Umbra's Great Paranoid Guide (Update in progress)

[Deleted member 178]

hi folks,

i saw lately many people have concerns about being infected and also about their "privacy" (if we dare say there is privacy on the net)

so i will start here a simple "guide" for paranoid-oriented people, this guide is just about collected facts & sources, i came across; not an hacker's anonymity guide

 

[Deleted member 178]

The Computer & Operating System

well, having lot of security is useless if someone has direct access to your machine...

first things first :

Spoiler: BIOS Password

BIOS Password

Your computer’s BIOS or UEFI offers the ability to set passwords. These passwords allow you to restrict anybody from booting the computer, booting from removable devices, and changing BIOS or UEFI settings without your permission.
Of course there is a way to bypass it, but it is tedious and not discreet to do.

Spoiler: Linux

Linux

of course, Linux is safer than Windows from my expreience, but not everybody want/could use it. This guide is more oriented for Windows users so i will avoid Linux topics.
for Linux, check this pretty awesome guide : The paranoid #! Security Guide / Tips, Tricks & Scripts / CrunchBang Linux Forums

Spoiler: Anonymiy & Privacy based OS

Anonymity OSes

some portable operating system exist such as Tails:

Tails is a live operating system, that you can start on almost any computer from a DVD, USB stick, or SD card. It aims at preserving your privacy and anonymity, and helps you to:

• use the Internet anonymously and circumvent censorship;
  all connections to the Internet are forced to go through the Tor network;
• leave no trace on the computer you are using unless you ask it explicitly;
• use state-of-the-art cryptographic tools to encrypt your files, emails and instant messaging.

Tails - Privacy for anyone anywhere

or

Privatix

Privatix Live system is a take-off of CD, USB stick or an external hard drive and easy to use Debian GNU / Linux - operating system for secure, mobile and privacy and confidentiality maintaining internet and communicating or editing and encrypting

Spoiler: Windows telemetry

Windows Telemetry

Since Win10 was released , many people worried about the datas collected by Microsoft. They even try to do it on previous Windows versions.
You have many setting to turn off and even you do it it is not enough.
So i found those tools that changes the registry keys to disable the telemetry modules with few clicks:
- Spybot Anti-Beacon for Windows
- O&O ShutUp10: download free antispy tool for Windows 10

Spoiler: Software/Hardware Drive Encryption

Drive protection

now that the Bios is protected, it is the tun of your HDD/SSD, for this we have what we call FDE (Full Disk Encryption) platforms, software and hardware.

What is a FDE
What FDE do and don't
Software vs Hardware
Software or Hardware , which is the best?

Software-based

1- Bitlocker (for pro/enterprise version)

Windows BitLocker Drive Encryption is a new security feature that provides better data protection for your computer, by encrypting all data stored on the Windows operating system volume. (In this version of Windows, a volume consists of one or more partitions on one or more hard disks. BitLocker works with simple volumes, where one volume is one partition. A volume usually has a drive letter assigned, such as "C.")

BitLocker Drive Encryption Overview
Windows BitLocker Drive Encryption Step-by-Step Guide

2- Veracrypt ( Truecrypt & variants)

if you don't have access to Bitlocker, you can do the same with Truecrypt and its variants, i will show you Veracrypt, a updated and supposely safest variant of Truecrypt.

VeraCrypt can on-the-fly encrypt a system partition or entire system drive, i.e. a partition or drive where Windows is installed and from which it boots.
System encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), hibernation files, swap files, etc., are always permanently encrypted (even when power supply is suddenly interrupted). Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and registry entries are always permanently encrypted too.

VeraCrypt - Documentation

3- Symantec Encryption (previoudly PGP)

Of course big security vendors possess their own tools, symantec bought the well known PGP.

What is Symantec Encryption?
Symantec’s encryption portfolio includes endpoint, file and folder and email encryption. Integration with Symantec Data Loss Prevention automatically encrypts sensitive data being moved onto removable media devices or residing in emails and files. Robust management features include individual and group key management, automated policy controls, and out-of-the-box, compliance-based reporting. Heterogeneous management capabilities include support for native OS encryption (FileVault2) and Opal compliant self-encrypting drives.

PGP Encryption Software | Symantec

Note that PGP has a free variant called GPG4win

4- others

there is a link to plenty of software-based drive encryptions

Comparison of disk encryption software - Wikipedia, the free encyclopedia



Hardware-based

Easier and faster to use than Software encryption, Hardware Encyption (called SDE for Self Encrypted Drives) is an option to consider. USB or Padlocks exist.

hardware FDE (SDE)
SDE Explanation

Obviously attacks & risks are still present

Risks & Attacks

below are some companies offering such devices

Apricorn
Software vs Hardware Encryption

Seagate

 

[Deleted member 178]

The Security Softs

the biggest of all, and why we all are in this forum, to LEARN how to secure our machines from malwares.

luckily i did a some guides to "teach" you about protection.

