n0mad1k/CoM-covert_sd_card_tool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5b0ed2ba6721d1bd07f2316e47d7fb4e8ae72584
CoM-covert_sd_card_tool/README.md
T
n0mad1k 5b0ed2ba67 fixed issues and improved security
2025-10-19 23:33:43 -04:00

9.8 KiB
Raw Blame History

Covert SD Card Tool

Introduction

The Covert SD Card Tool is a Python script designed to automate the process of setting up a bootable USB/SD card with either Kali Linux or Tails OS. It includes options to create encrypted persistence partitions, secure document storage, and user-friendly access scripts. This tool simplifies the complex steps involved in preparing a secure, portable operating system on a USB drive or SD card.

Features

  • Install Kali Linux or Tails OS on a USB/SD card
  • Create an encrypted persistence partition for Kali Linux (LUKS encryption)
  • Create a maximum-security encrypted documents partition with triple-cascade encryption
  • Secure drive wiping using multi-pass shred for data sanitization
  • User-friendly access scripts for mounting and locking secure storage
  • OPSEC-focused design - generated scripts use generic terminology
  • Automated dependency checking and installation

Prerequisites

  • Operating System: Linux (Debian-based distributions recommended)
  • Python Version: Python 3.x
  • Root Access: Required for disk operations
  • Dependencies:
    • parted - Partition management
    • cryptsetup - LUKS encryption
    • lsblk - Block device listing
    • dd - Disk writing
    • sgdisk - GPT partition manipulation
    • wipefs - Filesystem signature removal
    • shred - Secure data wiping
    • bc - Calculator for partition math
    • fdisk - Partition table manipulation
    • veracrypt - Document partition encryption
    • lsof, fuser - Process detection
    • udevadm - Device management

Note: The script will automatically detect missing dependencies and offer to install them.

Installation

  1. Clone the Repository or Download the Script:

    git clone https://github.com/yourusername/covert_sd_card_tool.git
cd covert_sd_card_tool

  2. Make the Script Executable:

    chmod +x covert_sd_card_tool.py

Usage

Run the script with appropriate options:

sudo ./covert_sd_card_tool.py [options]

Command-Line Options

  • -a, --all : Set up both the OS bootable USB and the documents partition (defaults to Kali)
  • -k, --kali : Create a Kali bootable USB and persistence partition
  • -t, --tails : Create a Tails bootable USB (no persistence, mutually exclusive with -a)
  • -c, --custom : Create a custom ISO bootable USB (uses Kali-style partitioning with persistence)
  • -d, --docs : Create an encrypted documents partition
  • -i, --iso : Path to the ISO file (Kali, Tails, or custom)
  • --fast : Enable fast setup mode (Note: Documents partition always uses maximum security)
  • --debug : Enable debug mode with verbose logging

Examples

  • Install Kali with Encrypted Persistence and Encrypted Documents Partition:

    sudo ./covert_sd_card_tool.py -a -i /path/to/kali.iso

  • Install Tails with Encrypted Documents Partition:

    sudo ./covert_sd_card_tool.py -t -d -i /path/to/tails.iso

  • Install Tails Only (No Documents Partition):

    sudo ./covert_sd_card_tool.py -t -i /path/to/tails.iso

  • Create Encrypted Documents Partition Only (No OS):

    sudo ./covert_sd_card_tool.py -d

  • Install Custom ISO (e.g., Parrot OS, BlackArch) with Persistence and Documents:

    sudo ./covert_sd_card_tool.py -c -d -i /path/to/custom.iso

  • Install Custom ISO with Persistence Only (No Documents):

    sudo ./covert_sd_card_tool.py -c -i /path/to/custom.iso

Security Features

Documents Partition Encryption

The documents partition uses maximum security settings regardless of the --fast flag:

  • Triple Cascade Encryption: AES-Twofish-Serpent (3 layers)
  • Hash Algorithm: SHA-512
  • Key Derivation: PIM 2000 (enforced for strong key stretching)
  • Filesystem: ext4
  • Full Format: Always performs full format (no quick format) to overwrite old data

This configuration provides military-grade security suitable for sensitive documents like travel documents, credentials, and confidential files.

Persistence Partition Encryption (Kali)

  • Normal Mode: AES-XTS-PLAIN64, 512-bit keys, SHA-512, 5 second iteration time
  • Fast Mode: AES-CBC-ESSIV:SHA256, 256-bit keys, SHA-256, 1 second iteration time

Secure Drive Wiping

When you choose to wipe the drive, the tool uses shred:

  • 3 passes of random data overwriting
  • Final pass with zeros
  • Makes data recovery virtually impossible
  • Confirmation required (must type 'WIPE')

OPSEC (Operational Security)

The generated helper scripts use generic terminology to avoid disclosing encryption methods:

  • Scripts renamed to mount_storage.sh and lock_storage.sh (instead of mentioning encryption types)
  • README uses terms like "secure storage" instead of specific encryption names
  • No algorithm disclosure in user-facing documentation on the device
  • Suitable for travel scenarios where device inspection may occur

