fixed issues and improved security
This commit is contained in:
n0mad1k
@@ -2,31 +2,38 @@
|
||||
|
||||
## Introduction
|
||||
|
||||
The **Covert SD Card Tool** is a Python script designed to automate the process of setting up a bootable USB drive with either Kali Linux or Tails OS. It includes options to create encrypted persistence partitions, encrypted documents partitions, and an unencrypted partition containing helpful scripts and instructions. This tool simplifies the complex steps involved in preparing a secure, portable operating system on a USB drive.
|
||||
The **Covert SD Card Tool** is a Python script designed to automate the process of setting up a bootable USB/SD card with either Kali Linux or Tails OS. It includes options to create encrypted persistence partitions, secure document storage, and user-friendly access scripts. This tool simplifies the complex steps involved in preparing a secure, portable operating system on a USB drive or SD card.
|
||||
|
||||
## Features
|
||||
|
||||
- **Install Kali Linux or Tails OS** on a USB drive.
|
||||
- **Create an encrypted persistence partition** for Kali Linux.
|
||||
- **Create an encrypted documents partition** using VeraCrypt.
|
||||
- **Add an unencrypted partition** containing automount scripts and instructions.
|
||||
- **Customizable encryption options** with a fast setup mode.
|
||||
- **Automated dependency checking and installation**.
|
||||
- **Install Kali Linux or Tails OS** on a USB/SD card
|
||||
- **Create an encrypted persistence partition** for Kali Linux (LUKS encryption)
|
||||
- **Create a maximum-security encrypted documents partition** with triple-cascade encryption
|
||||
- **Secure drive wiping** using multi-pass shred for data sanitization
|
||||
- **User-friendly access scripts** for mounting and locking secure storage
|
||||
- **OPSEC-focused design** - generated scripts use generic terminology
|
||||
- **Automated dependency checking and installation**
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- **Operating System:** Linux (Debian-based distributions recommended).
|
||||
- **Python Version:** Python 3.x.
|
||||
- **Operating System:** Linux (Debian-based distributions recommended)
|
||||
- **Python Version:** Python 3.x
|
||||
- **Root Access:** Required for disk operations
|
||||
- **Dependencies:**
|
||||
- `parted`
|
||||
- `cryptsetup`
|
||||
- `lsblk`
|
||||
- `dd`
|
||||
- `sgdisk`
|
||||
- `wipefs`
|
||||
- `bc`
|
||||
- `fdisk`
|
||||
- `veracrypt` (The script can install this if not present).
|
||||
- `parted` - Partition management
|
||||
- `cryptsetup` - LUKS encryption
|
||||
- `lsblk` - Block device listing
|
||||
- `dd` - Disk writing
|
||||
- `sgdisk` - GPT partition manipulation
|
||||
- `wipefs` - Filesystem signature removal
|
||||
- `shred` - Secure data wiping
|
||||
- `bc` - Calculator for partition math
|
||||
- `fdisk` - Partition table manipulation
|
||||
- `veracrypt` - Document partition encryption
|
||||
- `lsof`, `fuser` - Process detection
|
||||
- `udevadm` - Device management
|
||||
|
||||
**Note:** The script will automatically detect missing dependencies and offer to install them.
|
||||
|
||||
## Installation
|
||||
|
||||
@@ -53,13 +60,14 @@ sudo ./covert_sd_card_tool.py [options]
|
||||
|
||||
### Command-Line Options
|
||||
|
||||
- `-a`, `--all` : Set up both the OS bootable USB and the documents partition.
|
||||
- `-k`, `--kali` : Create a Kali bootable USB and persistence partition.
|
||||
- `-t`, `--tails` : Create a Tails bootable USB (no persistence).
|
||||
- `-d`, `--docs` : Create an encrypted documents partition.
|
||||
- `-i`, `--iso` : Path to the Kali or Tails ISO file.
|
||||
- `--fast` : Enable fast setup with less secure encryption.
|
||||
- `--debug` : Enable debug mode.