Here my guides:

Umbra's Concept of Layered Config
How to protect your USB from getting infected

 

[Deleted member 178]

The Browsers & Addons & Networking

Browser are crucial parts and have to be as secured as possible.

Spoiler: Secured browsers

1- Secured Browsers

Some secured and anonymity friendly browsers exists since ages:

Some just disable telemetry services or add some features to ensure privacy , the well-known Comodo Dragon browser is one of them.

- JonDoFox
- List of secured browsers

but some others are heavily focused on anonymity such as the (in)famous Tor Browser , used by either criminals, secret agencies and security geeks: Tor Browser

Bitbox (Browser in the Box) is a VirtualBox-ed, hardened Linux Debian and SELinux and Firefox/Chrome that is encapsulated in a virtual machine: BitBox

we have also some sandboxed browsers such as Quarri myPOQ offered by Quarri: Quarri

Spoiler: Addons & Extensions for Browsers

Addons/ extensions for Browsers

the list will be long...i will mentonned those i came across. Remember that more addons you are using, more resources hogggings, incompatibilities and slowdowns you will face.

- Adguard (adblocker, addons or software)
- Lastpass (local/cloud password manager)
- HTTPS Everywhere (Forde HTTPS protocol on unsecured sites or block them)
- Ghostery (anti-trackers)
- Noscript (script blocker)
- Disconnect for Firefox (Anti-trackers)
- Bluhell Firewall for Firefox (adblocker)
- ublock/ublock origin (adblocker)
-

(list will be updated)

Spoiler: DNS

Domain Name Servers (DNS)

Domain Name Servers (DNS) are the Internet's equivalent of a phone book. They maintain a directory of domain names and translate them to Internet Protocol (IP) addresses. This is necessary because, although domain names are easy for people to remember, computers or machines, access websites based on IP addresses.

1- Secured DNS

Since DNS are equivalent of a phonebook, you want your "phonebook" indicates only safe sites and not the infected/malicious ones. Several services provides such features:

6 known DNS services ( i like Norton DNS personally)

2- Encrypted DNS

Secure a DNS is one thing , but what if the datas travelling from/to your computer are subject to spying (aka MITM , Man in The Middle)? you wouldn't want that , so here comes DNScrypt from OpenDNS.

DNScrypt
Simple DNScrypt : an easy to use GUI for DNScrypt, im using it.

Spoiler: Virtual Private Networks

3- Virtual private Networks (VPN)

A virtual private network (VPN) extends a private network across a public network, such as the Internet. It enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network, and thus are benefiting from the functionality, security and management policies of the private network.[1] A VPN is created by establishing a virtual point-to-point connection through the use of dedicated connections, virtual tunneling protocols, or traffic encryption.

basically a VPN reroute your datas via secured proxies/servers.

- Cyberghost VPN (Paid)
- Security Kiss
- Hotspot Shield (some says that the CIA owns it)
- JonDo
- PacketiX (proprietary platform from Japan)
- OpenVPN (free Open Source VPN; my favorite and the one i actually using)
- SoftEther (OpenVPN fork, im using it)
- some others

 

[Deleted member 178]

Other Tools

Spoiler: Black Phone

Secured smartphone

Wanna feels like James Bond or Raymond Reddington? use this :

Black Phone

Spoiler: Email & Messaging

Messaging & Email

Want private messaging and email providers?

Off-The-Records (Messaging)
Proton Mail (encrypted emails, famous to be the target of (governement?)"hackers" because its efficiency)

Spoiler: System Cleaner

System Cleaner

better erase sensitive datas than not

- Bleachbit

 

[Deleted member 178]

updated

 

[Anupam]

Hi Umbra,

Seems like 360 is marking SpyBot as High Risk Trojan. Is it safe to use or it's just another FP from 360?

 

[Vasudev]

Hi Umbra,

View attachment 77083

Seems like 360 is marking SpyBot as High Risk Trojan. Is it safe to use or it's just another FP from 360?

Submit the sample to virustotal and check results.

 

[LabZero]

Hi Umbra,

View attachment 77083

Seems like 360 is marking SpyBot as High Risk Trojan. Is it safe to use or it's just another FP from 360?

It's a FP, see also my review about this:

Written Review - Spybot Anti-Beacon 1.5.0.35

 

[pneuma1985]

I love the guide the only issues I have is software compatibility in most cases not working with one another and or slowing down my WS. I tried the cis and hmp3 and adguard you posted wasn't very happy with the results. I've tried alot of the bundle software which I'd prefer not to use if I'm going to layer the system properly. I spent a while on win 10 now im back to win7 with a ton of guest os's. I primarily want a hips system with total control of everything a sandbox and a good av now making them all work together is not so easy... I so wish there was a program like littlesnitch for windows. Glasswire comes to mind but requires windows firewall. I'd like to know certain configs that mods are using now? And another question I had was what if we work in a JRE? I develop for androids so was jw about that I need a good anti exploit for a jre environment.