Generated Helper Scripts

The tool creates a small unencrypted partition (TOOLS) containing:

mount_storage.sh

  • Interactive script to mount the encrypted documents partition
  • Shows available devices and validates input
  • Mounts to /mnt/secure_storage
  • Clear error messages and success confirmations

lock_storage.sh

  • Safely dismounts and locks the encrypted storage
  • Checks for open files before locking
  • Shows warnings if applications are still using the storage
  • Syncs pending writes before dismount
  • Prevents data loss from improper ejection

README.txt

  • Simple instructions for non-technical users
  • Generic terminology (no encryption disclosure)
  • Step-by-step mount/lock procedures

Important Security Notes

⚠️ Password Strength: Use strong passphrases (20+ characters, mixed case, numbers, symbols)

⚠️ No Password Recovery: If you forget your password, your data is permanently inaccessible

⚠️ PIM Value: The tool enforces PIM 2000 for documents partition - this adds 2-3 seconds to unlock time but massively increases security

⚠️ Always Lock Before Removal: Use lock_storage.sh before removing the device to prevent data corruption

⚠️ Fast Mode: While available for persistence partition, documents partition always uses maximum security

Partition Layout Examples

Kali + Documents (-a)

  1. Partition 1: Kali Live OS (bootable)
  2. Partition 2: LUKS encrypted persistence (configurable size, e.g., 4GB)
  3. Partition 3: VeraCrypt encrypted documents (remaining space minus 1GB)
  4. Partition 4: Unencrypted tools partition (1GB, FAT32, contains scripts)

Tails Only (-t)

  • Entire Drive: Tails Live OS (bootable, no additional partitions)

Tails + Documents (-t -d)

  1. Partition 1: Tails Live OS (bootable, 12MB EFI System)
  2. Partition 2: Tails system partition (~2-3GB depending on Tails version)
  3. Partition 3: VeraCrypt encrypted documents (remaining space minus 1GB)
  4. Partition 4: Unencrypted tools partition (1GB, FAT32, contains scripts)

Documents Only (-d)

  1. Partition 1: VeraCrypt encrypted documents (remaining space minus 1GB)
  2. Partition 2: Unencrypted tools partition (1GB, FAT32, contains scripts)

Custom ISO + Documents (-c -d)

  1. Partition 1: Custom Live OS (bootable)
  2. Partition 2: LUKS encrypted persistence (configurable size, e.g., 4GB)
  3. Partition 3: VeraCrypt encrypted documents (remaining space minus 1GB)
  4. Partition 4: Unencrypted tools partition (1GB, FAT32, contains scripts)

Note: Custom ISO mode uses Kali-style partitioning. Works well with Debian-based live ISOs like Parrot OS, BlackArch, BackBox, etc.

Using Custom ISOs

The -c (custom) flag allows you to use any bootable ISO and set it up with encrypted persistence and documents partitions. This is useful for:

Compatible ISOs

  • Parrot Security OS - Privacy-focused security distro
  • BlackArch Linux - Penetration testing distro
  • BackBox - Ubuntu-based penetration testing
  • Pentoo - Gentoo-based security distro
  • Any Debian/Ubuntu-based live ISO

How It Works

Custom ISOs are treated like Kali Linux:

  1. ISO is flashed to the drive
  2. LUKS encrypted persistence partition is created (if you want settings to persist)
  3. VeraCrypt encrypted documents partition is added (if -d flag is used)
  4. Tools partition with mount/lock scripts

Example: Parrot OS with Docs

sudo ./covert_sd_card_tool.py -c -d -i ~/Downloads/parrot-security.iso

Compatibility Notes

  • Best for: Debian/Ubuntu-based live ISOs
  • May not work with: Arch-based ISOs (different partition structure), Windows ISOs
  • Persistence: Depends on the ISO supporting LUKS persistence (Debian-based usually do)
  • If persistence doesn't work with your ISO, you can still use the documents partition

Troubleshooting

Device Busy Errors

  • The tool automatically unmounts partitions and kills processes using the drive
  • If problems persist, manually unmount: sudo umount /dev/sdX*
  • Check for processes: sudo lsof /dev/sdX

VeraCrypt Not Found

  • On Debian/Ubuntu: sudo apt install veracrypt
  • Or the script will offer to install it automatically

Permission Denied

  • Always run with sudo
  • Ensure your user has sudo privileges

Drive Not Detected

  • Check if drive is connected: lsblk
  • Verify drive path (e.g., /dev/sdb not /dev/sdb1)
  • Try unplugging and reconnecting the device

License

This tool is provided as-is for educational and legitimate security purposes only. Use responsibly and in compliance with applicable laws.

Contributing

Contributions, bug reports, and feature requests are welcome! Please open an issue or submit a pull request.

Disclaimer

This tool performs destructive operations on storage devices. Always verify you've selected the correct drive before proceeding. The authors are not responsible for data loss.

Reference in New Issue View Git Blame Copy Permalink