|
||||
- `-a`, `--all` : Set up both the OS bootable USB and the documents partition (defaults to Kali)
|
||||
- `-k`, `--kali` : Create a Kali bootable USB and persistence partition
|
||||
- `-t`, `--tails` : Create a Tails bootable USB (no persistence, mutually exclusive with `-a`)
|
||||
- `-c`, `--custom` : Create a custom ISO bootable USB (uses Kali-style partitioning with persistence)
|
||||
- `-d`, `--docs` : Create an encrypted documents partition
|
||||
- `-i`, `--iso` : Path to the ISO file (Kali, Tails, or custom)
|
||||
- `--fast` : Enable fast setup mode (Note: Documents partition always uses maximum security)
|
||||
- `--debug` : Enable debug mode with verbose logging
|
||||
|
||||
### Examples
|
||||
|
||||
@@ -69,20 +77,192 @@ sudo ./covert_sd_card_tool.py [options]
|
||||
sudo ./covert_sd_card_tool.py -a -i /path/to/kali.iso
|
||||
```
|
||||
|
||||
- **Install Tails and Encrypted Documents Partition:**
|
||||
- **Install Tails with Encrypted Documents Partition:**
|
||||
|
||||
```bash
|
||||
sudo ./covert_sd_card_tool.py -a -t -i /path/to/tails.iso
|
||||
sudo ./covert_sd_card_tool.py -t -d -i /path/to/tails.iso
|
||||
```
|
||||
|
||||
- **Install Tails Without Encrypted Documents Partition:**
|
||||
- **Install Tails Only (No Documents Partition):**
|
||||
|
||||
```bash
|
||||
sudo ./covert_sd_card_tool.py -t -i /path/to/tails.iso
|
||||
```
|
||||
|
||||
- **Install Encrypted Documents Partition Only:**
|
||||
- **Create Encrypted Documents Partition Only (No OS):**
|
||||
|
||||
```bash
|
||||
sudo ./covert_sd_card_tool.py -d
|
||||
```
|
||||
```
|
||||
|
||||
- **Install Custom ISO (e.g., Parrot OS, BlackArch) with Persistence and Documents:**
|
||||
|
||||
```bash
|
||||
sudo ./covert_sd_card_tool.py -c -d -i /path/to/custom.iso
|
||||
```
|
||||
|
||||
- **Install Custom ISO with Persistence Only (No Documents):**
|
||||
|
||||
```bash
|
||||
sudo ./covert_sd_card_tool.py -c -i /path/to/custom.iso
|
||||
```
|
||||
|
||||
## Security Features
|
||||
|
||||
### Documents Partition Encryption
|
||||
|
||||
The documents partition uses **maximum security settings** regardless of the `--fast` flag:
|
||||
|
||||
- **Triple Cascade Encryption:** AES-Twofish-Serpent (3 layers)
|
||||
- **Hash Algorithm:** SHA-512
|
||||
- **Key Derivation:** PIM 2000 (enforced for strong key stretching)
|
||||
- **Filesystem:** ext4
|
||||
- **Full Format:** Always performs full format (no quick format) to overwrite old data
|
||||
|
||||
This configuration provides **military-grade security** suitable for sensitive documents like travel documents, credentials, and confidential files.
|
||||
|
||||
### Persistence Partition Encryption (Kali)
|
||||
|
||||
- **Normal Mode:** AES-XTS-PLAIN64, 512-bit keys, SHA-512, 5 second iteration time
|
||||
- **Fast Mode:** AES-CBC-ESSIV:SHA256, 256-bit keys, SHA-256, 1 second iteration time
|
||||
|
||||
### Secure Drive Wiping
|
||||
|
||||
When you choose to wipe the drive, the tool uses `shred`:
|
||||
- **3 passes** of random data overwriting
|
||||
- **Final pass** with zeros
|
||||
- Makes data recovery virtually impossible
|
||||
- Confirmation required (must type 'WIPE')
|
||||
|
||||
### OPSEC (Operational Security)
|
||||
|
||||
The generated helper scripts use **generic terminology** to avoid disclosing encryption methods:
|
||||
|
||||
- Scripts renamed to `mount_storage.sh` and `lock_storage.sh` (instead of mentioning encryption types)
|
||||
- README uses terms like "secure storage" instead of specific encryption names
|
||||
- No algorithm disclosure in user-facing documentation on the device
|
||||
- Suitable for travel scenarios where device inspection may occur
|
||||
|
||||
## Generated Helper Scripts
|
||||
|
||||
The tool creates a small unencrypted partition (TOOLS) containing:
|
||||
|
||||
### `mount_storage.sh`
|
||||
- Interactive script to mount the encrypted documents partition
|
||||
- Shows available devices and validates input
|
||||
- Mounts to `/mnt/secure_storage`
|
||||
- Clear error messages and success confirmations
|
||||
|
||||
### `lock_storage.sh`
|
||||
- Safely dismounts and locks the encrypted storage
|
||||
- Checks for open files before locking
|
||||
- Shows warnings if applications are still using the storage
|
||||
- Syncs pending writes before dismount
|
||||
- Prevents data loss from improper ejection
|
||||
|
||||
### `README.txt`
|
||||
- Simple instructions for non-technical users
|
||||
- Generic terminology (no encryption disclosure)
|
||||
- Step-by-step mount/lock procedures
|
||||
|
||||
## Important Security Notes
|
||||
|
||||
⚠️ **Password Strength:** Use strong passphrases (20+ characters, mixed case, numbers, symbols)