 

[Deleted member 178]

added OpenVPN to VPN section (forgot to add it, it is the one im using, after i ditched Cyberghost)

 

[Deleted member 178]

I love the guide the only issues I have is software compatibility in most cases not working with one another and or slowing down my WS. I tried the cis and hmp3 and adguard you posted wasn't very happy with the results.

of you read some of my guides, you surely know by now that doing combos requires tweakings in every software included; in your case you are using CIS as backbone and this requires LOT of tweaks (even to make it run alone properly on your system, so i dont even talk about adding other softs in the mix)

I spent a while on win 10 now im back to win7 with a ton of guest os's. I primarily want a hips system with total control of everything a sandbox and a good av now making them all work together is not so easy...

CIS is what you need then, but you must read a lot about it; and here is the best place for that (even better than Comodo forum ^^)

Guide on how to install and configure Comodo Firewall
Question - Comodo Internet Security v8 Setup/configuration thread
Comodo Internet Security v8 Setup/configuration thread (Setting Only)

1st link is to have the minimum required setting for decent protection with CIS
second is when you master the 1st link then want to know what may happen if you want go deeper.
third is when second link is totally understood, with the setting very experienced Comodo's users and me used to setup CIS/CFW

I so wish there was a program like littlesnitch for windows. Glasswire comes to mind but requires windows firewall. I'd like to know certain configs that mods are using now?

Littlesnitch is good, similar soft exist but are mostly paid. you can see my config here :

Umbra Total Security 2015 (Main Laptop)

And another question I had was what if we work in a JRE? I develop for androids so was jw about that I need a good anti exploit for a jre environment.

Honestly if you work , you should have a computer exclusively for that, never do serious works on your "leisure" computer.
if you cannot afford another computer HitmanProAlert is the best anti-exploit i came across.

 

[pneuma1985]

Well I work on my workstation but I could make my laptop my java specific WS I'd need to upgrade the ram in it though... Hmm Yeah I'm running your old config. I may just use acronis and go back to a clean slate and start testing and see what I can come up with...Also I've read the first two links already very carefully. And gone through each post. Spent all morning doing it lol... I am learning CIS but I have run across an issue. Im running HMPAlert3 and CIS when i first opened mozilla it said the signature was invalid and the connection was insecure. Didn't know if that was due to the settings or what. I tested it on several sites using chrome they say its fine.. No Idea why firefox comes up with that. This on a clean install mind you. I keep doing image backups of different configs and my main just being a clean windows install.

 

[Hangtooth]

added OpenVPN to VPN section (forgot to add it, it is the one im using, after i ditched Cyberghost)

Are you on the free OpenVPN plan or did you break down and add a pay service? Just looking at their rates they charge by traffic total and you buy it in blocks? Neat idea. Just curious here, I am still eyeballing Airvpn.org if I ever need a pay service. They seem to take privacy extremely seriously. No free service though =(

 

[Deleted member 178]

I am learning CIS but I have run across an issue. Im running HMPAlert3 and CIS when i first opened mozilla it said the signature was invalid and the connection was insecure. Didn't know if that was due to the settings or what. I tested it on several sites using chrome they say its fine.. No Idea why firefox comes up with that. This on a clean install mind you. I keep doing image backups of different configs and my main just being a clean windows install.

the issue is not from CIS or HMPA , it comes from Adguard, you have to renew the certificate (in adguard GUI) or import it in FF

Are you on the free OpenVPN plan or did you break down and add a pay service? Just looking at their rates they charge by traffic total and you buy it in blocks? Neat idea. Just curious here, I am still eyeballing Airvpn.org if I ever need a pay service. They seem to take privacy extremely seriously. No free service though =(

using OpenVPN and added VPNgate as provider. free and deadly fast as having no VPN

 

[pneuma1985]

How do i do that I dont see anything in the adguard GUI to renew the certificate? And where do I look for it to import into FF? First time I've used adguard aside from their beta version.

 

[Deleted member 178]

How do i do that I dont see anything in the adguard GUI to renew the certificate? And where do I look for it to import into FF? First time I've used adguard aside from their beta version.

 

[Hangtooth]

using OpenVPN and added VPNgate as provider. free and deadly fast as having no VPN

Thank you! I couldn't figure out who to use as a provider!

 

[pneuma1985]

Thankyou sir you are a scholar wasnt using the rc version was on an older version

 

[Hangtooth]

Scratch this question =)