find much. (It looks like TrueCrypt is not under a completely PC enough free enough license for the Linux distros to bundle it). So while I kept thinking “Someone ought to be doing that”, it is looking like “I am someone”… As I’m already up to my eyeballs in ‘projects’ (some falling behind already) I’m not thrilled at the idea of adding another one. Yet I think there is a real need for such a “demonstrably secure” bundle. So maybe I ought to make it a formal project, try to build a developer community, make and distribute a formal ‘disto’ of it. We’ll see.