|
||||
|
||||
⚠️ **No Password Recovery:** If you forget your password, your data is **permanently inaccessible**
|
||||
|
||||
⚠️ **PIM Value:** The tool enforces PIM 2000 for documents partition - this adds 2-3 seconds to unlock time but massively increases security
|
||||
|
||||
⚠️ **Always Lock Before Removal:** Use `lock_storage.sh` before removing the device to prevent data corruption
|
||||
|
||||
⚠️ **Fast Mode:** While available for persistence partition, documents partition **always uses maximum security**
|
||||
|
||||
## Partition Layout Examples
|
||||
|
||||
### Kali + Documents (`-a`)
|
||||
1. **Partition 1:** Kali Live OS (bootable)
|
||||
2. **Partition 2:** LUKS encrypted persistence (configurable size, e.g., 4GB)
|
||||
3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
|
||||
4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
|
||||
|
||||
### Tails Only (`-t`)
|
||||
- **Entire Drive:** Tails Live OS (bootable, no additional partitions)
|
||||
|
||||
### Tails + Documents (`-t -d`)
|
||||
1. **Partition 1:** Tails Live OS (bootable, 12MB EFI System)
|
||||
2. **Partition 2:** Tails system partition (~2-3GB depending on Tails version)
|
||||
3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
|
||||
4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
|
||||
|
||||
### Documents Only (`-d`)
|
||||
1. **Partition 1:** VeraCrypt encrypted documents (remaining space minus 1GB)
|
||||
2. **Partition 2:** Unencrypted tools partition (1GB, FAT32, contains scripts)
|
||||
|
||||
### Custom ISO + Documents (`-c -d`)
|
||||
1. **Partition 1:** Custom Live OS (bootable)
|
||||
2. **Partition 2:** LUKS encrypted persistence (configurable size, e.g., 4GB)
|
||||
3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
|
||||
4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
|
||||
|
||||
**Note:** Custom ISO mode uses Kali-style partitioning. Works well with Debian-based live ISOs like Parrot OS, BlackArch, BackBox, etc.
|
||||
|
||||
## Using Custom ISOs
|
||||
|
||||
The `-c` (custom) flag allows you to use **any bootable ISO** and set it up with encrypted persistence and documents partitions. This is useful for:
|
||||
|
||||
### Compatible ISOs
|
||||
- **Parrot Security OS** - Privacy-focused security distro
|
||||
- **BlackArch Linux** - Penetration testing distro
|
||||
- **BackBox** - Ubuntu-based penetration testing
|
||||
- **Pentoo** - Gentoo-based security distro
|
||||
- **Any Debian/Ubuntu-based live ISO**
|
||||
|
||||
### How It Works
|
||||
Custom ISOs are treated like Kali Linux:
|
||||
1. ISO is flashed to the drive
|
||||
2. LUKS encrypted persistence partition is created (if you want settings to persist)
|
||||
3. VeraCrypt encrypted documents partition is added (if `-d` flag is used)
|
||||
4. Tools partition with mount/lock scripts
|
||||
|
||||
### Example: Parrot OS with Docs
|
||||
```bash
|
||||
sudo ./covert_sd_card_tool.py -c -d -i ~/Downloads/parrot-security.iso
|
||||
```
|
||||
|
||||
### Compatibility Notes
|
||||
- **Best for:** Debian/Ubuntu-based live ISOs
|
||||
- **May not work with:** Arch-based ISOs (different partition structure), Windows ISOs
|
||||
- **Persistence:** Depends on the ISO supporting LUKS persistence (Debian-based usually do)
|
||||
- If persistence doesn't work with your ISO, you can still use the documents partition
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Device Busy Errors
|
||||
- The tool automatically unmounts partitions and kills processes using the drive
|
||||
- If problems persist, manually unmount: `sudo umount /dev/sdX*`
|
||||
- Check for processes: `sudo lsof /dev/sdX`
|
||||
|
||||
### VeraCrypt Not Found
|
||||
- On Debian/Ubuntu: `sudo apt install veracrypt`
|
||||
- Or the script will offer to install it automatically
|
||||
|
||||
### Permission Denied
|
||||
- Always run with `sudo`
|
||||
- Ensure your user has sudo privileges
|
||||
|
||||
### Drive Not Detected
|
||||
- Check if drive is connected: `lsblk`
|
||||
- Verify drive path (e.g., `/dev/sdb` not `/dev/sdb1`)
|
||||
- Try unplugging and reconnecting the device
|
||||
|
||||
## License
|
||||
|
||||
This tool is provided as-is for educational and legitimate security purposes only. Use responsibly and in compliance with applicable laws.
|
||||
|
||||
## Contributing
|
||||
|
||||
Contributions, bug reports, and feature requests are welcome! Please open an issue or submit a pull request.
|
||||
|
||||
## Disclaimer
|
||||
|
||||
This tool performs destructive operations on storage devices. **Always verify you've selected the correct drive** before proceeding. The authors are not responsible for data loss.
|
||||
Reference in New Issue
Block a user